Overview

overview

8

Static

static

3

2026-06-27...at.exe

windows10-2004-x64

7

2026-06-27...at.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    119s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 06:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_67cab43c60b16e92aa1712f4eeaddbcb_elex_icedid_njrat.exe
  • Size 1.0MB
  • Sample260629-hblnpsfs2w
  • SHA256 6f932eb9b531ac6bb06a91f4951ec6bb92dfc1dcd5e6c224f3f628d8809f5137
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 15 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_67cab43c60b16e92aa1712f4eeaddbcb_elex_icedid_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_67cab43c60b16e92aa1712f4eeaddbcb_elex_icedid_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\SysWOW64\whvgp.exe
      "C:\Windows\system32\whvgp.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:756
      • C:\Windows\SysWOW64\wqtrjobc.exe
        "C:\Windows\system32\wqtrjobc.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\Windows\SysWOW64\wxeyj.exe
          "C:\Windows\system32\wxeyj.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:900
          • C:\Windows\SysWOW64\wbassc.exe
            "C:\Windows\system32\wbassc.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3184
            • C:\Windows\SysWOW64\wdyuvpbf.exe
              "C:\Windows\system32\wdyuvpbf.exe"
              6⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5300
              • C:\Windows\SysWOW64\wqdoyk.exe
                "C:\Windows\system32\wqdoyk.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1844
                • C:\Windows\SysWOW64\wev.exe
                  "C:\Windows\system32\wev.exe"
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4180
                  • C:\Windows\SysWOW64\wijnur.exe
                    "C:\Windows\system32\wijnur.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5912
                    • C:\Windows\SysWOW64\wcxyvwn.exe
                      "C:\Windows\system32\wcxyvwn.exe"
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4724
                      • C:\Windows\SysWOW64\wjdxke.exe
                        "C:\Windows\system32\wjdxke.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4988
                        • C:\Windows\SysWOW64\wqdt.exe
                          "C:\Windows\system32\wqdt.exe"
                          12⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2608
                          • C:\Windows\SysWOW64\wihjhn.exe
                            "C:\Windows\system32\wihjhn.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3820
                            • C:\Windows\SysWOW64\wfjvsqr.exe
                              "C:\Windows\system32\wfjvsqr.exe"
                              14⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1388
                              • C:\Windows\SysWOW64\wccxxt.exe
                                "C:\Windows\system32\wccxxt.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:5616
                                • C:\Windows\SysWOW64\wwquoxw.exe
                                  "C:\Windows\system32\wwquoxw.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  PID:1968
                                  • C:\Windows\SysWOW64\wwbgerkg.exe
                                    "C:\Windows\system32\wwbgerkg.exe"
                                    17⤵
                                      PID:5660
                                      • C:\Windows\SysWOW64\wwuoklj.exe
                                        "C:\Windows\system32\wwuoklj.exe"
                                        18⤵
                                          PID:3884
                                          • C:\Windows\SysWOW64\wcjwet.exe
                                            "C:\Windows\system32\wcjwet.exe"
                                            19⤵
                                              PID:4752
                                              • C:\Windows\SysWOW64\wssudf.exe
                                                "C:\Windows\system32\wssudf.exe"
                                                20⤵
                                                  PID:4668
                                                  • C:\Windows\SysWOW64\wdvjufe.exe
                                                    "C:\Windows\system32\wdvjufe.exe"
                                                    21⤵
                                                      PID:5092
                                                      • C:\Windows\SysWOW64\wquvf.exe
                                                        "C:\Windows\system32\wquvf.exe"
                                                        22⤵
                                                          PID:868
                                                          • C:\Windows\SysWOW64\wdogbl.exe
                                                            "C:\Windows\system32\wdogbl.exe"
                                                            23⤵
                                                              PID:3896
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wquvf.exe"
                                                              23⤵
                                                                PID:3284
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdvjufe.exe"
                                                              22⤵
                                                                PID:4584
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wssudf.exe"
                                                              21⤵
                                                                PID:5048
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcjwet.exe"
                                                              20⤵
                                                                PID:4312
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwuoklj.exe"
                                                              19⤵
                                                                PID:4476
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwbgerkg.exe"
                                                              18⤵
                                                                PID:1576
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwquoxw.exe"
                                                              17⤵
                                                                PID:2716
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  18⤵
                                                                    PID:3456
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wccxxt.exe"
                                                                16⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4284
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 924
                                                                16⤵
                                                                • Program crash
                                                                PID:3580
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfjvsqr.exe"
                                                              15⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2664
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wihjhn.exe"
                                                            14⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:2088
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqdt.exe"
                                                          13⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2640
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjdxke.exe"
                                                        12⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3896
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcxyvwn.exe"
                                                      11⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:6016
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wijnur.exe"
                                                    10⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3024
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wev.exe"
                                                  9⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4476
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqdoyk.exe"
                                                8⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:5648
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdyuvpbf.exe"
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3456
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbassc.exe"
                                            6⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2648
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1236
                                            6⤵
                                            • Program crash
                                            PID:1680
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxeyj.exe"
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5400
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 900 -s 1444
                                          5⤵
                                          • Program crash
                                          PID:1136
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqtrjobc.exe"
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5712
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whvgp.exe"
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1600
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-06-27_67cab43c60b16e92aa1712f4eeaddbcb_elex_icedid_njrat.exe"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3636
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of WriteProcessMemory
                                  PID:832
                                  • C:\Windows\explorer.exe
                                    explorer.exe /LOADSAVEDWINDOWS
                                    2⤵
                                    • Boot or Logon Autostart Execution: Active Setup
                                    • Enumerates connected drives
                                    • Checks SCSI registry key(s)
                                    • Modifies Internet Explorer settings
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3876
                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2384
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                  • Modifies registry class
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1324
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 900 -ip 900
                                  1⤵
                                    PID:3608
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3184 -ip 3184
                                    1⤵
                                      PID:5064
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5616 -ip 5616
                                      1⤵
                                        PID:4772

