Overview

overview

7

Static

static

3

2026-05-03...ry.exe

windows10-2004-x64

7

2026-05-03...ry.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/05/2026, 16:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-03_c43e0ac2d5ce1f6959a03811bc460838_elex_wannacry.exe
  • Size 58KB
  • Sample260503-vcfv3ahs7j
  • SHA256 f438f2a68c5d3acc62d56c5e92177394b20bfbe254efe73c64fca01093914925
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Drops startup file 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-03_c43e0ac2d5ce1f6959a03811bc460838_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-03_c43e0ac2d5ce1f6959a03811bc460838_elex_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3160
    • \??\c:\windows\SysWOW64\rwwdw64d.exe
      c:\windows\system32\rwwdw64d.exe DWoli
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4320
      • \??\c:\windows\SysWOW64\rwwdw64d.exe
        c:\windows\system32\rwwdw64d.exe DWoli
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4488
        • \??\c:\windows\SysWOW64\rwwdw64d.exe
          c:\windows\system32\rwwdw64d.exe DWoli
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2568
          • \??\c:\windows\SysWOW64\rwwdw64d.exe
            c:\windows\system32\rwwdw64d.exe DWoli
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1272
            • \??\c:\windows\SysWOW64\rwwdw64d.exe
              c:\windows\system32\rwwdw64d.exe DWoli
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5980
              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                c:\windows\system32\rwwdw64d.exe DWoli
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4452
                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                  c:\windows\system32\rwwdw64d.exe DWoli
                  8⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1668
                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                    c:\windows\system32\rwwdw64d.exe DWoli
                    9⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:5676
                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                      c:\windows\system32\rwwdw64d.exe DWoli
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4872
                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                        c:\windows\system32\rwwdw64d.exe DWoli
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1072
                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                          c:\windows\system32\rwwdw64d.exe DWoli
                          12⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2208
                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                            c:\windows\system32\rwwdw64d.exe DWoli
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:3808
                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                              c:\windows\system32\rwwdw64d.exe DWoli
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1792
                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                c:\windows\system32\rwwdw64d.exe DWoli
                                15⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1908
                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                  c:\windows\system32\rwwdw64d.exe DWoli
                                  16⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3080
                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                    c:\windows\system32\rwwdw64d.exe DWoli
                                    17⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4416
                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                      c:\windows\system32\rwwdw64d.exe DWoli
                                      18⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Suspicious use of WriteProcessMemory
                                      PID:1856
                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                        c:\windows\system32\rwwdw64d.exe DWoli
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:6140
                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                          c:\windows\system32\rwwdw64d.exe DWoli
                                          20⤵
                                          • Drops startup file
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:3244
                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                            c:\windows\system32\rwwdw64d.exe DWoli
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2060
                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                              c:\windows\system32\rwwdw64d.exe DWoli
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:3368
                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:5232
                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1136
                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2992
                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3800
                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4804
                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3656
                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                            29⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4660
                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4788
                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                31⤵
                                                                • Drops startup file
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2356
                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1376
                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                    33⤵
                                                                    • Drops startup file
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3964
                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                      34⤵
                                                                      • Drops startup file
                                                                      • Executes dropped EXE
                                                                      PID:4836
                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                        35⤵
                                                                        • Drops file in System32 directory
                                                                        PID:3952
                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                          36⤵
                                                                            PID:3916
                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                              37⤵
                                                                              • Drops startup file
                                                                              PID:5640
                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                38⤵
                                                                                • Drops startup file
                                                                                • Drops file in System32 directory
                                                                                PID:3544
                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                  39⤵
                                                                                  • Drops file in System32 directory
                                                                                  PID:5008
                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                    40⤵
                                                                                    • Drops startup file
                                                                                    PID:3344
                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                      41⤵
                                                                                        PID:4316
                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                          42⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:3204
                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                            43⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3008
                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                              44⤵
                                                                                              • Drops file in System32 directory
                                                                                              PID:2196
                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                45⤵
                                                                                                  PID:4168
                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                    46⤵
                                                                                                    • Drops startup file
                                                                                                    • Modifies registry class
                                                                                                    PID:3556
                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                      47⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      PID:1936
                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                        48⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:6116
                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                          49⤵
                                                                                                          • Drops startup file
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3820
                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                            50⤵
                                                                                                              PID:4440
                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                51⤵
                                                                                                                  PID:3920
                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                    52⤵
                                                                                                                    • Modifies registry class
                                                                                                                    PID:2680
                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                      53⤵
                                                                                                                      • Drops file in System32 directory
                                                                                                                      PID:4616
                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                        54⤵
                                                                                                                          PID:772
                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                            55⤵
                                                                                                                            • Drops startup file
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2148
                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                              56⤵
                                                                                                                                PID:4092
                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                  57⤵
                                                                                                                                    PID:5516
                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                      58⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:1972
                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                        59⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:3912
                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                          60⤵
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          PID:2828
                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                            61⤵
                                                                                                                                            • Drops startup file
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5400
                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                              62⤵
                                                                                                                                              • Drops startup file
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:5508
                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                63⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:6124
                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                  64⤵
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  PID:5556
                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                    65⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:2004
                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                      66⤵
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:3132
                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                        67⤵
                                                                                                                                                          PID:1584
                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                            68⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5624
                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                              69⤵
                                                                                                                                                                PID:3292
                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                  70⤵
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:248
                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                    71⤵
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    PID:4860
                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                      72⤵
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:384
                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                        73⤵
                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:3024
                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                          74⤵
                                                                                                                                                                          • Drops startup file
                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                          PID:5088
                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                            75⤵
                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5388
                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                              76⤵
                                                                                                                                                                                PID:1040
                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                  77⤵
                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:4504
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                    78⤵
                                                                                                                                                                                      PID:2864
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                        79⤵
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        PID:4844
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                          80⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5068
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                            81⤵
                                                                                                                                                                                              PID:5156
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                82⤵
                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                PID:4716
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                  83⤵
                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      PID:4736
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:1748
                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                PID:2140
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                                      PID:1720
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                PID:5536
                                    • C:\Windows\SysWOW64\rwwdw64d.exe
                                      C:\Windows\SysWOW64\rwwdw64d.exe
                                      1⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Drops file in System32 directory
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:4468
                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                        c:\windows\system32\rwwdw64d.exe DWoli
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:1788
                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                          c:\windows\system32\rwwdw64d.exe DWoli
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3300
                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                            c:\windows\system32\rwwdw64d.exe DWoli
                                            4⤵
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:4672
                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                              c:\windows\system32\rwwdw64d.exe DWoli
                                              5⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:5256
                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                6⤵
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:5748
                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                  7⤵
                                                  • Drops startup file
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5708
                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                    8⤵
                                                    • Drops startup file
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:892
                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                      9⤵
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5712
                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2128
                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                          11⤵
                                                          • Drops startup file
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2952
                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                            12⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4456
                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                              13⤵
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1700
                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                14⤵
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5528
                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                  15⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2068
                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                    16⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5512
                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                      17⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1640
                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                        18⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5260
                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                          19⤵
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4808
                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                            20⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5248
                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                              21⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2596
                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                22⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3112
                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                  23⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2548
                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                    24⤵
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3352
                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                      25⤵
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5428
                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                        26⤵
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2688
                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                          27⤵
                                                                                          • Executes dropped EXE
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5420
                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                            28⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3784
                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                              29⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3472
                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                30⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1416
                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                  31⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4056
                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                    32⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1052
                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                      33⤵
                                                                                                        PID:6028
                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                          34⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          PID:2852
                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                            35⤵
                                                                                                              PID:4448
                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                36⤵
                                                                                                                  PID:4728
                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                    37⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Modifies registry class
                                                                                                                    PID:4508
                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                      38⤵
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5080
                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                        39⤵
                                                                                                                        • Drops file in System32 directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies registry class
                                                                                                                        PID:5064
                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                          40⤵
                                                                                                                          • Drops startup file
                                                                                                                          • Modifies registry class
                                                                                                                          PID:1044
                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                            41⤵
                                                                                                                            • Drops startup file
