Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 05:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe
- Size 56KB
- Sample260629-ghrb4aes3x
- SHA256 9f82926d133146ca8cbeaf4bb504c93cb34dc2d7412a19232cd8a4c0c443c8ce
- MD5 7c323b3815dd6cc49ab5a3718f2ab7fb
- SHA1 f664eb2552d4e3745983faee76d0d4e9f9c853f8
- SHA512 993cb557a5da26eb867a34eeaa7c90692b82310679aba6657aac2202315ba53550d8378b33647b0f55005be1481b1a6c121f214d2fa63d56baf6bb43e86cc13b
- SSDEEP 1536:cDhi16rvXJ6YhG/1os/P33PM3NN/ntNpQ:cFIMlhy//fM3NN/ntN+
- TLSH T136433957EE9D4091E6155670887D233ACAB7917D4730DBAB1B98EE3C2837080EC3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe - Executes dropped EXE 64 IoCs
pid Process 3220 dwdsrngt.exe 1536 dwdsrngt.exe 2360 dwdsrngt.exe 1948 dwdsrngt.exe 5660 dwdsrngt.exe 6028 dwdsrngt.exe 2992 dwdsrngt.exe 1936 dwdsrngt.exe 3820 dwdsrngt.exe 2000 dwdsrngt.exe 5732 dwdsrngt.exe 632 dwdsrngt.exe 5632 dwdsrngt.exe 5980 dwdsrngt.exe 252 dwdsrngt.exe 5592 dwdsrngt.exe 3712 dwdsrngt.exe 1088 dwdsrngt.exe 5580 dwdsrngt.exe 3028 dwdsrngt.exe 1920 dwdsrngt.exe 4964 dwdsrngt.exe 1804 dwdsrngt.exe 5952 dwdsrngt.exe 3388 dwdsrngt.exe 4796 dwdsrngt.exe 3412 dwdsrngt.exe 1076 dwdsrngt.exe 5744 dwdsrngt.exe 5756 dwdsrngt.exe 2352 dwdsrngt.exe 4556 dwdsrngt.exe 3508 dwdsrngt.exe 2636 dwdsrngt.exe 2444 dwdsrngt.exe 6120 dwdsrngt.exe 4976 dwdsrngt.exe 3504 dwdsrngt.exe 2816 dwdsrngt.exe 5068 dwdsrngt.exe 6040 dwdsrngt.exe 1064 dwdsrngt.exe 2272 dwdsrngt.exe 1424 dwdsrngt.exe 1080 dwdsrngt.exe 1236 dwdsrngt.exe 4104 dwdsrngt.exe 2988 dwdsrngt.exe 2832 dwdsrngt.exe 5884 dwdsrngt.exe 3496 dwdsrngt.exe 5740 dwdsrngt.exe 5636 dwdsrngt.exe 3368 dwdsrngt.exe 5644 dwdsrngt.exe 5752 dwdsrngt.exe 2024 dwdsrngt.exe 4152 dwdsrngt.exe 2244 dwdsrngt.exe 2252 dwdsrngt.exe 5656 dwdsrngt.exe 4424 dwdsrngt.exe 1496 dwdsrngt.exe 1952 dwdsrngt.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{DE-E2-22-26-ZN} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe CHA001" 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{DE-E2-22-26-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{DE-E2-22-26-ZN} = "C:\\Windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{DE-E2-22-26-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File created \??\c:\windows\SysWOW64\dwdsrngt.exe 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification \??\c:\windows\SysWOW64\dwdsrngt.exe 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_29_06_26.log dwdsrngt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4380 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe 4380 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe 3220 dwdsrngt.exe 3220 dwdsrngt.exe 1536 dwdsrngt.exe 1536 dwdsrngt.exe 2360 dwdsrngt.exe 2360 dwdsrngt.exe 1948 dwdsrngt.exe 1948 dwdsrngt.exe 5660 dwdsrngt.exe 5660 dwdsrngt.exe 6028 dwdsrngt.exe 6028 dwdsrngt.exe 2992 dwdsrngt.exe 2992 dwdsrngt.exe 1936 dwdsrngt.exe 1936 dwdsrngt.exe 3820 dwdsrngt.exe 3820 dwdsrngt.exe 2000 dwdsrngt.exe 2000 dwdsrngt.exe 5732 dwdsrngt.exe 5732 dwdsrngt.exe 632 dwdsrngt.exe 632 dwdsrngt.exe 5632 dwdsrngt.exe 5632 dwdsrngt.exe 5980 dwdsrngt.exe 5980 dwdsrngt.exe 252 dwdsrngt.exe 252 dwdsrngt.exe 5592 dwdsrngt.exe 5592 dwdsrngt.exe 3712 dwdsrngt.exe 3712 dwdsrngt.exe 1088 dwdsrngt.exe 1088 dwdsrngt.exe 5580 dwdsrngt.exe 5580 dwdsrngt.exe 3028 dwdsrngt.exe 3028 dwdsrngt.exe 1920 dwdsrngt.exe 1920 dwdsrngt.exe 4964 dwdsrngt.exe 4964 dwdsrngt.exe 1804 dwdsrngt.exe 1804 dwdsrngt.exe 5952 dwdsrngt.exe 5952 dwdsrngt.exe 3388 dwdsrngt.exe 3388 dwdsrngt.exe 4796 dwdsrngt.exe 4796 dwdsrngt.exe 3412 dwdsrngt.exe 3412 dwdsrngt.exe 1076 dwdsrngt.exe 1076 dwdsrngt.exe 5744 dwdsrngt.exe 5744 dwdsrngt.exe 5756 dwdsrngt.exe 5756 dwdsrngt.exe 2352 dwdsrngt.exe 2352 dwdsrngt.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 3220 4380 2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe 89 PID 3220 wrote to memory of 1536 3220 dwdsrngt.exe 91 PID 1536 wrote to memory of 1948 1536 dwdsrngt.exe 95 PID 2360 wrote to memory of 5660 2360 dwdsrngt.exe 96 PID 1948 wrote to memory of 6028 1948 dwdsrngt.exe 97 PID 5660 wrote to memory of 2992 5660 dwdsrngt.exe 99 PID 6028 wrote to memory of 1936 6028 dwdsrngt.exe 100 PID 2992 wrote to memory of 3820 2992 dwdsrngt.exe 101 PID 1936 wrote to memory of 2000 1936 dwdsrngt.exe 102 PID 3820 wrote to memory of 5732 3820 dwdsrngt.exe 103 PID 2000 wrote to memory of 632 2000 dwdsrngt.exe 104 PID 5732 wrote to memory