03fcd9c05777fca4fc4902deb34d5c68ff0cd3edc3eaa8f7baff34e330b74de3

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe
Size 1.0MB
Sample260711-ggcsbaew7s
SHA256 03fcd9c05777fca4fc4902deb34d5c68ff0cd3edc3eaa8f7baff34e330b74de3
MD5 ac4f53cb7596fced6be25073716ccece
SHA1 64e3c79007b485be48eca61c47a464c2d06512cf
SHA512 830064ffab41f7d4edc0e68348add7166504f9baec6dfaed3c29ecc1a02ccfddff1d343071d8c0c8bb17f83e2c3a0f262b362bc3ddfc2dd39610f0ae820c9367
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoE:jxPAPJmtJ
TLSH
T17635A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
5060	wlikctkh.exe
2980	wmynom.exe
3640	wnpyrdcl.exe
3972	wcplbu.exe
1872	wbli.exe
3296	wphoxyki.exe
3480	wnpiqvt.exe
4444	wwiv.exe
5096	wosncjg.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wlikctkh.exe	2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wnpyrdcl.exe	wmynom.exe
File opened for modification	C:\Windows\SysWOW64\wnpyrdcl.exe	wmynom.exe
File opened for modification	C:\Windows\SysWOW64\wcplbu.exe	wnpyrdcl.exe
File opened for modification	C:\Windows\SysWOW64\wmynom.exe	wlikctkh.exe
File created	C:\Windows\SysWOW64\wcplbu.exe	wnpyrdcl.exe
File opened for modification	C:\Windows\SysWOW64\wbli.exe	wcplbu.exe
File created	C:\Windows\SysWOW64\wnpiqvt.exe	wphoxyki.exe
File opened for modification	C:\Windows\SysWOW64\wwiv.exe	wnpiqvt.exe
File created	C:\Windows\SysWOW64\wpjavmbh.exe	wosncjg.exe
File opened for modification	C:\Windows\SysWOW64\wnpiqvt.exe	wphoxyki.exe
File created	C:\Windows\SysWOW64\wmynom.exe	wlikctkh.exe
File created	C:\Windows\SysWOW64\wbli.exe	wcplbu.exe
File created	C:\Windows\SysWOW64\wphoxyki.exe	wbli.exe
File opened for modification	C:\Windows\SysWOW64\wphoxyki.exe	wbli.exe
File created	C:\Windows\SysWOW64\wosncjg.exe	wwiv.exe
File opened for modification	C:\Windows\SysWOW64\wosncjg.exe	wwiv.exe
File created	C:\Windows\SysWOW64\wlikctkh.exe	2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wwiv.exe	wnpiqvt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4468	5060	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wbli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcplbu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnpiqvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wosncjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmynom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnpyrdcl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wwiv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlikctkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wphoxyki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 5060	4612	2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe	87
PID 4612 wrote to memory of 4100	4612	2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe	88
PID 5060 wrote to memory of 2980	5060	wlikctkh.exe	90
PID 5060 wrote to memory of 1388	5060	wlikctkh.exe	91
PID 2980 wrote to memory of 3640	2980	wmynom.exe	96
PID 2980 wrote to memory of 256	2980	wmynom.exe	97
PID 3640 wrote to memory of 3972	3640	wnpyrdcl.exe	99
PID 3640 wrote to memory of 5672	3640	wnpyrdcl.exe	100
PID 3972 wrote to memory of 1872	3972	wcplbu.exe	102
PID 3972 wrote to memory of 4832	3972	wcplbu.exe	103
PID 1872 wrote to memory of 3296	1872	wbli.exe	106
PID 1872 wrote to memory of 3992	1872	wbli.exe	107
PID 3296 wrote to memory of 3480	3296	wphoxyki.exe	109
PID 3296 wrote to memory of 1596	3296	wphoxyki.exe	110
PID 3480 wrote to memory of 4444	3480	wnpiqvt.exe	112
PID 3480 wrote to memory of 4308	3480	wnpiqvt.exe	113
PID 4444 wrote to memory of 5096	4444	wwiv.exe	115
PID 4444 wrote to memory of 3220	4444	wwiv.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\SysWOW64\wlikctkh.exe
  "C:\Windows\system32\wlikctkh.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\wmynom.exe
    "C:\Windows\system32\wmynom.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\wnpyrdcl.exe
      "C:\Windows\system32\wnpyrdcl.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3640
    - - C:\Windows\SysWOW64\wcplbu.exe
        