                                                                                                                            • Modifies registry class
                                                                                                                            PID:5308
                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                              42⤵
                                                                                                                              • Drops startup file
                                                                                                                              PID:3052
                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                43⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Modifies registry class
                                                                                                                                PID:2592
                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                  44⤵
                                                                                                                                    PID:5924
                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                      45⤵
                                                                                                                                      • Drops startup file
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:1344
                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                        46⤵
                                                                                                                                        • Drops startup file
                                                                                                                                        PID:1312
                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                          47⤵
                                                                                                                                          • Drops startup file
                                                                                                                                          PID:3516
                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                            48⤵
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:5584
                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                              49⤵
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              PID:5332
                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                50⤵
                                                                                                                                                • Drops startup file
                                                                                                                                                PID:1292
                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                  51⤵
                                                                                                                                                  • Drops startup file
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  PID:728
                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                    52⤵
                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                    PID:1472
                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                      53⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:2256
                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                        54⤵
                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                        PID:3136
                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                          55⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:3180
                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                            56⤵
                                                                                                                                                              PID:6072
                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                57⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1304
                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                  58⤵
                                                                                                                                                                  • Drops startup file
                                                                                                                                                                  PID:6020
                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                    59⤵
                                                                                                                                                                      PID:3884
                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                        60⤵
                                                                                                                                                                        • Drops startup file
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:400
                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                          61⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:6092
                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                            62⤵
                                                                                                                                                                            • Drops startup file
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5224
                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                              63⤵
                                                                                                                                                                                PID:1876
                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                  64⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                  PID:3000
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                    65⤵
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                    PID:5680
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                      66⤵
                                                                                                                                                                                        PID:5664
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                          67⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:768
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                            68⤵
                                                                                                                                                                                              PID:3012
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                69⤵
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:2316
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                  70⤵
                                                                                                                                                                                                    PID:5392
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                            73⤵
                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                74⤵
                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                  75⤵
                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:428
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    PID:4816
                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                      77⤵
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4088
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                        78⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2728
                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                          79⤵
                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:4684
                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                              PID:4432
                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                  82⤵
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:3064
                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                    83⤵
                                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5760
                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                      84⤵
                                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                                      PID:1440
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                            86⤵
                                                                                                                                                                                                                                              PID:3356
                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                87⤵
                                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1608
                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:2324
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                      PID:4712
                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3992
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:3652
                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                                                                              PID:1764
                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                  PID:1892
                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3648
                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        PID:4528
                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                                          PID:5572
                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            PID:6128
                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:5176
                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                                                        PID:2720
                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5240
                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                                                                                                                            PID:976
                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                                                                PID:2084
                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                                                                    PID:3296
                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:32
                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2644
                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                                                                                PID:3248
                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2040
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3904
                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:1140
                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                                                                              PID:5356
                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                PID:3260
                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                  PID:1308
                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                    PID:5300
                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                                                                        PID:2584
                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                          PID:5184
                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                            PID:4292
                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                PID:1880
                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4928
                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2432
                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2804

                                                                                            Network

                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 023f03429eb6f789ed901996378ce37754b1a48a97864ce892ac702b390a87d6
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 0cd2626c55b10e6bd4c34122e75145b8a065c91eaa4d881b36dfee4a504afdd8
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 84229286265f8593edf19ed548bc86bb32f0c6ca6b4043d0c39c1837ed3e1567
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 0286401f011f5fdbefb403712f6fe319f25ccba2fda178d720f8d30c54010a30
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 6b973b334a74068b1a3c7f8d369a0360652a22f843b3a899e7633bc227c9d9cf
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 56819501529c1fb84b20abd6adfa15ad8c9ef65d1318e9c1d4b26fc4f1c7b84c
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 cc3a9c3e78e1d52b08f053c08e8de99237c16881f00d7516b6ffa8e532d72261
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 6dd1e30d38e89d79d124d151b36569b6186394b05f7af702de47d2983fd73e97
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  DW_Start.lnk
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                                                                  • Size 987B
                                                                                                  • SHA256 a4f04780cf7c964f843985e6bc6305261b3c3ac212bbfc2ec28f75a3a4feb8d9
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  msnav32.ax
                                                                                                  • Path C:\Windows\SysWOW64\msnav32.ax
                                                                                                  • Size 16B
                                                                                                  • SHA256 085fd403608dbdb9b5dac45db2f43ed16dfe6076acc9ba69080719e4380316d7
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  rwwdw64d.exe
                                                                                                  • Path C:\Windows\SysWOW64\rwwdw64d.exe
                                                                                                  • Size 58KB
                                                                                                  • SHA256 34340e063895c388c63d53f5d19e6663817a13dc3665aee332fb7bc9801bb785
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  memory/892-78-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1072-82-0x0000000000870000-0x0000000000982000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1136-138-0x0000000000990000-0x0000000000AA2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1272-34-0x0000000000890000-0x00000000009A2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1376-170-0x00000000008A0000-0x00000000009B2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1416-172-0x0000000000960000-0x0000000000A72000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1640-120-0x0000000000960000-0x0000000000A72000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1668-58-0x00000000008A0000-0x00000000009B2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1700-104-0x0000000000990000-0x0000000000AA2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1788-30-0x0000000000870000-0x0000000000982000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1792-98-0x00000000008A0000-0x00000000009B2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1856-114-0x0000000000830000-0x0000000000942000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1908-102-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2060-126-0x0000000000980000-0x0000000000A92000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2068-112-0x00000000008E0000-0x00000000009F2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2128-92-0x0000000000980000-0x0000000000A92000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2208-90-0x0000000000880000-0x0000000000992000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2356-166-0x0000000000970000-0x0000000000A82000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2548-144-0x0000000000910000-0x0000000000A22000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2568-26-0x0000000000960000-0x0000000000A72000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2596-136-0x00000000008A0000-0x00000000009B2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2688-156-0x0000000000830000-0x0000000000942000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2952-96-0x00000000009E0000-0x0000000000AF2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2992-142-0x0000000000860000-0x0000000000972000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3080-106-0x00000000008C0000-0x00000000009D2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3112-140-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3160-8-0x0000000000980000-0x0000000000A92000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3244-122-0x00000000008E0000-0x00000000009F2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3300-38-0x0000000000830000-0x0000000000942000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3352-148-0x00000000009E0000-0x0000000000AF2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3368-130-0x0000000000820000-0x0000000000932000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3472-168-0x0000000000A80000-0x0000000000B92000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3656-154-0x00000000008A0000-0x00000000009B2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3784-164-0x0000000000970000-0x0000000000A82000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3800-146-0x0000000000970000-0x0000000000A82000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3808-94-0x0000000000940000-0x0000000000A52000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3964-174-0x0000000000820000-0x0000000000932000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4056-176-0x00000000008C0000-0x00000000009D2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4320-13-0x0000000000970000-0x0000000000A82000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4416-110-0x0000000000830000-0x0000000000942000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4452-50-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4456-100-0x0000000000830000-0x0000000000942000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4468-22-0x0000000000820000-0x0000000000932000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4488-18-0x0000000000840000-0x0000000000952000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4660-158-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4672-46-0x0000000000820000-0x0000000000932000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4788-162-0x0000000000890000-0x00000000009A2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4804-150-0x0000000000970000-0x0000000000A82000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4808-128-0x0000000000990000-0x0000000000AA2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4872-74-0x00000000009D0000-0x0000000000AE2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5232-134-0x00000000009A0000-0x0000000000AB2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5248-132-0x0000000000860000-0x0000000000972000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5256-54-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5260-124-0x0000000000840000-0x0000000000952000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5420-160-0x0000000000820000-0x0000000000932000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5428-152-0x0000000000990000-0x0000000000AA2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5512-116-0x0000000000850000-0x0000000000962000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5528-108-0x00000000009D0000-0x0000000000AE2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5676-66-0x00000000008A0000-0x00000000009B2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5708-70-0x0000000000A00000-0x0000000000B12000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5712-86-0x00000000008D0000-0x00000000009E2000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5748-62-0x0000000000960000-0x0000000000A72000-memory.dmp
                                                                                                  Download

                                                                                                  memory/5980-42-0x0000000000A30000-0x0000000000B42000-memory.dmp
                                                                                                  Download

                                                                                                  memory/6140-118-0x0000000000970000-0x0000000000A82000-memory.dmp
                                                                                                  Download