of 5632 5732 dwdsrngt.exe 105 PID 632 wrote to memory of 5980 632 dwdsrngt.exe 106 PID 5632 wrote to memory of 252 5632 dwdsrngt.exe 107 PID 5980 wrote to memory of 5592 5980 dwdsrngt.exe 108 PID 252 wrote to memory of 3712 252 dwdsrngt.exe 109 PID 5592 wrote to memory of 1088 5592 dwdsrngt.exe 110 PID 3712 wrote to memory of 5580 3712 dwdsrngt.exe 111 PID 1088 wrote to memory of 3028 1088 dwdsrngt.exe 112 PID 5580 wrote to memory of 1920 5580 dwdsrngt.exe 113 PID 3028 wrote to memory of 4964 3028 dwdsrngt.exe 114 PID 1920 wrote to memory of 1804 1920 dwdsrngt.exe 115 PID 4964 wrote to memory of 5952 4964 dwdsrngt.exe 116 PID 1804 wrote to memory of 3388 1804 dwdsrngt.exe 117 PID 5952 wrote to memory of 4796 5952 dwdsrngt.exe 118 PID 3388 wrote to memory of 3412 3388 dwdsrngt.exe 119 PID 4796 wrote to memory of 1076 4796 dwdsrngt.exe 120 PID 3412 wrote to memory of 5744 3412 dwdsrngt.exe 121 PID 1076 wrote to memory of 5756 1076 dwdsrngt.exe 122 PID 5744 wrote to memory of 2352 5744 dwdsrngt.exe 123 PID 5756 wrote to memory of 4556 5756 dwdsrngt.exe 124 PID 2352 wrote to memory of 3508 2352 dwdsrngt.exe 125 PID 4556 wrote to memory of 2636 4556 dwdsrngt.exe 126 PID 3508 wrote to memory of 2444 3508 dwdsrngt.exe 127 PID 2636 wrote to memory of 6120 2636 dwdsrngt.exe 128 PID 2444 wrote to memory of 4976 2444 dwdsrngt.exe 129 PID 6120 wrote to memory of 3504 6120 dwdsrngt.exe 130 PID 4976 wrote to memory of 2816 4976 dwdsrngt.exe 131 PID 3504 wrote to memory of 5068 3504 dwdsrngt.exe 132 PID 2816 wrote to memory of 6040 2816 dwdsrngt.exe 133 PID 5068 wrote to memory of 1064 5068 dwdsrngt.exe 134 PID 6040 wrote to memory of 2272 6040 dwdsrngt.exe 135 PID 1064 wrote to memory of 1424 1064 dwdsrngt.exe 136 PID 2272 wrote to memory of 1080 2272 dwdsrngt.exe 137 PID 1424 wrote to memory of 1236 1424 dwdsrngt.exe 138 PID 1080 wrote to memory of 4104 1080 dwdsrngt.exe 139 PID 1236 wrote to memory of 2988 1236 dwdsrngt.exe 140 PID 4104 wrote to memory of 2832 4104 dwdsrngt.exe 141 PID 2988 wrote to memory of 5884 2988 dwdsrngt.exe 142 PID 2832 wrote to memory of 3496 2832 dwdsrngt.exe 143 PID 5884 wrote to memory of 5740 5884 dwdsrngt.exe 144 PID 3496 wrote to memory of 5636 3496 dwdsrngt.exe 145 PID 5740 wrote to memory of 3368 5740 dwdsrngt.exe 146 PID 5636 wrote to memory of 5644 5636 dwdsrngt.exe 147 PID 3368 wrote to memory of 5752 3368 dwdsrngt.exe 148 PID 5644 wrote to memory of 2024 5644 dwdsrngt.exe 149 PID 5752 wrote to memory of 4152 5752 dwdsrngt.exe 150 PID 2024 wrote to memory of 2244 2024 dwdsrngt.exe 151 PID 4152 wrote to memory of 2252 4152 dwdsrngt.exe 152 PID 2244 wrote to memory of 5656 2244 dwdsrngt.exe 153 PID 2252 wrote to memory of 4424 2252 dwdsrngt.exe 154 PID 5656 wrote to memory of 1496 5656 dwdsrngt.exe 155 PID 4424 wrote to memory of 1952 4424 dwdsrngt.exe 156 PID 1496 wrote to memory of 1540 1496 dwdsrngt.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_7c323b3815dd6cc49ab5a3718f2ab7fb_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0012⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0013⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0014⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0015⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0016⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0017⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0018⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0019⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00110⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00111⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00112⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00113⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00114⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00115⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00116⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00118⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00119⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00120⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6120 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00122⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00123⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00124⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00125⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00126⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00127⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5884 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00128⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5740 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00129⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00130⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00131⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00132⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00133⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00134⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00135⤵
- System Location Discovery: System Language Discovery
PID:4816 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00136⤵PID:4544
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00137⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4736 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00138⤵
- System Location Discovery: System Language Discovery
PID:3152 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00139⤵
- Modifies registry class
PID:2908 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00140⤵PID:4764
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00141⤵PID:4612
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00142⤵
- Drops startup file
- Modifies registry class
PID:1672 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00143⤵
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00144⤵PID:4780
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00145⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00146⤵
- Modifies registry class
PID:5260 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00147⤵
- Drops file in System32 directory
- Modifies registry class
PID:5512 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00148⤵
- Drops startup file
- Drops file in System32 directory
PID:1100 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00149⤵
- Drops startup file
- Drops file in System32 directory
PID:5348 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00150⤵
- Drops file in System32 directory
PID:3352 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00151⤵PID:3056
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00152⤵PID:5748
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00153⤵
- Drops startup file
PID:4800 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00154⤵
- System Location Discovery: System Language Discovery
PID:4944 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00155⤵PID:4852
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00156⤵
- Modifies registry class
PID:2972 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00157⤵
- Drops startup file
- Modifies registry class
PID:2848 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00158⤵
- System Location Discovery: System Language Discovery
PID:460 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00159⤵
- System Location Discovery: System Language Discovery
PID:912 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00160⤵
- Drops startup file
PID:1176 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00161⤵
- System Location Discovery: System Language Discovery
PID:5648 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00162⤵PID:4116
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00163⤵
- Drops file in System32 directory
PID:3000 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00164⤵
- Modifies registry class
PID:716 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00165⤵
- Modifies registry class
PID:4940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00166⤵
- Drops file in System32 directory
PID:1548 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00167⤵PID:4956
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00168⤵
- System Location Discovery: System Language Discovery
PID:4536 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00169⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1868 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00170⤵
- Drops file in System32 directory
PID:3396 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00171⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4576 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00172⤵PID:1264
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00173⤵PID:120
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00174⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00175⤵
- Modifies registry class
PID:124 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00176⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1332 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00177⤵
- System Location Discovery: System Language Discovery
PID:3668 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00178⤵
- Drops file in System32 directory
PID:4560 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00179⤵
- System Location Discovery: System Language Discovery
PID:5696 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00180⤵PID:2404
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00181⤵
- Drops startup file
PID:4968 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00182⤵PID:5492
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00183⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5584 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00184⤵
- Modifies registry class
PID:704 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00185⤵
- Drops file in System32 directory
PID:4996 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00186⤵
- Drops file in System32 directory
- Modifies registry class
PID:2480 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00187⤵
- Drops startup file
PID:2608 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00188⤵PID:5440
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00189⤵PID:2804
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00190⤵
- Drops startup file
PID:4988 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00191⤵
- Modifies registry class
PID:3216 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00192⤵
- Modifies registry class
PID:3096 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00193⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3140 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00194⤵PID:5912
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00195⤵PID:3728
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00196⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4076 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00197⤵PID:4592
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00198⤵PID:5668
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00199⤵PID:3280
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001100⤵
- Drops file in System32 directory
- Modifies registry class
PID:5736 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001101⤵PID:5364
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5344 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001103⤵
- Drops file in System32 directory
PID:5048 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001104⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:4072 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001105⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1252 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001106⤵PID:4320
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001107⤵
- Modifies registry class
PID:1460 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001108⤵
- Drops startup file
PID:5988 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001109⤵
- Modifies registry class
PID:3440 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001110⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:5428 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001111⤵
- Modifies registry class
PID:5832 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001112⤵PID:4648
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001113⤵
- Drops startup file
PID:2536 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001114⤵PID:3564
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001115⤵
- Drops file in System32 directory
PID:2396 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001116⤵
- System Location Discovery: System Language Discovery
PID:2604 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001117⤵
- System Location Discovery: System Language Discovery
PID:6000 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001118⤵
- Drops startup file
- Modifies registry class
PID:4472 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001119⤵
- Modifies registry class
PID:4036 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001120⤵
- Drops startup file
- Drops file in System32 directory
PID:3740 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001121⤵PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-