d12ee4b0d1b89b59cdb35d0206e82cb7def7064092f1cadffadf6e9ac4384571

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
Size 1.0MB
Sample260814-e81bksvwcs
SHA256 d12ee4b0d1b89b59cdb35d0206e82cb7def7064092f1cadffadf6e9ac4384571
MD5 44a23d0b6655a71ce09ac87f066e184c
SHA1 99dcb5fdbd366cf7ba2544116fa1552e479e16ba
SHA512 a4d97569797cdde07eaa4328e7eaa99d2826b0fc55ea02a531e03f374947526421b9e2c7318eb50f3565402ac747744b9dd19a355b7d218bc1d90e5a85ea8c84
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso+:jxPAPJmtH
TLSH
T12335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
4532	wcpwyse.exe
3296	wtitnx.exe
2368	wtdo.exe
5400	wexdpuxkq.exe
3360	weudym.exe
1172	wnnqdqh.exe
5172	wgeped.exe
5968	wmre.exe
3424	wuowkbws.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wexdpuxkq.exe	wtdo.exe
File opened for modification	C:\Windows\SysWOW64\weudym.exe	wexdpuxkq.exe
File opened for modification	C:\Windows\SysWOW64\wnnqdqh.exe	weudym.exe
File created	C:\Windows\SysWOW64\wmre.exe	wgeped.exe
File opened for modification	C:\Windows\SysWOW64\wmre.exe	wgeped.exe
File created	C:\Windows\SysWOW64\wgeped.exe	wnnqdqh.exe
File opened for modification	C:\Windows\SysWOW64\wgeped.exe	wnnqdqh.exe
File created	C:\Windows\SysWOW64\wcpwyse.exe	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
File opened for modification	C:\Windows\SysWOW64\wcpwyse.exe	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
File created	C:\Windows\SysWOW64\wtdo.exe	wtitnx.exe
File created	C:\Windows\SysWOW64\wexdpuxkq.exe	wtdo.exe
File created	C:\Windows\SysWOW64\weudym.exe	wexdpuxkq.exe
File created	C:\Windows\SysWOW64\wxkhwfa.exe	wuowkbws.exe
File created	C:\Windows\SysWOW64\wuowkbws.exe	wmre.exe
File opened for modification	C:\Windows\SysWOW64\wuowkbws.exe	wmre.exe
File created	C:\Windows\SysWOW64\wnnqdqh.exe	weudym.exe
File created	C:\Windows\SysWOW64\wtitnx.exe	wcpwyse.exe
File opened for modification	C:\Windows\SysWOW64\wtitnx.exe	wcpwyse.exe
File opened for modification	C:\Windows\SysWOW64\wtdo.exe	wtitnx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4528	3296	WerFault.exe	92
5332	3360	WerFault.exe	104
5888	1172	WerFault.exe	107

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wgeped.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtitnx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtdo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wnnqdqh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmre.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wexdpuxkq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	weudym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wcpwyse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuowkbws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5608 wrote to memory of 4532	5608	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe	89
PID 5608 wrote to memory of 2660	5608	2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe	90
PID 4532 wrote to memory of 3296	4532	wcpwyse.exe	92
PID 4532 wrote to memory of 3268	4532	wcpwyse.exe	93
PID 3296 wrote to memory of 2368	3296	wtitnx.exe	95
PID 3296 wrote to memory of 1784	3296	wtitnx.exe	96
PID 2368 wrote to memory of 5400	2368	wtdo.exe	101
PID 2368 wrote to memory of 1208	2368	wtdo.exe	102
PID 5400 wrote to memory of 3360	5400	wexdpuxkq.exe	104
PID 5400 wrote to memory of 1904	5400	wexdpuxkq.exe	105
PID 3360 wrote to memory of 1172	3360	weudym.exe	107
PID 3360 wrote to memory of 3920	3360	weudym.exe	108
PID 1172 wrote to memory of 5172	1172	wnnqdqh.exe	113
PID 1172 wrote to memory of 1604	1172	wnnqdqh.exe	114
PID 5172 wrote to memory of 5968	5172	wgeped.exe	118
PID 5172 wrote to memory of 2140	5172	wgeped.exe	119
PID 5968 wrote to memory of 3424	5968	wmre.exe	121
PID 5968 wrote to memory of 2376	5968	wmre.exe	122

