0975f0cbb3e9bcf29554c8192d7dca17dc99dbb924dbb3632ad1d58f42f63e7a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe
Size 1.0MB
Sample260705-eay1vshs7w
SHA256 0975f0cbb3e9bcf29554c8192d7dca17dc99dbb924dbb3632ad1d58f42f63e7a
MD5 6d6dbe01bd405d321a6a08bb2ec431e0
SHA1 966fb73ac1f44f8ff301ffe24e887eb9177a5d5e
SHA512 5eab04a1a4272edd3368e059b99e5ca2126a540380e6c9016e7904fcb94f610a727a0f9a62888cbe89751e2e14af52752b89307732f7cdbb0343c741fd1e6275
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsod:jxPAPJmtE
TLSH
T1E835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wulrgxrt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wgbaiuv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wlnw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wsn.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wqlrbp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wcpwyse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wdgg.exe

Executes dropped EXE 8 IoCs

pid	Process
4060	wsn.exe
4728	wqlrbp.exe
2256	wulrgxrt.exe
2372	wgbaiuv.exe
4520	wcpwyse.exe
4044	wlnw.exe
3840	wdgg.exe
460	wvfmscs.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wdgg.exe	wlnw.exe
File opened for modification	C:\Windows\SysWOW64\wsn.exe	2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wqlrbp.exe	wsn.exe
File opened for modification	C:\Windows\SysWOW64\wvfmscs.exe	wdgg.exe
File opened for modification	C:\Windows\SysWOW64\wulrgxrt.exe	wqlrbp.exe
File opened for modification	C:\Windows\SysWOW64\wgbaiuv.exe	wulrgxrt.exe
File created	C:\Windows\SysWOW64\wcpwyse.exe	wgbaiuv.exe
File opened for modification	C:\Windows\SysWOW64\wcpwyse.exe	wgbaiuv.exe
File opened for modification	C:\Windows\SysWOW64\wdgg.exe	wlnw.exe
File created	C:\Windows\SysWOW64\wvfmscs.exe	wdgg.exe
File created	C:\Windows\SysWOW64\wjr.exe	wvfmscs.exe
File created	C:\Windows\SysWOW64\wqlrbp.exe	wsn.exe
File created	C:\Windows\SysWOW64\wulrgxrt.exe	wqlrbp.exe
File created	C:\Windows\SysWOW64\wlnw.exe	wcpwyse.exe
File created	C:\Windows\SysWOW64\wsn.exe	2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wgbaiuv.exe	wulrgxrt.exe
File opened for modification	C:\Windows\SysWOW64\wlnw.exe	wcpwyse.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4604	4060	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcpwyse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdgg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqlrbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wulrgxrt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgbaiuv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlnw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wvfmscs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4060	2732	2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe	87
PID 2732 wrote to memory of 4044	2732	2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe	89
PID 4060 wrote to memory of 4728	4060	wsn.exe	98
PID 4060 wrote to memory of 640	4060	wsn.exe	99
PID 4728 wrote to memory of 2256	4728	wqlrbp.exe	105
PID 4728 wrote to memory of 3152	4728	wqlrbp.exe	106
PID 2256 wrote to memory of 2372	2256	wulrgxrt.exe	109
PID 2256 wrote to memory of 4516	2256	wulrgxrt.exe	110
PID 2372 wrote to memory of 4520	2372	wgbaiuv.exe	112
PID 2372 wrote to memory of 3864	2372	wgbaiuv.exe	113
PID 4520 wrote to memory of 4044	4520	wcpwyse.exe	115
PID 4520 wrote to memory of 4772	4520	wcpwyse.exe	116
PID 4044 wrote to memory of 3840	4044	wlnw.exe	118
PID 4044 wrote to memory of 3304	4044	wlnw.exe	119
PID 3840 wrote to memory of 460	3840	wdgg.exe	121
PID 3840 wrote to memory of 4868	3840	wdgg.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\wsn.exe
  "C:\Windows\system32\wsn.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\wqlrbp.exe
    "C:\Windows\system32\wqlrbp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\wulrgxrt.exe
      "C:\Windows\system32\wulrgxrt.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\Windows\SysWOW64\wgbaiuv.exe
        
        "C:\Windows\system32\wgbaiuv.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2372
      - C:\Windows\SysWOW64\wcpwyse.exe
        
        "C:\Windows\system32\wcpwyse.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\wlnw.exe
        
        "C:\Windows\system32\wlnw.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\wdgg.exe
        
        "C:\Windows\system32\wdgg.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\wvfmscs.exe
        
        "C:\Windows\system32\wvfmscs.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdgg.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlnw.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcpwyse.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4772
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgbaiuv.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wulrgxrt.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqlrbp.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 1388
    3⤵
    - Program crash
    PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-05_6d6dbe01bd405d321a6a08bb2ec431e0_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4060 -ip 4060
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GI7SXTIE\install[2].htm
Size 341B
SHA256 faceb706d4b7fe88330c0affe20eaa97e2d4ab7fdd5206724896ac2f59cd8ca0
MD5 21dcd9c130d5994cc4275d7d96c7c77f
SHA1 a9bd12053de9283bd1c730ceb68458ece87f963b
SHA512 47cd7375c22d88804fa8358df7ff596945950008f70bde49db0ed2d6302cce24f49c08de660538f0e94c26718f1625bd934c53bffbe6660acaef3e45138576f0
TLSH
T1E3E0264A0B219415B41120981CD17278A48BA587EB7BCDB59BFFB0A1D900AD498AA918
MD5 SHA1 SHA512 TLSH

