Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 04:33
General
- Target 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe
- Size 74KB
- Sample260419-e6x4fahw7x
- SHA256 e8b4ec07ab68a7725e8681d1a153959c74d18530fc59bb76c938d1049a25d77c
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\rwwdw64d.exeC:\Windows\SysWOW64\rwwdw64d.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵
- Drops startup file
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Drops startup file
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵
- Drops startup file
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵
- Drops startup file
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-