Analysis
- max time kernel
151s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe
- Size 46.3MB
- Sample260808-dedp2sgl9v
- SHA256 3b9558afc1928b54af6612041a3b125d01d852afdccbe414ab594d02bdd7e62b
- MD5 b1b591ea69d114089036b80bb09dbaff
- SHA1 523b762069e0a6fc58e248d97383bdf9a804ff41
- SHA512 3235d7e1543994071fd6a318da0f6065c145916f25d6da51d06e62a48e75e591ca65045f1832603c613e484cac04b7b3ca30893d33d6ecee045f0f5ddbfc9c2a
- SSDEEP 49152:B11111111111111111111111111111111111111111111111111111111111111L:Z
- TLSH T170B7E1FF0035A285BEE19D4C5E9230F37BB85D486AA0F549A543EE4CDC0E4DAEE151AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 236 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4640 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6028 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4120 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4348 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4784 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3828 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5876 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4060 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5456 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2784 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5572 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5628 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5864 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2532 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6068 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5848 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5844 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1176 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3980 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4976 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5720 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3716 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5056 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6116 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3060 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4032 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 6136 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3496 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5304 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3096 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3216 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2888 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4832 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5808 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3748 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1472 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5084 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5024 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1376 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1692 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2344 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5888 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5756 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5732 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3268 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3356 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5656 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 3036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5156 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2700 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1944 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 1400 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4308 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5648 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2296 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 5744 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 716 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 4208 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 2372 cqurs Vurftbwrst Anty TSydf Prwo wppdmh - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqurs Vurftbwrst Anty TSydf Prwo wppdmh - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1000 wrote to memory of 1124 1000 2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe 88 PID 1124 wrote to memory of 236 1124 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 89 PID 236 wrote to memory of 4640 236 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 90 PID 4640 wrote to memory of 6028 4640 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 91 PID 6028 wrote to memory of 4120 6028 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 92 PID 4120 wrote to memory of 4348 4120 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 93 PID 4348 wrote to memory of 4784 4348 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 94 PID 4784 wrote to memory of 3828 4784 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 95 PID 3828 wrote to memory of 5876 3828 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 96 PID 5876 wrote to memory of 2548 5876 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 97 PID 2548 wrote to memory of 4060 2548 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 98 PID 4060 wrote to memory of 5456 4060 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 99 PID 5456 wrote to memory of 2784 5456 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 100 PID 2784 wrote to memory of 5572 2784 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 101 PID 5572 wrote to memory of 5628 5572 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 102 PID 5628 wrote to memory of 5864 5628 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 103 PID 5864 wrote to memory of 6092 5864 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 104 PID 6092 wrote to memory of 2532 6092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 105 PID 2532 wrote to memory of 6068 2532 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 106 PID 6068 wrote to memory of 5848 6068 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 107 PID 5848 wrote to memory of 5844 5848 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 108 PID 5844 wrote to memory of 1176 5844 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 109 PID 1176 wrote to memory of 3980 1176 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 110 PID 3980 wrote to memory of 4976 3980 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 111 PID 4976 wrote to memory of 5720 4976 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 112 PID 5720 wrote to memory of 3716 5720 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 113 PID 3716 wrote to memory of 5056 3716 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 114 PID 5056 wrote to memory of 6116 5056 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 115 PID 6116 wrote to memory of 3060 6116 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 116 PID 3060 wrote to memory of 4032 3060 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 117 PID 4032 wrote to memory of 6136 4032 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 118 PID 6136 wrote to memory of 3496 6136 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 119 PID 3496 wrote to memory of 5304 3496 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 120 PID 5304 wrote to memory of 3096 5304 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 121 PID 3096 wrote to memory of 3216 3096 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 122 PID 3216 wrote to memory of 2888 3216 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 123 PID 2888 wrote to memory of 4832 2888 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 124 PID 4832 wrote to memory of 5808 4832 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 125 PID 5808 wrote to memory of 3748 5808 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 126 PID 3748 wrote to memory of 1472 3748 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 127 PID 1472 wrote to memory of 5084 1472 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 128 PID 5084 wrote to memory of 5024 5084 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 129 PID 5024 wrote to memory of 4092 5024 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 130 PID 4092 wrote to memory of 1376 4092 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 131 PID 1376 wrote to memory of 1692 1376 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 132 PID 1692 wrote to memory of 2344 1692 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 133 PID 2344 wrote to memory of 5888 2344 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 134 PID 5888 wrote to memory of 5756 5888 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 135 PID 5756 wrote to memory of 5732 5756 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 136 PID 5732 wrote to memory of 3268 5732 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 137 PID 3268 wrote to memory of 3356 3268 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 138 PID 3356 wrote to memory of 5656 3356 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 139 PID 5656 wrote to memory of 3036 5656 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 140 PID 3036 wrote to memory of 5156 3036 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 141 PID 5156 wrote to memory of 2700 5156 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 142 PID 2700 wrote to memory of 1944 2700 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 143 PID 1944 wrote to memory of 1400 1944 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 144 PID 1400 wrote to memory of 4308 1400 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 145 PID 4308 wrote to memory of 5648 4308 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 146 PID 5648 wrote to memory of 2296 5648 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 147 PID 2296 wrote to memory of 5744 2296 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 148 PID 5744 wrote to memory of 716 5744 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 149 PID 716 wrote to memory of 4208 716 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 150 PID 4208 wrote to memory of 2372 4208 cqurs Vurftbwrst Anty TSydf Prwo wppdmh 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b1b591ea69d114089036b80bb09dbaff_elex_wannacry.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI65⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI66⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI67⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI68⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI69⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI70⤵PID:5516
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI71⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI72⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI73⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI74⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI75⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI76⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI77⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI78⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI79⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI80⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI81⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI82⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI83⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI84⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI85⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI86⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI87⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI88⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI89⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI90⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI91⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI92⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI93⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI94⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI95⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI96⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI97⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI98⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI99⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI100⤵
- System Location Discovery: System Language Discovery
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI101⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI102⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI103⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI104⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI105⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI106⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI107⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI108⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI109⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI110⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI111⤵
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI112⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI113⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI114⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI115⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI116⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI117⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI118⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI119⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI120⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI121⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\cqurs Vurftbwrst Anty TSydf Prwo wppdmhFI122⤵PID:3784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-