C:\Users\Admin\AppData\Local\Temp\2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5608
- C:\Windows\SysWOW64\wcpwyse.exe
  "C:\Windows\system32\wcpwyse.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\wtitnx.exe
    "C:\Windows\system32\wtitnx.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\SysWOW64\wtdo.exe
      "C:\Windows\system32\wtdo.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\Windows\SysWOW64\wexdpuxkq.exe
        
        "C:\Windows\system32\wexdpuxkq.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5400
      - C:\Windows\SysWOW64\weudym.exe
        
        "C:\Windows\system32\weudym.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\wnnqdqh.exe
        
        "C:\Windows\system32\wnnqdqh.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        C:\Windows\SysWOW64\wgeped.exe
        
        "C:\Windows\system32\wgeped.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5172
        
        C:\Windows\SysWOW64\wmre.exe
        
        "C:\Windows\system32\wmre.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5968
        
        C:\Windows\SysWOW64\wuowkbws.exe
        
        "C:\Windows\system32\wuowkbws.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmre.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgeped.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnnqdqh.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 1772
        8⤵
        Program crash
        
        PID:5888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weudym.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 780
        7⤵
        Program crash
        
        PID:5332
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wexdpuxkq.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtdo.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtitnx.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1768
      4⤵
      Program crash
      PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcpwyse.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-08-14_44a23d0b6655a71ce09ac87f066e184c_elex_icedid_njrat.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3296 -ip 3296
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3360 -ip 3360
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1172 -ip 1172
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8PCNG0VN\install[2].htm
Size 1KB
SHA256 73f091e944f1a2133646754dd3e5a9480f941987498a5120579e2eb4b5b0d696
MD5 96a1a28fc6b2748c5825ecd901e4be3f
SHA1 a467fb3522cc2152b0cd4e39198f79f96e54c453
SHA512 c0aec69d9585741c0b0f7fa287bd47c8cb6660aaf700b5d70c77c2112c81ae2bf69be95315ba89ac1de4715c7f956db6c1d1a07e282353dfaaf3a2a6cf7bf5ec
TLSH
T1E411393707405415A861419C2DB1327DB44568DEFB2BCA71DF5FE3A14DD2FC149A5504
MD5 SHA1 SHA512 TLSH

Submit Download

wcpwyse.exe

Path C:\Windows\SysWOW64\wcpwyse.exe
Size 1.0MB
SHA256 2c53b0eb202771c1f17aed5ca619326c0952ffbb3218e35c21da79eb1126f17d
MD5 53c24fd4a2e17c2ad7569595abd4dfe3
SHA1 e53cb8f4067f530232b22baaf1d00ab9c4243dd2
SHA512 5d47ca9e0357b34d095f013fa2019fe8ef89b4d7cc70aae4c794652ef5ea847365b17e51fb4faf841a83eb5124316c52e611e5c0fd263192fe548632ff949a30
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoC:jxPAPJmtr
TLSH
T13135A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

weudym.exe

Path C:\Windows\SysWOW64\weudym.exe
Size 1.0MB
SHA256 227f937d231e8e9696821bfd9586ddbb08929e6d50ebf75d7218c55f0d0144b4
MD5 ce331a745ea985ddf3689bf1948e3b3e
SHA1 107ac2fded4261c163687406c1e8198d9105e496
SHA512 a36aecaf3c9d0ffd306c4ab7a7d67eb65e19c328ef71b2785ce4b2e590acf2e48b1d83b5586af32c0d18a0b9a7fd19e297b62b6992bf82ba722d37b61e4ac083
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoI:jxPAPJmtN
TLSH
T1C335A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wexdpuxkq.exe

Path C:\Windows\SysWOW64\wexdpuxkq.exe
Size 1.0MB
SHA256 30abf1d17769d853bdcfca74608369441b1cfc37a3d867b6d78a3b47d2f66e8e
MD5 3b6443618dff048ae93eb0f61cad9e11
SHA1 5b05e6b223a6d38e70b82cde7c0a89e987347d98
SHA512 239d5e0df2d64503b6a985ea677d5f3f93c94614757b4a60eb15cd41a07725e24888aa58122ebd3bc11f421a929b43d851607f3ca7ef9d60b7f3d01d8c05cae8
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoh:jxPAPJmt8
TLSH
T13D35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wgeped.exe

Path C:\Windows\SysWOW64\wgeped.exe
Size 1.0MB
SHA256 026c5408718205615371fca1a02aa34cb8b89e8cf989ca2863abcef5a8ed0c61
MD5 00a21283e1565082660330777a92fb1f
SHA1 534637872bfe3077ebd86dd0341022bcd308d34f
SHA512 93df32842d429faa8db5604b1566bca27afe173aaa6fce7498f71f4c0dc6342c17b8e93b5d36e96a2b3cb07b7a0a6af47df8e89725c4b245f39ca60df2e4dcfd
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoO:jxPAPJmt7
TLSH
T1CB35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmre.exe

Path C:\Windows\SysWOW64\wmre.exe
Size 1.0MB
SHA256 8a56e73ba665c4ba6442a0ecb05f89b806c735e5403788e051f5df02830fa4f8
MD5 d4dd820a74b873938aeecd47e88a0e3f
SHA1 48610ca612df8679a8c7e101477af80e0eb5ecfc
SHA512 ee13594de2527f8fc22378e914d18b3bfea28e40e064ddd89a529a71ca6208d070d706869bb8ba43b7dea3b87fc4071f75be38c57b544edc84e9dd5a3a3151e3
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoM:jxPAPJmth
TLSH
T1B735A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wnnqdqh.exe

Path C:\Windows\SysWOW64\wnnqdqh.exe
Size 1.0MB
SHA256 2334d63f0c471cdc8e1154c491714e57301b1c949ef657655672c1301e0bd1e3
MD5 b890ae8a80e09541361d851e83510db4
SHA1 690fa5db4b2731c5d28a41326416d7a7b23610b4
SHA512 01849f0f0623e66903894da701d12aefa28626e9fab53ae898e8224660c22cdd89b65178b911ec5c5c59d40a2f9b3c5bacf7d611c36818401d38e744b7479bd6
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsot:jxPAPJmtk
TLSH
T12235A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtdo.exe

Path C:\Windows\SysWOW64\wtdo.exe
Size 1.0MB
SHA256 eb0c23f2a44877d08f7fccdfe101b51bf616de163630f6bc465ee4491d6d457b
MD5 28988b58b3c0ce3832b7eb37ce193fb7
SHA1 476481df4c843409bedb447578c609a28e1c9551
SHA512 eadeb3f19009053e678606416f15cb36babdcf0ccb9c306ac283d2cee5c850fbe48038c6978881a781059ff3c0e317ecb5ead639c64102b4971a77760a9207d2
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nso0:jxPAPJmt1
TLSH
T1CF35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtitnx.exe

Path C:\Windows\SysWOW64\wtitnx.exe
Size 1.0MB
SHA256 51ec167aa438e61bddfab957bc90ce72d81000063e329d8128ded26777b6ea24
MD5 aa7b47c0c17fc4869e6bf39e88c2db5f
SHA1 0105323d7df0c767e3dddde48feb9e004b3ecbaf
SHA512 3667cdeb506275a95edd7a935efee242a9f0edc6ec8b4aa9d09f155f5c99cf1b6b78708f4cb3e34c4c89ea89a1e4bd3d98b3f5b37285a11aad3427f237926b5d
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoJ:jxPAPJmtQ
TLSH
T1CD35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuowkbws.exe

Path C:\Windows\SysWOW64\wuowkbws.exe
Size 1.0MB
SHA256 4f3afdf59df956ecdca3c1b44cd351e929121fd63ff4c29f5d5ff83e325b62ec
MD5 c845854d81a6013a3708d850386ecd1c
SHA1 020688dff1f682a23af06a5c2aea90bb5e5b5518
SHA512 204cea7738b70f5375b34b84875c47ebb042e8dda0e609253499dd6f17f583830ac08e51298748b069c671a860858fa6d51fa66a4273de210e67dde9dc6c9faf
SSDEEP 12288:jVer5+nZoyeLMA1tmer5+nIwaJNmozer5+nsoo:jxPAPJmtt
TLSH
T1EA35A113E3818AD5D7990932DE6481A0532AF02D6BFB16727A4C12CCDE57387BF65A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-80-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/1172-77-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2368-53-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/2368-39-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3296-26-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3360-79-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3360-64-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3424-119-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/3424-116-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4532-28-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/4532-14-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5172-104-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5172-90-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5172-92-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5400-51-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5400-66-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5608-3-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5608-2-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5608-1-0x0000000000414000-0x0000000000415000-memory.dmp

Download

memory/5608-15-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5608-0-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5968-102-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5968-105-0x0000000000400000-0x000000000050A000-memory.dmp

Download

memory/5968-118-0x0000000000400000-0x000000000050A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads