Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/11/2026, 15:07
General
- Target 2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe
- Size 1.0MB
- Sample261113-shj4kacz21
- SHA256 e6913be218dfd45487cafcd8d4ef0b7c48cd93227552991c44278c8e42589481
Malware Config
Signatures
- Checks computer location settings 2 TTPs 39 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 39 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 11 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wfvkwiek.exe"C:\Windows\system32\wfvkwiek.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmonk.exe"C:\Windows\system32\wmonk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wctap.exe"C:\Windows\system32\wctap.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wtxqjgm.exe"C:\Windows\system32\wtxqjgm.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wtkydd.exe"C:\Windows\system32\wtkydd.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wxnsd.exe"C:\Windows\system32\wxnsd.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wyalmhe.exe"C:\Windows\system32\wyalmhe.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmavv.exe"C:\Windows\system32\wmavv.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wksyadnx.exe"C:\Windows\system32\wksyadnx.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wwbbwb.exe"C:\Windows\system32\wwbbwb.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wrsebfclb.exe"C:\Windows\system32\wrsebfclb.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wgdy.exe"C:\Windows\system32\wgdy.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wlmgwiv.exe"C:\Windows\system32\wlmgwiv.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wqgwlt.exe"C:\Windows\system32\wqgwlt.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkcwsy.exe"C:\Windows\system32\wkcwsy.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\woawa.exe"C:\Windows\system32\woawa.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wyxcxmi.exe"C:\Windows\system32\wyxcxmi.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wriiia.exe"C:\Windows\system32\wriiia.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wxvwk.exe"C:\Windows\system32\wxvwk.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wexdpuxkq.exe"C:\Windows\system32\wexdpuxkq.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wsbwvmm.exe"C:\Windows\system32\wsbwvmm.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wjsdvb.exe"C:\Windows\system32\wjsdvb.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkuogupe.exe"C:\Windows\system32\wkuogupe.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\weckxfkj.exe"C:\Windows\system32\weckxfkj.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wftkcb.exe"C:\Windows\system32\wftkcb.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wstjpuh.exe"C:\Windows\system32\wstjpuh.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkufri.exe"C:\Windows\system32\wkufri.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wsgsuqjqg.exe"C:\Windows\system32\wsgsuqjqg.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wtgt.exe"C:\Windows\system32\wtgt.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wjnuncw.exe"C:\Windows\system32\wjnuncw.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wgnmhgn.exe"C:\Windows\system32\wgnmhgn.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wrmacbvo.exe"C:\Windows\system32\wrmacbvo.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wkehanci.exe"C:\Windows\system32\wkehanci.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wirduo.exe"C:\Windows\system32\wirduo.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\SysWOW64\wdurr.exe"C:\Windows\system32\wdurr.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wuhwcjav.exe"C:\Windows\system32\wuhwcjav.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wkrhewxc.exe"C:\Windows\system32\wkrhewxc.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wtsiy.exe"C:\Windows\system32\wtsiy.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wmsdbno.exe"C:\Windows\system32\wmsdbno.exe"40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtsiy.exe"40⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkrhewxc.exe"39⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuhwcjav.exe"38⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wdurr.exe"37⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wirduo.exe"36⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkehanci.exe"35⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrmacbvo.exe"34⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgnmhgn.exe"33⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjnuncw.exe"32⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 153632⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtgt.exe"31⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsgsuqjqg.exe"30⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 106030⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkufri.exe"29⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wstjpuh.exe"28⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wftkcb.exe"27⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weckxfkj.exe"26⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 145626⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkuogupe.exe"25⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 74825⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjsdvb.exe"24⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wsbwvmm.exe"23⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 168423⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wexdpuxkq.exe"22⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxvwk.exe"21⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wriiia.exe"20⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyxcxmi.exe"19⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 168819⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\woawa.exe"18⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkcwsy.exe"17⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wqgwlt.exe"16⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlmgwiv.exe"15⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 11615⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgdy.exe"14⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wrsebfclb.exe"13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wwbbwb.exe"12⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 140012⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wksyadnx.exe"11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmavv.exe"10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 166810⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyalmhe.exe"9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxnsd.exe"8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtkydd.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtxqjgm.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 10806⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wctap.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmonk.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfvkwiek.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 48521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3780 -ip 37801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2652 -ip 26521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1108 -ip 11081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3604 -ip 36041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 876 -ip 8761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1212 -ip 12121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2604 -ip 26041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4748 -ip 47481⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install[1].htm
wctap.exe
weckxfkj.exe
wexdpuxkq.exe
wftkcb.exe
wfvkwiek.exe
wgdy.exe
wgnmhgn.exe
wjnuncw.exe
wjsdvb.exe
wkcwsy.exe
wksyadnx.exe
wkufri.exe
wkuogupe.exe
wlmgwiv.exe
wmavv.exe
wmonk.exe
woawa.exe
wqgwlt.exe
wriiia.exe
wrmacbvo.exe
wrsebfclb.exe
wsbwvmm.exe
wsgsuqjqg.exe
wstjpuh.exe
wtgt.exe
wtkydd.exe
wtxqjgm.exe
wwbbwb.exe
wxnsd.exe
wxvwk.exe
wyalmhe.exe
wyxcxmi.exe
memory/876-257-0x0000000000400000-0x000000000050A000-memory.dmp
memory/876-245-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1056-393-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1056-383-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1108-119-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1108-132-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1212-278-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1460-213-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1460-224-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1472-401-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1472-411-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2244-374-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2244-384-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2440-223-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2440-235-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2568-179-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2568-192-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2584-36-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2584-24-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2604-321-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2604-333-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2612-13-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2612-0-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2612-1-0x0000000000414000-0x0000000000415000-memory.dmp
memory/2628-392-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2628-402-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2632-300-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2632-289-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2652-95-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2652-108-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3140-267-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3140-279-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3272-144-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3272-131-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3592-428-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3604-202-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3696-256-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3696-268-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3780-60-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3780-47-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3904-143-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3904-156-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3948-344-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3948-332-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4000-83-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4000-96-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4156-365-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4156-375-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4340-203-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4340-191-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4368-310-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4368-322-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4388-168-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4388-155-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4412-48-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4412-35-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4448-59-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4448-72-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4516-410-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4516-420-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4656-354-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4656-366-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4660-71-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4660-84-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4716-429-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4716-419-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4748-355-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4748-343-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4776-299-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4776-311-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4792-234-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4792-246-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4812-107-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4812-120-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4852-12-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4964-180-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4964-167-0x0000000000400000-0x000000000050A000-memory.dmp