Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/06/2026, 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe
- Size 48KB
- Sample260604-e4js2ahz4t
- SHA256 f19e6244ada2bc5fefd9bfa0abd2342332cb5041ecf440db1746a8a666206750
- MD5 95e57da8f295d0741bd73e9f3e164248
- SHA1 72ca3b97ce24a4d47ebcb715135f7779ebd3bba7
- SHA512 bd0df523b384fdc0ee2c87eb8644430160b9dc46f22231949e7391ee21d28271378a177aa07168430d9d7381e7eb814a45f19430499aa76551f867e05abc4acf
- SSDEEP 768:aTdZuu1Ao2J29ng+nqVshjKrVFRoPKDk53Rx7tfk1FuLB:CSgAo2Q9g4oshjqLbMxeuN
- TLSH T18323F753AE4B8095E201A6B0456D327DCB73797A0760D77B1784DD3C6837182FC3AA6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe - Executes dropped EXE 64 IoCs
pid Process 2080 rwwnw64d.exe 2084 rwwnw64d.exe 4372 rwwnw64d.exe 4348 rwwnw64d.exe 2152 rwwnw64d.exe 4860 rwwnw64d.exe 1496 rwwnw64d.exe 2760 rwwnw64d.exe 1072 rwwnw64d.exe 4276 rwwnw64d.exe 2068 rwwnw64d.exe 1288 rwwnw64d.exe 3560 rwwnw64d.exe 2236 rwwnw64d.exe 2512 rwwnw64d.exe 4652 rwwnw64d.exe 744 rwwnw64d.exe 4920 rwwnw64d.exe 116 rwwnw64d.exe 4132 rwwnw64d.exe 4448 rwwnw64d.exe 4500 rwwnw64d.exe 4216 rwwnw64d.exe 2960 rwwnw64d.exe 2736 rwwnw64d.exe 2096 rwwnw64d.exe 3196 rwwnw64d.exe 828 rwwnw64d.exe 4596 rwwnw64d.exe 1980 rwwnw64d.exe 4656 rwwnw64d.exe 1368 rwwnw64d.exe 2616 rwwnw64d.exe 4556 rwwnw64d.exe 2184 rwwnw64d.exe 3396 rwwnw64d.exe 1708 rwwnw64d.exe 3100 rwwnw64d.exe 3156 rwwnw64d.exe 2188 rwwnw64d.exe 3316 rwwnw64d.exe 5088 rwwnw64d.exe 4148 rwwnw64d.exe 372 rwwnw64d.exe 4324 rwwnw64d.exe 4664 rwwnw64d.exe 2592 rwwnw64d.exe 3540 rwwnw64d.exe 4376 rwwnw64d.exe 1080 rwwnw64d.exe 4584 rwwnw64d.exe 5084 rwwnw64d.exe 2028 rwwnw64d.exe 2652 rwwnw64d.exe 2752 rwwnw64d.exe 652 rwwnw64d.exe 1608 rwwnw64d.exe 2364 rwwnw64d.exe 1644 rwwnw64d.exe 2348 rwwnw64d.exe 1392 rwwnw64d.exe 3924 rwwnw64d.exe 3716 rwwnw64d.exe 4356 rwwnw64d.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-C4-48-8B-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe DWrvg" 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-C4-48-8B-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvg" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-C4-48-8B-DW} = "C:\\Windows\\SysWOW64\\rwwnw64d.exe DWrvg" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-C4-48-8B-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvg" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{B8-88-82-24-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvg" rwwnw64d.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification \??\c:\windows\SysWOW64\rwwnw64d.exe 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_04_06_26.log rwwnw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 636 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe 636 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe 2080 rwwnw64d.exe 2080 rwwnw64d.exe 2084 rwwnw64d.exe 2084 rwwnw64d.exe 4372 rwwnw64d.exe 4372 rwwnw64d.exe 4348 rwwnw64d.exe 4348 rwwnw64d.exe 2152 rwwnw64d.exe 2152 rwwnw64d.exe 4860 rwwnw64d.exe 4860 rwwnw64d.exe 1496 rwwnw64d.exe 1496 rwwnw64d.exe 2760 rwwnw64d.exe 2760 rwwnw64d.exe 1072 rwwnw64d.exe 1072 rwwnw64d.exe 4276 rwwnw64d.exe 4276 rwwnw64d.exe 2068 rwwnw64d.exe 2068 rwwnw64d.exe 1288 rwwnw64d.exe 1288 rwwnw64d.exe 3560 rwwnw64d.exe 3560 rwwnw64d.exe 2236 rwwnw64d.exe 2236 rwwnw64d.exe 2512 rwwnw64d.exe 2512 rwwnw64d.exe 4652 rwwnw64d.exe 4652 rwwnw64d.exe 744 rwwnw64d.exe 744 rwwnw64d.exe 4920 rwwnw64d.exe 4920 rwwnw64d.exe 116 rwwnw64d.exe 116 rwwnw64d.exe 4132 rwwnw64d.exe 4132 rwwnw64d.exe 4448 rwwnw64d.exe 4448 rwwnw64d.exe 4500 rwwnw64d.exe 4500 rwwnw64d.exe 4216 rwwnw64d.exe 4216 rwwnw64d.exe 2960 rwwnw64d.exe 2960 rwwnw64d.exe 2736 rwwnw64d.exe 2736 rwwnw64d.exe 2096 rwwnw64d.exe 2096 rwwnw64d.exe 3196 rwwnw64d.exe 3196 rwwnw64d.exe 828 rwwnw64d.exe 828 rwwnw64d.exe 4596 rwwnw64d.exe 4596 rwwnw64d.exe 1980 rwwnw64d.exe 1980 rwwnw64d.exe 4656 rwwnw64d.exe 4656 rwwnw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 636 wrote to memory of 2080 636 2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe 90 PID 2080 wrote to memory of 2084 2080 rwwnw64d.exe 92 PID 2084 wrote to memory of 4348 2084 rwwnw64d.exe 100 PID 4372 wrote to memory of 2152 4372 rwwnw64d.exe 101 PID 4348 wrote to memory of 4860 4348 rwwnw64d.exe 103 PID 2152 wrote to memory of 1496 2152 rwwnw64d.exe 107 PID 4860 wrote to memory of 2760 4860 rwwnw64d.exe 108 PID 1496 wrote to memory of 1072 1496 rwwnw64d.exe 109 PID 2760 wrote to memory of 4276 2760 rwwnw64d.exe 111 PID 1072 wrote to memory of 2068 1072 rwwnw64d.exe 113 PID 4276 wrote to memory of 1288 4276 rwwnw64d.exe 114 PID 2068 wrote to memory of 3560 2068 rwwnw64d.exe 115 PID 1288 wrote to memory of 2236 1288 rwwnw64d.exe 116 PID 3560 wrote to memory of 2512 3560 rwwnw64d.exe 117 PID 2236 wrote to memory of 4652 2236 rwwnw64d.exe 120 PID 2512 wrote to memory of 744 2512 rwwnw64d.exe 124 PID 4652 wrote to memory of 4920 4652 rwwnw64d.exe 125 PID 744 wrote to memory of 116 744 rwwnw64d.exe 127 PID 4920 wrote to memory of 4132 4920 rwwnw64d.exe 128 PID 116 wrote to memory of 4448 116 rwwnw64d.exe 129 PID 4132 wrote to memory of 4500 4132 rwwnw64d.exe 130 PID 4448 wrote to memory of 4216 4448 rwwnw64d.exe 131 PID 4500 wrote to memory of 2960 4500 rwwnw64d.exe 132 PID 4216 wrote to memory of 2736 4216 rwwnw64d.exe 133 PID 2960 wrote to memory of 2096 2960 rwwnw64d.exe 134 PID 2736 wrote to memory of 3196 2736 rwwnw64d.exe 135 PID 2096 wrote to memory of 828 2096 rwwnw64d.exe 136 PID 3196 wrote to memory of 4596 3196 rwwnw64d.exe 137 PID 828 wrote to memory of 1980 828 rwwnw64d.exe 138 PID 4596 wrote to memory of 4656 4596 rwwnw64d.exe 139 PID 1980 wrote to memory of 