Submit Download

wcpwyse.exe

Path C:\Windows\SysWOW64\wcpwyse.exe
Size 1.0MB
SHA256 66db4a977a087fd2d64f2b43f2d177123fd4284456d90c8ed6c1e5a3b60841e3
MD5 1ec382794f2fef6cb46dc6de428a95b3
SHA1 67a1cfdd571400e2ecd73e8fcb49f0f7f2c406ee
SHA512 2330d73bf00a854dc9ada711101cb39e27f019f087867ea904602c80999a7dfd75aed561dc9364ddeb8828397e65279f9bde7a603a1c224ceab34e518e6fd8a9
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsov:jxPAPJmtk
TLSH
T16035A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdgg.exe

Path C:\Windows\SysWOW64\wdgg.exe
Size 1.0MB
SHA256 04b266f0a116ccaf2ec162c1ca8789985dbc8a6238ec6f9942f1115016e5d754
MD5 7f630846b34530c113ae60166650015b
SHA1 db76f6d87ba93ac6bd4670008a1bcbf5ec39ef1b
SHA512 5c9a977195ae08e8653b411aad79f4ba86f3e7fc941465214f7f33c45d006e8df50e68341b63a30318a557ab6a8f9affe8731e7bc36100536e2728ceebd4f9da
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso1:jxPAPJmtK
TLSH
T15835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgbaiuv.exe

Path C:\Windows\SysWOW64\wgbaiuv.exe
Size 1.0MB
SHA256 80c1a5208956a7072b7b59d98e064ea40fc7015efc613dfb872045cdc91d9637
MD5 d61bff03c7c0788d484dc3be5f221db4
SHA1 04ffcc3dbd31fcf4d7cc081dc92c30a0614f68a2
SHA512 497f2b12b28437e058201b1d97cfe9a3f3e392b0c4c7b154ee3491be63ec64c8854514b173b46720739e20311300ea7f22ae0cd9412e4c2da726f90fc1519782
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso9:jxPAPJmtQ
TLSH
T17335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlnw.exe

Path C:\Windows\SysWOW64\wlnw.exe
Size 1.0MB
SHA256 3ebff4a88e04a46a982ce0a4aaa73c2ab4bf214187ae65a413ff56eef235df6d
MD5 552407aa7ddd70bec4b4c1a6b594346f
SHA1 4d52e8dde4d7f6e8ac6df8d86545d69d17c33903
SHA512 368c17057c64a26af9d56c66cadfc169dfca65da3f02d8af1766d002e6fa49bb95b3cdbf783238651ff3a21dfc854f1e85a0dd0b1d4b944540750d1fa6a3bce5
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmtQ
TLSH
T16835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqlrbp.exe

Path C:\Windows\SysWOW64\wqlrbp.exe
Size 1.0MB
SHA256 2face0ebf92a767d23b1fc8e68779454543dc4777f698dd36665c20929ecdf77
MD5 6517bf1f4ffc4dc55f9820e6e3cabeba
SHA1 2c1a2417f11c837b61769afd1ce175a7ab8a72f9
SHA512 6021edc0f359504e634d5d347437a164de8b2fa781774313ebbbf14f60aed348060e355b4f6b2c0503addef71424da8c387137d531bf16fde965ce17b6dec2c9
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoA:jxPAPJmtV
TLSH
T19935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsn.exe

Path C:\Windows\SysWOW64\wsn.exe
Size 1.0MB
SHA256 849407000755ca51b81c03b333e258fc041240cdaf27fd02762460e6cf8e3f54
MD5 61f1667bf067a7fbf1be780500305b14
SHA1 cc81d1f0627557962e324c6efb976ab3eca3a632
SHA512 2412a943d4355fc5e9325ea1c972a04767348d738265f7c07ca77ab8c5e5fa8175655a76ff164be62c85770d3a63cf3c72c67f32dc0f0577560c8eef170f4347
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoX:jxPAPJmto
TLSH
T1E335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wulrgxrt.exe

Path C:\Windows\SysWOW64\wulrgxrt.exe
Size 1.0MB
SHA256 703336194af00aeb08af1e6105c2350e0fac890fd56e5bf846161f4e7e9f657e
MD5 8c8f06a5b6ddffdb7076bc0a12c7001c
SHA1 ac557c24f7945ec3690b7cc03d49d5211f589b5c
SHA512 eca454c80146264495f7e2bb2573f963a82cbfd6ee81ea65c13d64ea26756835240a621fdbd40b216572c719ee0841bde4ccc9c9b544c6e517f6e61a4267a978
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoz:jxPAPJmtQ
TLSH
T17435A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wvfmscs.exe

Path C:\Windows\SysWOW64\wvfmscs.exe
Size 1.0MB
SHA256 cf0656a069fa90d93a5e8d3e59d1ce6970100d32df67a2790cd093fd77107c77
MD5 5c5111511428be906b4a397394db4e50
SHA1 63f6bd13871c1e5b5a032e87a8e52eebaeb64d7c
SHA512 d08634288d4da418698bde015e15ad2051a173b3bc2e0232b1ee59786b7ca59672735065421e3e1e22dd2a54d657dab7d0eb6846859b7a3c439cb2d29a61242e
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso7:jxPAPJmtW
TLSH
T1AF35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-98-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/460-96-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2256-49-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2256-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2256-36-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2372-48-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2372-50-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2372-62-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2732-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2732-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/2732-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3840-97-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3840-84-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4044-72-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4044-85-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4060-25-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4060-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4060-12-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4520-73-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4520-61-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4728-37-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4728-24-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads