Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe
- Size 74KB
- Sample260419-e6x4fahw7x
- SHA256 e8b4ec07ab68a7725e8681d1a153959c74d18530fc59bb76c938d1049a25d77c
- MD5 34d96dc459450ce33971ee471cf200d2
- SHA1 082a460566c019182e6a08fb511eebc79977018b
- SHA512 9db6063f541c004192fd9c9b4de32df14a4ebd9df20c3acc4f299722bd2a91139ab2f5da6057f77d34642d30ed56b21ad25034defe3a3eab638ea2a0539a6a72
- SSDEEP 768:FsFl3VOcV1OEqy7igfh9zuwrZXA6Wl9Oy2nfUECHpXuRNFCik5TRo7tJMW/c:FsBOppy7/hu4A6W+D3CEgdBW/c
- TLSH T1C873FA87AE594091E6159B70462D233FCA73A46E0B30D7A717D8DE3C7837181AC3A6B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe - Executes dropped EXE 64 IoCs
pid Process 600 rwwdw64d.exe 1272 rwwdw64d.exe 592 rwwdw64d.exe 4384 rwwdw64d.exe 4200 rwwdw64d.exe 1944 rwwdw64d.exe 3316 rwwdw64d.exe 1884 rwwdw64d.exe 2496 rwwdw64d.exe 4440 rwwdw64d.exe 2224 rwwdw64d.exe 764 rwwdw64d.exe 3264 rwwdw64d.exe 4112 rwwdw64d.exe 3232 rwwdw64d.exe 2140 rwwdw64d.exe 1684 rwwdw64d.exe 4984 rwwdw64d.exe 244 rwwdw64d.exe 4324 rwwdw64d.exe 760 rwwdw64d.exe 2760 rwwdw64d.exe 724 rwwdw64d.exe 3620 rwwdw64d.exe 1440 rwwdw64d.exe 3268 rwwdw64d.exe 2012 rwwdw64d.exe 2396 rwwdw64d.exe 1636 rwwdw64d.exe 4420 rwwdw64d.exe 728 rwwdw64d.exe 2108 rwwdw64d.exe 2296 rwwdw64d.exe 3652 rwwdw64d.exe 656 rwwdw64d.exe 4212 rwwdw64d.exe 1192 rwwdw64d.exe 4444 rwwdw64d.exe 2000 rwwdw64d.exe 4188 rwwdw64d.exe 1376 rwwdw64d.exe 3284 rwwdw64d.exe 1500 rwwdw64d.exe 4724 rwwdw64d.exe 1436 rwwdw64d.exe 1732 rwwdw64d.exe 2008 rwwdw64d.exe 4464 rwwdw64d.exe 4436 rwwdw64d.exe 4480 rwwdw64d.exe 3152 rwwdw64d.exe 2424 rwwdw64d.exe 4252 rwwdw64d.exe 4868 rwwdw64d.exe 2040 rwwdw64d.exe 4340 rwwdw64d.exe 2664 rwwdw64d.exe 788 rwwdw64d.exe 800 rwwdw64d.exe 2912 rwwdw64d.exe 4548 rwwdw64d.exe 4260 rwwdw64d.exe 4896 rwwdw64d.exe 4356 rwwdw64d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{66-66-69-9C-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{66-66-69-9C-DW} = "C:\\Windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{66-66-69-9C-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{66-66-69-9C-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe DWoli" 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification \??\c:\windows\SysWOW64\rwwdw64d.exe 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_19_04_26.log rwwdw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2584 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe 2584 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe 600 rwwdw64d.exe 600 rwwdw64d.exe 1272 rwwdw64d.exe 1272 rwwdw64d.exe 592 rwwdw64d.exe 592 rwwdw64d.exe 4384 rwwdw64d.exe 4384 rwwdw64d.exe 4200 rwwdw64d.exe 4200 rwwdw64d.exe 1944 rwwdw64d.exe 1944 rwwdw64d.exe 3316 rwwdw64d.exe 3316 rwwdw64d.exe 1884 rwwdw64d.exe 1884 rwwdw64d.exe 2496 rwwdw64d.exe 2496 rwwdw64d.exe 4440 rwwdw64d.exe 4440 rwwdw64d.exe 2224 rwwdw64d.exe 2224 rwwdw64d.exe 764 rwwdw64d.exe 764 rwwdw64d.exe 3264 rwwdw64d.exe 3264 rwwdw64d.exe 4112 rwwdw64d.exe 4112 rwwdw64d.exe 3232 rwwdw64d.exe 3232 rwwdw64d.exe 2140 rwwdw64d.exe 2140 rwwdw64d.exe 1684 rwwdw64d.exe 1684 rwwdw64d.exe 4984 rwwdw64d.exe 4984 rwwdw64d.exe 244 rwwdw64d.exe 244 rwwdw64d.exe 4324 rwwdw64d.exe 4324 rwwdw64d.exe 760 rwwdw64d.exe 760 rwwdw64d.exe 2760 rwwdw64d.exe 2760 rwwdw64d.exe 724 rwwdw64d.exe 724 rwwdw64d.exe 3620 rwwdw64d.exe 3620 rwwdw64d.exe 1440 rwwdw64d.exe 1440 rwwdw64d.exe 3268 rwwdw64d.exe 3268 rwwdw64d.exe 2012 rwwdw64d.exe 2012 rwwdw64d.exe 2396 rwwdw64d.exe 2396 rwwdw64d.exe 1636 rwwdw64d.exe 1636 rwwdw64d.exe 4420 rwwdw64d.exe 4420 rwwdw64d.exe 728 rwwdw64d.exe 728 rwwdw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 600 2584 2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe 80 PID 600 wrote to memory of 1272 600 rwwdw64d.exe 82 PID 1272 wrote to memory of 4384 1272 rwwdw64d.exe 86 PID 592 wrote to memory of 4200 592 rwwdw64d.exe 87 PID 4384 wrote to memory of 1944 4384 rwwdw64d.exe 88 PID 4200 wrote to memory of 3316 4200 rwwdw64d.exe 90 PID 1944 wrote to memory of 1884 1944 rwwdw64d.exe 91 PID 3316 wrote to memory of 2496 3316 rwwdw64d.exe 92 PID 1884 wrote to memory of 4440 1884 rwwdw64d.exe 93 PID 2496 wrote to memory of 2224 2496 rwwdw64d.exe 94 PID 4440 wrote to memory of 764 4440 rwwdw64d.exe 95 PID 2224 wrote to memory of 3264 2224 rwwdw64d.exe 96 PID 764 wrote to memory of 4112 764 rwwdw64d.exe 97 PID 3264 wrote to memory of 3232 3264 rwwdw64d.exe 98 PID 4112 wrote to memory of 2140 4112 rwwdw64d.exe 99 PID 3232 wrote to memory of 1684 3232 rwwdw64d.exe 100 PID 2140 wrote to memory of 4984 2140 rwwdw64d.exe 101 PID 1684 wrote to memory of 244 1684 rwwdw64d.exe 102 PID 4984 wrote to memory of 4324 4984 rwwdw64d.exe 103 PID 244 wrote to memory of 760 244 rwwdw64d.exe 104 PID 4324 wrote to memory of 2760 4324 rwwdw64d.exe 105 PID 760 wrote to memory of 724 760 rwwdw64d.exe 106 PID 2760 wrote to memory of 3620 2760 rwwdw64d.exe 107 PID 724 wrote to memory of 1440 724 rwwdw64d.exe 108 PID 3620 wrote to memory of 3268 3620 rwwdw64d.exe 109 PID 1440 wrote to memory of 2012 1440 rwwdw64d.exe 110 PID 3268 wrote to memory of 2396 3268 rwwdw64d.exe 111 PID 2012 wrote to memory of 1636 2012 rwwdw64d.exe 112 PID 2396 wrote to memory of 4420 2396 rwwdw64d.exe 113 PID 1636 wrote to memory of 728 1636 rwwdw64d.exe 114 PID 4420 wrote to memory of 2108 4420 rwwdw64d.exe 115 PID 728 wrote to memory of 2296 728 rwwdw64d.exe 116 PID 2108 wrote to memory of 3652 2108 rwwdw64d.exe 117 PID 2296 wrote to memory of 656 2296 rwwdw64d.exe 118 PID 3652 wrote to memory of 4212 3652 rwwdw64d.exe 119 PID 656 wrote to memory of 1192 656 rwwdw64d.exe 120 PID 4212 wrote to memory of 4444 4212 rwwdw64d.exe 121 PID 1192 wrote to memory of 2000 1192 rwwdw64d.exe 122 PID 4444 wrote to memory of 4188 4444 rwwdw64d.exe 123 PID 2000 wrote to memory of 1376 2000 rwwdw64d.exe 124 PID 4188 wrote to memory of 3284 4188 rwwdw64d.exe 125 PID 1376 wrote to memory of 1500 1376 rwwdw64d.exe 126 PID 3284 wrote to memory of 4724 3284 rwwdw64d.exe 127 PID 1500 wrote to memory of 1436 1500 rwwdw64d.exe 128 PID 4724 wrote to memory of 1732 4724 rwwdw64d.exe 129 PID 1436 wrote to memory of 2008 1436 rwwdw64d.exe 130 PID 1732 wrote to memory of 4464 1732 rwwdw64d.exe 131 PID 2008 wrote to memory of 4436 2008 rwwdw64d.exe 132 PID 4464 wrote to memory of 4480 4464 rwwdw64d.exe 133 PID 4436 wrote to memory of 3152 4436 rwwdw64d.exe 134 PID 4480 wrote to memory of 2424 4480 rwwdw64d.exe 135 PID 3152 wrote to memory of 4252 3152 rwwdw64d.exe 136 PID 2424 wrote to memory of 4868 2424 rwwdw64d.exe 137 PID 4252 wrote to memory of 2040 4252 rwwdw64d.exe 138 PID 4868 wrote to memory of 4340 4868 rwwdw64d.exe 139 PID 2040 wrote to memory of 2664 2040 rwwdw64d.exe 140 PID 4340 wrote to memory of 788 4340 rwwdw64d.exe 141 PID 2664 wrote to memory of 800 2664 rwwdw64d.exe 142 PID 788 wrote to memory of 2912 788 rwwdw64d.exe 143 PID 800 wrote to memory of 4548 800 rwwdw64d.exe 144 PID 2912 wrote to memory of 4260 2912 rwwdw64d.exe 145 PID 4548 wrote to memory of 4896 4548 rwwdw64d.exe 146 PID 4260 wrote to memory of 4356 4260 rwwdw64d.exe 147 PID 4896 wrote to memory of 1588 4896 rwwdw64d.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_34d96dc459450ce33971ee471cf200d2_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Executes dropped EXE
PID:4356 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Drops file in System32 directory
- Modifies registry class
PID:3704 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2024 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵PID:4160
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵
- Drops startup file
PID:2216 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵
- Modifies registry class
PID:3840 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Drops file in System32 directory
PID:5048 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵PID:1224
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵
- System Location Discovery: System Language Discovery
PID:392 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4848 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵PID:4460
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2976 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Drops file in System32 directory
- Modifies registry class
PID:668 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵
- System Location Discovery: System Language Discovery
PID:5080 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- Modifies registry class
PID:1676 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- Drops startup file
- Drops file in System32 directory
PID:4516 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- Drops file in System32 directory
PID:3896 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- Drops file in System32 directory
PID:1736 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Modifies registry class
PID:2712 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops file in System32 directory
PID:1828 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
- Drops startup file
- Modifies registry class
PID:4912 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3992 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵
- Drops startup file
PID:3836 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- System Location Discovery: System Language Discovery
PID:4416 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- Drops startup file
PID:4344 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Drops file in System32 directory
PID:2832 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵PID:852
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
- Modifies registry class
PID:660 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
- Drops file in System32 directory
PID:1256 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵PID:3132
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- Modifies registry class
PID:3976 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵PID:4500
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4812 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops startup file
PID:2308 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵PID:1952
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵PID:4504
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops file in System32 directory
- Modifies registry class
PID:784 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵PID:1776
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Modifies registry class
PID:3328 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵PID:2540
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵PID:3984
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- System Location Discovery: System Language Discovery
PID:5008 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- System Location Discovery: System Language Discovery
PID:3848 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- System Location Discovery: System Language Discovery
PID:4452 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- Modifies registry class
PID:3396 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵
- Drops startup file
- Drops file in System32 directory
PID:3740 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵PID:4092
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵PID:3472
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵PID:3100
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵
- System Location Discovery: System Language Discovery
PID:2952 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵
- Drops startup file
- Drops file in System32 directory
PID:1584 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵
- Drops file in System32 directory
- Modifies registry class
PID:4336 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵PID:3732
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵PID:3188
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵PID:2992
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- Modifies registry class
PID:2376 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵
- Drops file in System32 directory
PID:5096 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵PID:3760
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3192 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵PID:4484
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵PID:2152
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
- Modifies registry class
PID:2028 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵PID:3860
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Modifies registry class
PID:620 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵
- Modifies registry class
PID:4064 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵PID:1616
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵PID:4844
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵
- System Location Discovery: System Language Discovery
PID:2252 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵PID:3944
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵PID:1048
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵PID:1108
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵
- Drops file in System32 directory
PID:3084 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵
- Drops startup file
PID:4792 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵
- Modifies registry class
PID:916 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵
- System Location Discovery: System Language Discovery
PID:848 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵
- Drops file in System32 directory
PID:4088 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵PID:572
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵
- Modifies registry class
PID:2368 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵
- Drops startup file
PID:384 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵
- System Location Discovery: System Language Discovery
PID:4592 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1600 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵
- Drops startup file
PID:4992 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵
- Drops startup file
PID:3724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-