Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/05/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe
- Size 58KB
- Sample260505-danpfsft4w
- SHA256 5e5ecaf1a9d0ee9cbcb1aabc56d7f9b5f1a3d09ff7eb1afdeadd2973edd881c9
- MD5 ec7fdfd8cbd80d614ff7eba817699da9
- SHA1 7cb120e40790266ee8f08ff533a2284035335dc9
- SHA512 38d8278b237a7d5540149be787b6548edc6d87c7408ad76df0fdf45edc71654697244d915fe86fab234ef7c3178d27300b18012b95181ead5fc38ef983739674
- SSDEEP 768:hsFl3VOcV1OEqy7igfh9zuwrZXA6Wl9Oy2nfUECHpXuRNFCik5TRo7tJMWh:hsBOppy7/hu4A6W+D3CEgdBWh
- TLSH T15F431A47AE5D4091E6149B70453D233ACA73947E0B20DBA717D8DE3C3837181AC3A7BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe - Executes dropped EXE 64 IoCs
pid Process 3180 rwwdw64d.exe 4840 rwwdw64d.exe 5024 rwwdw64d.exe 5912 rwwdw64d.exe 5592 rwwdw64d.exe 4436 rwwdw64d.exe 1140 rwwdw64d.exe 2728 rwwdw64d.exe 4492 rwwdw64d.exe 3828 rwwdw64d.exe 5952 rwwdw64d.exe 2564 rwwdw64d.exe 4288 rwwdw64d.exe 2872 rwwdw64d.exe 6020 rwwdw64d.exe 420 rwwdw64d.exe 4952 rwwdw64d.exe 2352 rwwdw64d.exe 3420 rwwdw64d.exe 1872 rwwdw64d.exe 2520 rwwdw64d.exe 776 rwwdw64d.exe 3052 rwwdw64d.exe 2536 rwwdw64d.exe 2364 rwwdw64d.exe 5156 rwwdw64d.exe 3648 rwwdw64d.exe 5304 rwwdw64d.exe 3424 rwwdw64d.exe 4848 rwwdw64d.exe 5844 rwwdw64d.exe 2064 rwwdw64d.exe 4268 rwwdw64d.exe 1120 rwwdw64d.exe 5428 rwwdw64d.exe 1732 rwwdw64d.exe 5184 rwwdw64d.exe 5644 rwwdw64d.exe 3460 rwwdw64d.exe 3900 rwwdw64d.exe 6140 rwwdw64d.exe 3696 rwwdw64d.exe 2492 rwwdw64d.exe 4500 rwwdw64d.exe 3936 rwwdw64d.exe 3316 rwwdw64d.exe 5948 rwwdw64d.exe 4968 rwwdw64d.exe 2192 rwwdw64d.exe 1636 rwwdw64d.exe 5560 rwwdw64d.exe 1892 rwwdw64d.exe 5316 rwwdw64d.exe 4440 rwwdw64d.exe 2640 rwwdw64d.exe 236 rwwdw64d.exe 2904 rwwdw64d.exe 5440 rwwdw64d.exe 3372 rwwdw64d.exe 5672 rwwdw64d.exe 2456 rwwdw64d.exe 2096 rwwdw64d.exe 6104 rwwdw64d.exe 3852 rwwdw64d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{03-38-86-67-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{03-38-86-67-DW} = "C:\\Windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{03-38-86-67-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{03-38-86-67-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe DWoli" 2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File created C:\Windows\SysWOW64\msnav32.ax 2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_05_26.log rwwdw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4688 2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe 4688 2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe 3180 rwwdw64d.exe 3180 rwwdw64d.exe 4840 rwwdw64d.exe 4840 rwwdw64d.exe 5024 rwwdw64d.exe 5024 rwwdw64d.exe 5912 rwwdw64d.exe 5912 rwwdw64d.exe 5592 rwwdw64d.exe 5592 rwwdw64d.exe 4436 rwwdw64d.exe 4436 rwwdw64d.exe 1140 rwwdw64d.exe 1140 rwwdw64d.exe 2728 rwwdw64d.exe 2728 rwwdw64d.exe 4492 rwwdw64d.exe 4492 rwwdw64d.exe 3828 rwwdw64d.exe 3828 rwwdw64d.exe 5952 rwwdw64d.exe 5952 rwwdw64d.exe 2564 rwwdw64d.exe 2564 rwwdw64d.exe 4288 rwwdw64d.exe 4288 rwwdw64d.exe 2872 rwwdw64d.exe 2872 rwwdw64d.exe 6020 rwwdw64d.exe 6020 rwwdw64d.exe 420 rwwdw64d.exe 420 rwwdw64d.exe 4952 rwwdw64d.exe 4952 rwwdw64d.exe 2352 rwwdw64d.exe 2352 rwwdw64d.exe 3420 rwwdw64d.exe 3420 rwwdw64d.exe 1872 rwwdw64d.exe 1872 rwwdw64d.exe 2520 rwwdw64d.exe 2520 rwwdw64d.exe 776 rwwdw64d.exe 776 rwwdw64d.exe 3052 rwwdw64d.exe 3052 rwwdw64d.exe 2536 rwwdw64d.exe 2536 rwwdw64d.exe 2364 rwwdw64d.exe 2364 rwwdw64d.exe 5156 rwwdw64d.exe 5156 rwwdw64d.exe 3648 rwwdw64d.exe 3648 rwwdw64d.exe 5304 rwwdw64d.exe 5304 rwwdw64d.exe 3424 rwwdw64d.exe 3424 rwwdw64d.exe 4848 rwwdw64d.exe 4848 rwwdw64d.exe 5844 rwwdw64d.exe 5844 rwwdw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3180 4688 2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe 78 PID 3180 wrote to memory of 4840 3180 rwwdw64d.exe 80 PID 4840 wrote to memory of 5912 4840 rwwdw64d.exe 84 PID 5024 wrote to memory of 5592 5024 rwwdw64d.exe 85 PID 5912 wrote to memory of 4436 5912 rwwdw64d.exe 86 PID 5592 wrote to memory of 1140 5592 rwwdw64d.exe 88 PID 4436 wrote to memory of 2728 4436 rwwdw64d.exe 89 PID 1140 wrote to memory of 4492 1140 rwwdw64d.exe 90 PID 2728 wrote to memory of 3828 2728 rwwdw64d.exe 91 PID 4492 wrote to memory of 5952 4492 rwwdw64d.exe 92 PID 3828 wrote to memory of 2564 3828 rwwdw64d.exe 93 PID 5952 wrote to memory of 4288 5952 rwwdw64d.exe 94 PID 2564 wrote to memory of 2872 2564 rwwdw64d.exe 95 PID 4288 wrote to memory of 6020 4288 rwwdw64d.exe 96 PID 2872 wrote to memory of 420 2872 rwwdw64d.exe 97 PID 6020 wrote to memory of 4952 6020 rwwdw64d.exe 98 PID 420 wrote to memory of 2352 420 rwwdw64d.exe 99 PID 4952 wrote to memory of 3420 4952 rwwdw64d.exe 100 PID 2352 wrote to memory of 1872 2352 rwwdw64d.exe 101 PID 3420 wrote to memory of 2520 3420 rwwdw64d.exe 102 PID 1872 wrote to memory of 776 1872 rwwdw64d.exe 103 PID 2520 wrote to memory of 3052 2520 rwwdw64d.exe 104 PID 776 wrote to memory of 2536 776 rwwdw64d.exe 105 PID 3052 wrote to memory of 2364 3052 rwwdw64d.exe 106 PID 2536 wrote to memory of 5156 2536 rwwdw64d.exe 107 PID 2364 wrote to memory of 3648 2364 rwwdw64d.exe 108 PID 5156 wrote to memory of 5304 5156 rwwdw64d.exe 109 PID 3648 wrote to memory of 3424 3648 rwwdw64d.exe 110 PID 5304 wrote to memory of 4848 5304 rwwdw64d.exe 111 PID 3424 wrote to memory of 5844 3424 rwwdw64d.exe 112 PID 4848 wrote to memory of 2064 4848 rwwdw64d.exe 113 PID 5844 wrote to memory of 4268 5844 rwwdw64d.exe 114 PID 2064 wrote to memory of 1120 2064 rwwdw64d.exe 115 PID 4268 wrote to memory of 5428 4268 rwwdw64d.exe 116 PID 1120 wrote to memory of 1732 1120 rwwdw64d.exe 117 PID 5428 wrote to memory of 5184 5428 rwwdw64d.exe 118 PID 1732 wrote to memory of 5644 1732 rwwdw64d.exe 119 PID 5184 wrote to memory of 3460 5184 rwwdw64d.exe 120 PID 5644 wrote to memory of 3900 5644 rwwdw64d.exe 121 PID 3460 wrote to memory of 6140 3460 rwwdw64d.exe 122 PID 3900 wrote to memory of 3696 3900 rwwdw64d.exe 123 PID 6140 wrote to memory of 2492 6140 rwwdw64d.exe 124 PID 3696 wrote to memory of 4500 3696 rwwdw64d.exe 125 PID 2492 wrote to memory of 3936 2492 rwwdw64d.exe 126 PID 4500 wrote to memory of 3316 4500 rwwdw64d.exe 127 PID 3936 wrote to memory of 5948 3936 rwwdw64d.exe 128 PID 3316 wrote to memory of 4968 3316 rwwdw64d.exe 129 PID 5948 wrote to memory of 2192 5948 rwwdw64d.exe 130 PID 4968 wrote to memory of 1636 4968 rwwdw64d.exe 131 PID 2192 wrote to memory of 5560 2192 rwwdw64d.exe 132 PID 1636 wrote to memory of 1892 1636 rwwdw64d.exe 133 PID 5560 wrote to memory of 5316 5560 rwwdw64d.exe 134 PID 1892 wrote to memory of 4440 1892 rwwdw64d.exe 135 PID 5316 wrote to memory of 2640 5316 rwwdw64d.exe 136 PID 4440 wrote to memory of 236 4440 rwwdw64d.exe 137 PID 2640 wrote to memory of 2904 2640 rwwdw64d.exe 138 PID 236 wrote to memory of 5440 236 rwwdw64d.exe 139 PID 2904 wrote to memory of 3372 2904 rwwdw64d.exe 140 PID 5440 wrote to memory of 5672 5440 rwwdw64d.exe 141 PID 3372 wrote to memory of 2456 3372 rwwdw64d.exe 142 PID 5672 wrote to memory of 2096 5672 rwwdw64d.exe 143 PID 2456 wrote to memory of 6104 2456 rwwdw64d.exe 144 PID 2096 wrote to memory of 3852 2096 rwwdw64d.exe 145 PID 6104 wrote to memory of 4364 6104 rwwdw64d.exe 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_ec7fdfd8cbd80d614ff7eba817699da9_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:420 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5644 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5672 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
PID:3852 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵PID:2748
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Drops startup file
PID:2336 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵
- Drops startup file
- Drops file in System32 directory
PID:2612 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5040 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵PID:2812
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Drops startup file
- Modifies registry class
PID:4856 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵PID:4476
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵PID:1444
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- System Location Discovery: System Language Discovery
PID:3812 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵PID:5000
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Drops startup file
PID:5192 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵PID:4976
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵PID:3088
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- Drops startup file
PID:3572 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- System Location Discovery: System Language Discovery
PID:4144 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Modifies registry class
PID:5336 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5388 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵PID:3124
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Drops startup file
PID:5604 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops startup file
PID:1684 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵PID:2884
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵PID:5992
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵PID:4980
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- System Location Discovery: System Language Discovery
PID:4828 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- Drops startup file
PID:416 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Drops file in System32 directory
- Modifies registry class
PID:5852 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- System Location Discovery: System Language Discovery
PID:4220 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵PID:5200
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵PID:6128
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
- System Location Discovery: System Language Discovery
PID:3912 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵PID:3660
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- Drops file in System32 directory
PID:4512 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- Modifies registry class
PID:868 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵PID:5884
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4488 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4628 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵PID:5520
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵PID:2164
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops startup file
PID:3000 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵PID:2208
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵PID:3332
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- System Location Discovery: System Language Discovery
PID:3472 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- Modifies registry class
PID:4348 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵PID:1236
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- Drops file in System32 directory
PID:3704 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- Modifies registry class
PID:4056 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- Drops file in System32 directory
- Modifies registry class
PID:1808 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵PID:4752
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵PID:4480
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3148 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
- Drops file in System32 directory
PID:4972 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵PID:4748
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵PID:4796
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵PID:1584
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2300 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵
- Drops startup file
PID:4284 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- Drops file in System32 directory
PID:3980 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵
- Modifies registry class
PID:1380 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵
- Drops startup file
PID:1128 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵
- Modifies registry class
PID:5412 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵PID:2452
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵
- Drops file in System32 directory
PID:2004 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
- System Location Discovery: System Language Discovery
PID:3280 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵PID:1352
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Drops file in System32 directory
PID:1032 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵
- Drops startup file
PID:3672 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵PID:432
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5296 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵
- System Location Discovery: System Language Discovery
PID:876 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵PID:104
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵
- System Location Discovery: System Language Discovery
PID:4464 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵
- Drops startup file
- Modifies registry class
PID:6100 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵
- Drops file in System32 directory
PID:3580 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵
- Modifies registry class
PID:2116 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵
- Drops file in System32 directory
PID:5612 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵PID:5152
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵
- System Location Discovery: System Language Discovery
PID:4768 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵
- Drops startup file
PID:4808 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵
- Drops file in System32 directory
PID:4812 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵
- Drops startup file
- Modifies registry class
PID:2248 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵PID:4900
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵PID:5064
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-