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 599B
                                            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 595B
                                            • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            wbassc.exe
                                            • Path C:\Windows\SysWOW64\wbassc.exe
                                            • Size 1.0MB
                                            • SHA256 3f14d6d638f100089071f07d56a741636ea3c0253dd7a2b58a205be2ca6a76cd
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wccxxt.exe
                                            • Path C:\Windows\SysWOW64\wccxxt.exe
                                            • Size 1.0MB
                                            • SHA256 4fc136064241e7f6adee283964d5593d4c103777fe920662b02edcd1b3686159
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wcjwet.exe
                                            • Path C:\Windows\SysWOW64\wcjwet.exe
                                            • Size 1.0MB
                                            • SHA256 af6e0f9552b3603c4f1999b8c3cc6879d84a8944e65be9a1bda5df07a08a3ba8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wcxyvwn.exe
                                            • Path C:\Windows\SysWOW64\wcxyvwn.exe
                                            • Size 1.0MB
                                            • SHA256 3aada0b8bd36037bd427d1e923b76ac34422afeb800a716440080558116e2bdf
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wdogbl.exe
                                            • Path C:\Windows\SysWOW64\wdogbl.exe
                                            • Size 1.0MB
                                            • SHA256 c7e8c9ab95f69aa3cd4abd9f31f724ee82a3c9e604a936e0622f5feffbc43c8b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wdvjufe.exe
                                            • Path C:\Windows\SysWOW64\wdvjufe.exe
                                            • Size 1.0MB
                                            • SHA256 57beab6c42aa3f3b60ca7e9a408661aaa8216781fafff36430e0afa630aba702
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wdyuvpbf.exe
                                            • Path C:\Windows\SysWOW64\wdyuvpbf.exe
                                            • Size 1.0MB
                                            • SHA256 f700f2fc0b693eed2572b1309bfdb145287eab7892895df582eea4786b447986
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wev.exe
                                            • Path C:\Windows\SysWOW64\wev.exe
                                            • Size 1.0MB
                                            • SHA256 24e4239619f59db088f587493bf7c5dc7a6c99ee2c2339a6e34abaef8d523de0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wfjvsqr.exe
                                            • Path C:\Windows\SysWOW64\wfjvsqr.exe
                                            • Size 1.0MB
                                            • SHA256 46d0fc9dacbbfd587522691fed35000d72a626df3ef789749f237fb39428512b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            whvgp.exe
                                            • Path C:\Windows\SysWOW64\whvgp.exe
                                            • Size 1.0MB
                                            • SHA256 29394d637aa13f8ad85dd60ece7568d8089377b3da52b28fa3192141036154b0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wihjhn.exe
                                            • Path C:\Windows\SysWOW64\wihjhn.exe
                                            • Size 1.0MB
                                            • SHA256 2665c698e0460bb87ef8e62ed8916dd29ce69221d2ed5510e6595f6fd1cc2822
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wijnur.exe
                                            • Path C:\Windows\SysWOW64\wijnur.exe
                                            • Size 1.0MB
                                            • SHA256 ad6ae0bc0c9bcb3c958872baa46515954267857a5d4043cfb6ce421dd13b59b2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wjdxke.exe
                                            • Path C:\Windows\SysWOW64\wjdxke.exe
                                            • Size 1.0MB
                                            • SHA256 0819b8677421a484472a69bb0f20186c38ee0b25ccd35fd9489306f1deae9a46
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wqdoyk.exe
                                            • Path C:\Windows\SysWOW64\wqdoyk.exe
                                            • Size 1.0MB
                                            • SHA256 d7dfdaf8530b798168238a87f1c5d842af449d3c6a368407ddbb851c001f5145
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wqdt.exe
                                            • Path C:\Windows\SysWOW64\wqdt.exe
                                            • Size 1.0MB
                                            • SHA256 1ce76a03fa90ba2f05af688293faeafd244a9b3da91b8e12c654b26c10e84fe6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wqtrjobc.exe
                                            • Path C:\Windows\SysWOW64\wqtrjobc.exe
                                            • Size 1.0MB
                                            • SHA256 bf88cfb93d99d8c299d88906827e2a558af693abd205291c262992ac8e61f33e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wquvf.exe
                                            • Path C:\Windows\SysWOW64\wquvf.exe
                                            • Size 1.0MB
                                            • SHA256 b11f30d41bddd61dd5a724b3172e638dfb8676bd00b3dc4b9ca7fa21098dfecb
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wssudf.exe
                                            • Path C:\Windows\SysWOW64\wssudf.exe
                                            • Size 1.0MB
                                            • SHA256 867477dda10b67f6b6c433f3a4b4a51cbbc845e3da4c8d92394f4965730ed701
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wwbgerkg.exe
                                            • Path C:\Windows\SysWOW64\wwbgerkg.exe
                                            • Size 1.0MB
                                            • SHA256 0729836b3e38968ce02442b0973371dfed82f91018f69784660cf3d8ba198b23
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wwquoxw.exe
                                            • Path C:\Windows\SysWOW64\wwquoxw.exe
                                            • Size 1.0MB
                                            • SHA256 9d75e8f2787786abeeefc4335f84f7b83e5a34f729598aafbd6e932cb83f9a1f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wwuoklj.exe
                                            • Path C:\Windows\SysWOW64\wwuoklj.exe
                                            • Size 1.0MB
                                            • SHA256 337121bd793d19e2bfe5d36e4c66a6703d3420e7bdcbb7fc696920a70bc2bfd2
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            wxeyj.exe
                                            • Path C:\Windows\SysWOW64\wxeyj.exe
                                            • Size 1.0MB
                                            • SHA256 0390c67fee3e13548ab88565c6ab33f375aff29aae833ae65a816c418cb29bee
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/756-28-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/756-16-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/756-14-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/868-491-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/900-241-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/900-235-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1324-240-0x000002271CF40000-0x000002271CF84000-memory.dmp
                                            Download

                                            memory/1324-239-0x000002271C260000-0x000002271C4FE000-memory.dmp
                                            Download

                                            memory/1388-389-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1388-377-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1624-0-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1624-15-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1624-3-0x0000000000414000-0x0000000000415000-memory.dmp
                                            Download

                                            memory/1624-2-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1624-1-0x0000000000414000-0x0000000000415000-memory.dmp
                                            Download

                                            memory/1844-282-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1844-295-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1968-402-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/1968-416-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/2384-95-0x00000187842F0000-0x0000018784310000-memory.dmp
                                            Download

                                            memory/2384-63-0x0000018784000000-0x0000018784100000-memory.dmp
                                            Download

                                            memory/2384-61-0x0000018781D10000-0x0000018781D30000-memory.dmp
                                            Download

                                            memory/2384-81-0x0000018781DD0000-0x0000018781DF0000-memory.dmp
                                            Download

                                            memory/2384-238-0x0000018FA11E0000-0x0000018FA147E000-memory.dmp
                                            Download

                                            memory/2384-32-0x00000187801E0000-0x00000187802E0000-memory.dmp
                                            Download

                                            memory/2608-350-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/2608-364-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3184-256-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3820-362-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3820-378-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3876-237-0x0000000006460000-0x00000000064A4000-memory.dmp
                                            Download

                                            memory/3884-440-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3884-427-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3896-489-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/3896-496-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4180-293-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4180-307-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4604-29-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4604-236-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4604-26-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4668-464-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4668-450-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4724-340-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4724-318-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4724-324-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4752-452-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4752-439-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4988-352-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/4988-339-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5092-462-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5092-476-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5300-271-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5300-283-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5616-404-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5660-428-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5660-414-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5912-319-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download

                                            memory/5912-305-0x0000000000400000-0x000000000050A000-memory.dmp
                                            Download