Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 08:30
General
- Target 2026-04-17_523619eca2aa820f66b11bf8be7aa799_elex_wannacry.exe
- Size 58KB
- Sample260417-kd64jacy31
- SHA256 cd90a514c0070378dcf4118c97e9f0d04388b92a232c63629ca5f87a4c42115c
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_523619eca2aa820f66b11bf8be7aa799_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_523619eca2aa820f66b11bf8be7aa799_elex_wannacry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\rwwdw64d.exeC:\Windows\SysWOW64\rwwdw64d.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵
- Drops file in System32 directory
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-