        "C:\Windows\system32\wcplbu.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Windows\SysWOW64\wbli.exe
        
        "C:\Windows\system32\wbli.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\wphoxyki.exe
        
        "C:\Windows\system32\wphoxyki.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\wnpiqvt.exe
        
        "C:\Windows\system32\wnpiqvt.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\wwiv.exe
        
        "C:\Windows\system32\wwiv.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\wosncjg.exe
        
        "C:\Windows\system32\wosncjg.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwiv.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:3220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnpiqvt.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wphoxyki.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbli.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3992
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcplbu.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnpyrdcl.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5672
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmynom.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:256
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlikctkh.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1508
    3⤵
    - Program crash
    PID:4468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-07-11_ac4f53cb7596fced6be25073716ccece_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5060 -ip 5060
1⤵
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SD49KLV2\install[2].htm
Size 341B
SHA256 faceb706d4b7fe88330c0affe20eaa97e2d4ab7fdd5206724896ac2f59cd8ca0
MD5 21dcd9c130d5994cc4275d7d96c7c77f
SHA1 a9bd12053de9283bd1c730ceb68458ece87f963b
SHA512 47cd7375c22d88804fa8358df7ff596945950008f70bde49db0ed2d6302cce24f49c08de660538f0e94c26718f1625bd934c53bffbe6660acaef3e45138576f0
TLSH
T1E3E0264A0B219415B41120981CD17278A48BA587EB7BCDB59BFFB0A1D900AD498AA918
MD5 SHA1 SHA512 TLSH

Submit Download

wbli.exe

Path C:\Windows\SysWOW64\wbli.exe
Size 1.0MB
SHA256 6906bbb7fc2bc71daaba810d793133261e593b08b35bc7bbec7955ea83f29ad3
MD5 eab66ab3d676557fe50e58d405ca2e14
SHA1 2e539e058be84fbc52c797a30b1f21e255324c0d
SHA512 c931b192d8cfb9e2a7c734ecac42396f10a7c9dbace84383307c639cf98a0267a3ed3781069dd36ebb00929781e04bf25d4923f48735781a6c3e5b2c6819d68a
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmtY
TLSH
T11C35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcplbu.exe

Path C:\Windows\SysWOW64\wcplbu.exe
Size 1.0MB
SHA256 952e97a1dd52bd4296e4eaa8a8da24521a31ee8ab4f74a1acb0d1a887679825f
MD5 8ab099c2853781ebf6e263461aaa31cc
SHA1 7bf0b8013f9a741668830f30e1ffe8dd4a7faf64
SHA512 196ace176b6c47a0c89c54659319e541f597807ef1f47e5c1c9774c6553184e27220579d5b3bd22a5abd52fcb61593781beb3a715039ab4309e837ea1fac9db6
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoB:jxPAPJmtM
TLSH
T1F935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlikctkh.exe

Path C:\Windows\SysWOW64\wlikctkh.exe
Size 1.0MB
SHA256 0892f3b239ea153385117451331170051ac2331affeb4b6999d0675bc633d805
MD5 b500b8909e8b52334e785298c6112fe4
SHA1 015b94b2160c9b666f4d151a94a61ca42ddfad35
SHA512 2c2662ae0f32f3f142690c4860769063bf715d24aad3563f7d447612bdf93f66ac840ef6be20655380d1224874d05866afa49d6f23a7e97c8f4bbefd8b8bc67d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso6:jxPAPJmtX
TLSH
T1AC35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmynom.exe

