Analysis
- max time kernel
58s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe
- Size 46.3MB
- Sample260808-dedp2sgl9v
- SHA256 3b9558afc1928b54af6612041a3b125d01d852afdccbe414ab594d02bdd7e62b
- MD5 b1b591ea69d114089036b80bb09dbaff
- SHA1 523b762069e0a6fc58e248d97383bdf9a804ff41
- SHA512 3235d7e1543994071fd6a318da0f6065c145916f25d6da51d06e62a48e75e591ca65045f1832603c613e484cac04b7b3ca30893d33d6ecee045f0f5ddbfc9c2a
- SSDEEP 49152:B11111111111111111111111111111111111111111111111111111111111111L:Z
- TLSH T170B7E1FF0035A285BEE19D4C5E9230F37BB85D486AA0F549A543EE4CDC0E4DAEE151AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1856 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4460 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1680 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5108 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 416 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3024 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1228 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3832 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5008 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4792 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3048 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 552 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4452 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3288 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4976 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4220 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1868 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2428 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3216 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4372 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 816 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1888 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3872 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5072 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1704 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4788 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1072 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1672 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1764 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2224 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1736 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3572 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4064 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3164 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1048 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2300 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2512 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1904 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 204 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 116 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1064 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3320 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3804 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3196 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4120 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1008 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 440 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2128 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3364 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4832 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3520 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3084 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4920 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3168 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2192 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3136 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3160 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3584 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4336 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2640 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4448 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3904 cqurs Vurftbwrst Anty TSydf Prwo wppdmh - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1856 2072 2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe 84 PID 1856 wrote to memory of 4460 1856 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 85 PID 4460 wrote to memory of 1680 4460 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 86 PID 1680 wrote to memory of 5108 1680 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 87 PID 5108 wrote to memory of 416 5108 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 88 PID 416 wrote to memory of 3024 416 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 89 PID 3024 wrote to memory of 1228 3024 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 90 PID 1228 wrote to memory of 3832 1228 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 91 PID 3832 wrote to memory of 5008 3832 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 92 PID 5008 wrote to memory of 4792 5008 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 93 PID 4792 wrote to memory of 3048 4792 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 94 PID 3048 wrote to memory of 2092 3048 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 95 PID 2092 wrote to memory of 552 2092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 96 PID 552 wrote to memory of 4452 552 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 97 PID 4452 wrote to memory of 3288 4452 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 98 PID 3288 wrote to memory of 4976 3288 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 99 PID 4976 wrote to memory of 4220 4976 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 100 PID 4220 wrote to memory of 1868 4220 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 101 PID 1868 wrote to memory of 2428 1868 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 102 PID 2428 wrote to memory of 3216 2428 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 103 PID 3216 wrote to memory of 4372 3216 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 104 PID 4372 wrote to memory of 816 4372 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 105 PID 816 wrote to memory of 1888 816 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 106 PID 1888 wrote to memory of 3872 1888 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 107 PID 3872 wrote to memory of 5072 3872 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 108 PID 5072 wrote to memory of 1704 5072 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 109 PID 1704 wrote to memory of 4788 1704 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 110 PID 4788 wrote to memory of 1072 4788 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 111 PID 1072 wrote to memory of 1672 1072 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 112 PID 1672 wrote to memory of 1764 1672 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 113 PID 1764 wrote to memory of 2224 1764 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 114 PID 2224 wrote to memory of 1736 2224 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 115 PID 1736 wrote to memory of 3572 1736 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 116 PID 3572 wrote to memory of 4064 3572 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 117 PID 4064 wrote to memory of 3164 4064 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 118 PID 3164 wrote to memory of 1048 3164 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 119 PID 1048 wrote to memory of 2300 1048 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 120 PID 2300 wrote to memory of 2512 2300 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 121 PID 2512 wrote to memory of 1904 2512 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 122 PID 1904 wrote to memory of 204 1904 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 123 PID 204 wrote to memory of 116 204 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 124 PID 116 wrote to memory of 1064 116 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 125 PID 1064 wrote to memory of 3320 1064 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 126 PID 3320 wrote to memory of 3804 3320 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 127 PID 3804 wrote to memory of 3196 3804 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 128 PID 3196 wrote to memory of 4120 3196 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 129 PID 4120 wrote to memory of 1008 4120 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 130 PID 1008 wrote to memory of 440 1008 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 131 PID 440 wrote to memory of 2128 440 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 132 PID 2128 wrote to memory of 3364 2128 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 133 PID 3364 wrote to memory of 4832 3364 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 134 PID 4832 wrote to memory of 3520 4832 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 135 PID 3520 wrote to memory of 3084 3520 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 136 PID 3084 wrote to memory of 4276 3084 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 137 PID 4276 wrote to memory of 4920 4276 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 138 PID 4920 wrote to memory of 3168 4920 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 139 PID 3168 wrote to memory of 2192 3168 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 140 PID 2192 wrote to memory of 3136 2192 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 141 PID 3136 wrote to memory of 3160 3136 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 143 PID 3160 wrote to memory of 3584 3160 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 144 PID 3584 wrote to memory of 4336 3584 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 145 PID 4336 wrote to memory of 2640 4336 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 146 PID 2640 wrote to memory of 4448 2640 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 147 PID 4448 wrote to memory of 3904 4448 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI65⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI66⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI67⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI68⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI69⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI70⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI71⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI72⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI73⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI74⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI75⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI76⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI77⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI78⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI79⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI80⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI81⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI82⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI83⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI84⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI85⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI86⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI87⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI88⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI89⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI90⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI91⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI92⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI93⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI94⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI95⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI96⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI97⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI98⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI99⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI100⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI101⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI102⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI103⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI104⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI105⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI106⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI107⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI108⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI109⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI110⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI111⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI112⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI113⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI114⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI115⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI116⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI117⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI118⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI119⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI120⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI122⤵PID:1532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-