1368 1980 rwwnw64d.exe 140 PID 4656 wrote to memory of 2616 4656 rwwnw64d.exe 141 PID 1368 wrote to memory of 4556 1368 rwwnw64d.exe 142 PID 2616 wrote to memory of 2184 2616 rwwnw64d.exe 143 PID 4556 wrote to memory of 3396 4556 rwwnw64d.exe 144 PID 2184 wrote to memory of 1708 2184 rwwnw64d.exe 145 PID 3396 wrote to memory of 3100 3396 rwwnw64d.exe 146 PID 1708 wrote to memory of 3156 1708 rwwnw64d.exe 147 PID 3100 wrote to memory of 2188 3100 rwwnw64d.exe 148 PID 3156 wrote to memory of 3316 3156 rwwnw64d.exe 149 PID 2188 wrote to memory of 5088 2188 rwwnw64d.exe 150 PID 3316 wrote to memory of 4148 3316 rwwnw64d.exe 151 PID 5088 wrote to memory of 372 5088 rwwnw64d.exe 152 PID 4148 wrote to memory of 4324 4148 rwwnw64d.exe 153 PID 372 wrote to memory of 4664 372 rwwnw64d.exe 154 PID 4324 wrote to memory of 2592 4324 rwwnw64d.exe 155 PID 4664 wrote to memory of 3540 4664 rwwnw64d.exe 156 PID 2592 wrote to memory of 4376 2592 rwwnw64d.exe 157 PID 3540 wrote to memory of 1080 3540 rwwnw64d.exe 160 PID 4376 wrote to memory of 4584 4376 rwwnw64d.exe 161 PID 1080 wrote to memory of 5084 1080 rwwnw64d.exe 162 PID 4584 wrote to memory of 2028 4584 rwwnw64d.exe 163 PID 5084 wrote to memory of 2652 5084 rwwnw64d.exe 164 PID 2028 wrote to memory of 2752 2028 rwwnw64d.exe 165 PID 2652 wrote to memory of 652 2652 rwwnw64d.exe 166 PID 2752 wrote to memory of 1608 2752 rwwnw64d.exe 167 PID 652 wrote to memory of 2364 652 rwwnw64d.exe 168 PID 1608 wrote to memory of 1644 1608 rwwnw64d.exe 170 PID 2364 wrote to memory of 2348 2364 rwwnw64d.exe 171 PID 1644 wrote to memory of 1392 1644 rwwnw64d.exe 172 PID 2348 wrote to memory of 3924 2348 rwwnw64d.exe 173 PID 1392 wrote to memory of 3716 1392 rwwnw64d.exe 174 PID 3924 wrote to memory of 4356 3924 rwwnw64d.exe 176 PID 3716 wrote to memory of 2528 3716 rwwnw64d.exe 177
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_95e57da8f295d0741bd73e9f3e164248_elex_wannacry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg11⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg12⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg13⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg14⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg17⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg19⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg21⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg22⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg25⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg29⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg31⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg34⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
PID:4356 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg35⤵
- Modifies registry class
PID:848 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg36⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2284 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg37⤵
- Drops startup file
- Modifies registry class
PID:1504 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg38⤵
- Drops startup file
- Drops file in System32 directory
PID:5092 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg39⤵
- Drops file in System32 directory
- Modifies registry class
PID:5048 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg40⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2420 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg41⤵PID:2384
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg42⤵
- System Location Discovery: System Language Discovery
PID:4328 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg43⤵
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg44⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:968 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg45⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1216 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg46⤵
- Drops startup file
- Modifies registry class
PID:1416 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg47⤵
- Modifies registry class
PID:1704 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg48⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2656 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg49⤵
- System Location Discovery: System Language Discovery
PID:904 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg50⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1372 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg51⤵PID:2796
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg52⤵
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg53⤵
- Drops file in System32 directory
PID:3944 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg54⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:1888 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg55⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4932 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg56⤵PID:2328
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg57⤵PID:2208
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg58⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4172 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg59⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2732 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg60⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:216 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg61⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:5008 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg62⤵PID:4200
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg63⤵
- Drops file in System32 directory
PID:2172 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg64⤵
- Drops startup file
- Modifies registry class
PID:1688 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg65⤵
- Drops file in System32 directory
PID:2456 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg66⤵
- System Location Discovery: System Language Discovery
PID:3432 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg67⤵
- Drops startup file
PID:752 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg68⤵
- Drops startup file
PID:3104 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg69⤵
- Drops startup file
- Modifies registry class
PID:1972 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg70⤵
- Adds Run key to start application
PID:3896 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg71⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2800 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg72⤵
- Drops file in System32 directory
- Modifies registry class
PID:1540 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg73⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg74⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg75⤵PID:4360
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg76⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:224 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg77⤵
- Drops file in System32 directory
PID:2124 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg78⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2884 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg79⤵
- Drops startup file
PID:4716 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg80⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3812 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg81⤵PID:2516
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg82⤵
- Drops file in System32 directory
PID:4576 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg83⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg84⤵
- Modifies registry class
PID:4800 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg85⤵
- Drops startup file
- Drops file in System32 directory
PID:2596 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg86⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:1008 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg87⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:664 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg88⤵
- Drops file in System32 directory
PID:3580 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg89⤵
- System Location Discovery: System Language Discovery
PID:4140 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg90⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:564 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg91⤵PID:1584
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg92⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:4508 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg93⤵
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg94⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1772 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg95⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1528 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg96⤵
- Modifies registry class
PID:1384 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg97⤵PID:2632
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg98⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2388 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg99⤵
- System Location Discovery: System Language Discovery
PID:3888 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg100⤵
- System Location Discovery: System Language Discovery
PID:4820 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg101⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2044 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg102⤵
- System Location Discovery: System Language Discovery
PID:780 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg103⤵
- Drops startup file
PID:396 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg104⤵PID:5000
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg105⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4080 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg106⤵
- Drops startup file
- Drops file in System32 directory
PID:3152 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg107⤵
- Modifies registry class
PID:2300 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg108⤵
- Modifies registry class
PID:416 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg109⤵
- Drops startup file
PID:4628 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg110⤵PID:1948
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg111⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4736 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg112⤵PID:2964
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg113⤵
- Drops startup file
PID:932 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg114⤵PID:1272
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg115⤵
- Drops startup file
- Drops file in System32 directory
PID:2232 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:544 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg117⤵
- Drops file in System32 directory
- Modifies registry class
PID:2496 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg118⤵
- Drops file in System32 directory
PID:1176 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg119⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:432 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg120⤵
- System Location Discovery: System Language Discovery
PID:1580 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-