Analysis
- max time kernel
54s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 06:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe
- Size 70.0MB
- Sample260804-hevqsahn2s
- SHA256 8491d14586324c70b2cbf07b9b9d91f1a5ed596b31b88a0011556b4dff572b4d
- MD5 7dc1bd64b8a4ca8ba45dac279549543e
- SHA1 d852710f4591123d635e09f537474290a1b0bd0c
- SHA512 95a67a4d763c418a8461e69e4a401262b7775f787563fd6047494615b733ac047fa1626e744ea4f59031985da960077b943bc4f8718bbfbd3a8460fd95fae264
- SSDEEP 24576:n/5Fbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb+:6
- TLSH T1D8F7E1EA9525F0873CE285DF96CC6AC04A2F39FCB664D70D9D2CC535366C2112839E7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4680 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 416 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5108 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4892 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 464 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1100 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4408 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4620 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4828 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2184 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1436 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1040 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3260 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4380 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2120 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3920 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4988 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3884 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1700 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5008 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2056 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5040 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1828 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4992 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1696 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3272 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3196 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2268 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3152 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3988 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3148 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 116 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4052 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5048 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1304 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 64 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4360 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4520 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4472 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2012 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 724 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2228 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 984 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1204 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3924 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1468 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3708 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4976 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1900 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3208 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2852 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1228 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2432 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4400 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4500 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 540 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3564 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1592 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2080 cqurs Vurftbwrst Anty TSydf Prwo wppdmh - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 4680 2124 2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe 84 PID 4680 wrote to memory of 416 4680 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 85 PID 416 wrote to memory of 5108 416 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 86 PID 5108 wrote to memory of 4892 5108 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 87 PID 4892 wrote to memory of 464 4892 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 88 PID 464 wrote to memory of 1100 464 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 89 PID 1100 wrote to memory of 4408 1100 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 90 PID 4408 wrote to memory of 4620 4408 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 91 PID 4620 wrote to memory of 4828 4620 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 92 PID 4828 wrote to memory of 2184 4828 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 93 PID 2184 wrote to memory of 1436 2184 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 94 PID 1436 wrote to memory of 1040 1436 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 95 PID 1040 wrote to memory of 3260 1040 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 96 PID 3260 wrote to memory of 4380 3260 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 97 PID 4380 wrote to memory of 2120 4380 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 98 PID 2120 wrote to memory of 3920 2120 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 99 PID 3920 wrote to memory of 4988 3920 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 100 PID 4988 wrote to memory of 3884 4988 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 101 PID 3884 wrote to memory of 1092 3884 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 102 PID 1092 wrote to memory of 1700 1092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 103 PID 1700 wrote to memory of 5008 1700 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 104 PID 5008 wrote to memory of 2056 5008 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 105 PID 2056 wrote to memory of 548 2056 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 106 PID 548 wrote to memory of 5040 548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 107 PID 5040 wrote to memory of 1828 5040 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 108 PID 1828 wrote to memory of 4992 1828 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 109 PID 4992 wrote to memory of 1696 4992 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 110 PID 1696 wrote to memory of 3272 1696 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 111 PID 3272 wrote to memory of 3196 3272 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 112 PID 3196 wrote to memory of 2268 3196 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 113 PID 2268 wrote to memory of 3152 2268 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 114 PID 3152 wrote to memory of 3988 3152 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 115 PID 3988 wrote to memory of 3148 3988 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 116 PID 3148 wrote to memory of 116 3148 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 117 PID 116 wrote to memory of 4052 116 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 118 PID 4052 wrote to memory of 5048 4052 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 119 PID 5048 wrote to memory of 1304 5048 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 120 PID 1304 wrote to memory of 64 1304 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 121 PID 64 wrote to memory of 4360 64 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 122 PID 4360 wrote to memory of 4520 4360 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 123 PID 4520 wrote to memory of 4472 4520 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 124 PID 4472 wrote to memory of 2012 4472 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 125 PID 2012 wrote to memory of 724 2012 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 126 PID 724 wrote to memory of 2228 724 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 127 PID 2228 wrote to memory of 984 2228 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 128 PID 984 wrote to memory of 1204 984 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 129 PID 1204 wrote to memory of 4276 1204 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 130 PID 4276 wrote to memory of 3924 4276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 131 PID 3924 wrote to memory of 1468 3924 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 132 PID 1468 wrote to memory of 2548 1468 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 133 PID 2548 wrote to memory of 3708 2548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 134 PID 3708 wrote to memory of 4976 3708 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 135 PID 4976 wrote to memory of 1900 4976 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 136 PID 1900 wrote to memory of 4124 1900 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 137 PID 4124 wrote to memory of 3208 4124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 138 PID 3208 wrote to memory of 2852 3208 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 139 PID 2852 wrote to memory of 1228 2852 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 140 PID 1228 wrote to memory of 2432 1228 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 141 PID 2432 wrote to memory of 4400 2432 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 142 PID 4400 wrote to memory of 4500 4400 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 143 PID 4500 wrote to memory of 540 4500 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 144 PID 540 wrote to memory of 3564 540 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 145 PID 3564 wrote to memory of 1592 3564 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 146 PID 1592 wrote to memory of 2080 1592 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_7dc1bd64b8a4ca8ba45dac279549543e_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI65⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI66⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI67⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI69⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI70⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI72⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI73⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI74⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI75⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI76⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI77⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI78⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI79⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI80⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI81⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI82⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI83⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI84⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI85⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI86⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI87⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI88⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI89⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI90⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI91⤵
- System Location Discovery: System Language Discovery
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI93⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI94⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI95⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI96⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI97⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI98⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI99⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI100⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI101⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI102⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI103⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI104⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI105⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI106⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI107⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI108⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI109⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI110⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI111⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI112⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI113⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI114⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI115⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI116⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI117⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI118⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI119⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI120⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI121⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI122⤵PID:3168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-