Path C:\Windows\SysWOW64\wmynom.exe
Size 1.0MB
SHA256 b986decd6a26c3634a46c70f841c515fe0218b12ace0156fed3f47720751d96a
MD5 2ebcba3fa57d02bd5a2f58e4359fc4de
SHA1 8609a5cb673e1bf2d36bf79e30f22bb2cec84945
SHA512 ee7dee5340a2af8684179a66d98a723d6d575c57864b15cfcacf4be3887fb4df19ba42bf982a7e4f892247f1c0b0f421c30f12ef945868005c8e6ab1666fcc25
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsor:jxPAPJmt2
TLSH
T19935A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65E3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnpiqvt.exe

Path C:\Windows\SysWOW64\wnpiqvt.exe
Size 1.0MB
SHA256 408b7c87eb19a56fc133dcc1a088edfbe49cbf47071608aac6543635b606f420
MD5 52a8585373c1d1ded7dcedcccb5084f7
SHA1 f49f196c0121edf628bfe89cdeb7601777bc61f7
SHA512 76ed3f4f940415aff12b20400d43bbc95ad398c452b1914637b06bf56217b39043cfecd1fbe20879d5a148f03293455793d301d0d071ce50796a7fae9c624da9
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso6:jxPAPJmt/
TLSH
T1BE35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnpyrdcl.exe

Path C:\Windows\SysWOW64\wnpyrdcl.exe
Size 1.0MB
SHA256 2312a78929dc92a7cd2546fadcf3397c83f35e8fc68a34388795f567397cb405
MD5 6aa6b71e776caf6ea78926c9c5d5f1f6
SHA1 ee58962a302ad6983a3b06ad942631690d2740ff
SHA512 89aad2aed17de5b2e320fc21ce2b64319b06f91ff604ed66e8d63b32bc991a42edebfb10eab7ade247d48fca2a4d7ece146ae708218f06fef210b12185691154
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoq:jxPAPJmtD
TLSH
T19E35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12C8DE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wosncjg.exe

Path C:\Windows\SysWOW64\wosncjg.exe
Size 1.0MB
SHA256 433da98864e4a41b6879807527d6b0f64ca598575323ccdb1eb0df5940716433
MD5 aa35e8d4c420cecea73bb7d1fbe737dc
SHA1 347854bad01bf11ace1f332550d92fbe9457fa9c
SHA512 e29e3daf6b13f3afedf6475efea50bc801f13aad886bccbd3cf96f3306b4075f4d1acbfa1cae0831578d6aa62d017c65c4a2798dad377b46057a694e26ecae6d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso7:jxPAPJmtu
TLSH
T1BB35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wphoxyki.exe

Path C:\Windows\SysWOW64\wphoxyki.exe
Size 1.0MB
SHA256 7c55942b0e3f6153f35adc8e44232d68bc49007ecdd994c8d63332394b2e966c
MD5 002fe10dbbbfd31610406a5344bb3db3
SHA1 aa4979ea6a810bb5849f64b9af29b5e5cc50a7dc
SHA512 cab8149c2ad519bdbd16280d6518d42383cd0c8b44b27238cf932dc9b991215a54cd940a9328470503b90fd47632c83ae87d427a62fc9d2dea9fafbe2b546974
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsog:jxPAPJmtB
TLSH
T17135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wwiv.exe

Path C:\Windows\SysWOW64\wwiv.exe
Size 1.0MB
SHA256 93a6bed7782e577fc7fe27a7836bd323b09d4f6ec9c88be4a167948cb776ba0c
MD5 ef9af4d7d9cfaf0ba1bab1df1d49922a
SHA1 8f88c9c880c3aa6fdb68a23235fb430bd01421d5
SHA512 595eedc2675fcb27a02e9fe88313ef99cfdf6f2f34ec68e56441e9b71f35f61fc7543d020374822c76156d29c6ff2e3ef9a9b98677156178347d3539d84939a4
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoJ:jxPAPJmtQ
TLSH
T15835A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1872-63-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1872-78-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1872-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2980-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2980-25-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3296-91-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3296-77-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3480-90-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3480-104-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3640-38-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3640-52-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3640-40-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3972-65-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3972-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4444-102-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4444-105-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4444-118-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4612-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4612-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4612-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5060-13-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5096-116-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5096-119-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads