Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 15:07
General
- Target 2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe
- Size 1.0MB
- Sample261113-shj4kacz21
- SHA256 e6913be218dfd45487cafcd8d4ef0b7c48cd93227552991c44278c8e42589481
Malware Config
Signatures
- Executes dropped EXE 35 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 17 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe"1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkkljb.exe"C:\Windows\system32\wkkljb.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpclm.exe"C:\Windows\system32\wmpclm.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wtxjs.exe"C:\Windows\system32\wtxjs.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whc.exe"C:\Windows\system32\whc.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wlljcd.exe"C:\Windows\system32\wlljcd.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wfelagd.exe"C:\Windows\system32\wfelagd.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wpvrkhh.exe"C:\Windows\system32\wpvrkhh.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wljodltlg.exe"C:\Windows\system32\wljodltlg.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuxtplxyf.exe"C:\Windows\system32\wuxtplxyf.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkiqn.exe"C:\Windows\system32\wkiqn.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wisem.exe"C:\Windows\system32\wisem.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wxwsr.exe"C:\Windows\system32\wxwsr.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wocjlsqy.exe"C:\Windows\system32\wocjlsqy.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\watxjos.exe"C:\Windows\system32\watxjos.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkjqwrnb.exe"C:\Windows\system32\wkjqwrnb.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wfxo.exe"C:\Windows\system32\wfxo.exe"17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wcpsp.exe"C:\Windows\system32\wcpsp.exe"18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmfld.exe"C:\Windows\system32\wmfld.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wpyed.exe"C:\Windows\system32\wpyed.exe"20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whbaghb.exe"C:\Windows\system32\whbaghb.exe"21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbn.exe"C:\Windows\system32\wbn.exe"22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wtaetd.exe"C:\Windows\system32\wtaetd.exe"23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wnvqdn.exe"C:\Windows\system32\wnvqdn.exe"24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wjgew.exe"C:\Windows\system32\wjgew.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wyamvaa.exe"C:\Windows\system32\wyamvaa.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wimayeqw.exe"C:\Windows\system32\wimayeqw.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wgijxffc.exe"C:\Windows\system32\wgijxffc.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wlkp.exe"C:\Windows\system32\wlkp.exe"29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wxcck.exe"C:\Windows\system32\wxcck.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpk.exe"C:\Windows\system32\wmpk.exe"31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wkjhljqto.exe"C:\Windows\system32\wkjhljqto.exe"32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\weyshwt.exe"C:\Windows\system32\weyshwt.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wtmuuns.exe"C:\Windows\system32\wtmuuns.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\SysWOW64\wkmqvafub.exe"C:\Windows\system32\wkmqvafub.exe"35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\wuoss.exe"C:\Windows\system32\wuoss.exe"36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkmqvafub.exe"36⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtmuuns.exe"35⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\weyshwt.exe"34⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkjhljqto.exe"33⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmpk.exe"32⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 128832⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 157232⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 55232⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 146032⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxcck.exe"31⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlkp.exe"30⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 154030⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 156030⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wgijxffc.exe"29⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wimayeqw.exe"28⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 169228⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 143628⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5264 -s 154428⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wyamvaa.exe"27⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wjgew.exe"26⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 176026⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wnvqdn.exe"25⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtaetd.exe"24⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wbn.exe"23⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whbaghb.exe"22⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpyed.exe"21⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmfld.exe"20⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wcpsp.exe"19⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfxo.exe"18⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkjqwrnb.exe"17⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\watxjos.exe"16⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wocjlsqy.exe"15⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wxwsr.exe"14⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wisem.exe"13⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 175213⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkiqn.exe"12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wuxtplxyf.exe"11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wljodltlg.exe"10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wpvrkhh.exe"9⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5936 -s 15409⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wfelagd.exe"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 17768⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 14288⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 5408⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 5488⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wlljcd.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\whc.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wtxjs.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmpclm.exe"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkkljb.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 12963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\2026-11-11_2c33ebf1e83595deee665836cb429c91_elex_icedid_njrat.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3568 -ip 35681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3124 -ip 31241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3124 -ip 31241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3124 -ip 31241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5936 -ip 59361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3124 -ip 31241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 576 -ip 5761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3808 -ip 38081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5264 -ip 52641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5264 -ip 52641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5264 -ip 52641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1132 -ip 11321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1132 -ip 11321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5488 -ip 54881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5488 -ip 54881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5488 -ip 54881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5488 -ip 54881⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
install[1].htm
watxjos.exe
wbn.exe
wcpsp.exe
weyshwt.exe
wfelagd.exe
wfxo.exe
wgijxffc.exe
whbaghb.exe
whc.exe
wimayeqw.exe
wisem.exe
wjgew.exe
wkiqn.exe
wkjhljqto.exe
wkjqwrnb.exe
wkkljb.exe
wljodltlg.exe
wlkp.exe
wlljcd.exe
wmfld.exe
wmpclm.exe
wmpk.exe
wnvqdn.exe
wocjlsqy.exe
wpvrkhh.exe
wpyed.exe
wtaetd.exe
wtxjs.exe
wuxtplxyf.exe
wxcck.exe
wxwsr.exe
wyamvaa.exe
memory/552-128-0x0000000000400000-0x000000000050A000-memory.dmp
memory/552-143-0x0000000000400000-0x000000000050A000-memory.dmp
memory/576-141-0x0000000000400000-0x000000000050A000-memory.dmp
memory/576-156-0x0000000000400000-0x000000000050A000-memory.dmp
memory/876-262-0x0000000000400000-0x000000000050A000-memory.dmp
memory/876-276-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1132-345-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1132-359-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1144-130-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1144-116-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1780-214-0x0000000000400000-0x000000000050A000-memory.dmp
memory/1780-228-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2412-405-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2412-394-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2592-395-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2592-381-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2732-117-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2872-37-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2872-53-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2920-154-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2920-168-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2948-240-0x0000000000400000-0x000000000050A000-memory.dmp
memory/2948-226-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3028-26-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3028-39-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3056-415-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3056-404-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3124-78-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3124-104-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3204-425-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3204-414-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3492-424-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3568-13-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3568-40-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3748-371-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3748-357-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3780-347-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3780-333-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3808-298-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3816-310-0x0000000000400000-0x000000000050A000-memory.dmp
memory/3816-323-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4148-51-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4148-66-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4716-288-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4716-274-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4784-190-0x0000000000400000-0x000000000050A000-memory.dmp
memory/4784-204-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5156-0-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5156-14-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5156-1-0x0000000000414000-0x0000000000415000-memory.dmp
memory/5264-321-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5264-335-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5380-166-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5380-180-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5428-238-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5428-252-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5436-216-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5436-203-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5488-369-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5488-383-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5504-64-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5504-79-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5720-300-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5720-286-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5816-192-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5816-178-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5936-103-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5936-91-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5968-250-0x0000000000400000-0x000000000050A000-memory.dmp
memory/5968-264-0x0000000000400000-0x000000000050A000-memory.dmp