Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 16:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe
- Size 48KB
- Sample260702-va84tsfs4m
- SHA256 774f880ba21830bafaeb2c2738bbf2a8ca3807f73dafa9fef42a76757da14cf2
- MD5 afd7eae42c4152517a4d6fe99401c327
- SHA1 cccb673bacdc0f3fc04d5542f01c431d9fb00059
- SHA512 812482949a2d7516b951beadf9b2d376dab0c1f55a9afdf764b039277fc10ca185a955837f723348b0b9e6beb90ce1e26eecf4b8f95e189c6678dbb802ac0697
- SSDEEP 768:aTdZuu1Ao2J29ng+nqVshjKrVFRoPKDk53Rx7tfk1FuLy:CSgAo2Q9g4oshjqLbMxeue
- TLSH T16F23F743AE4B8095E211A6B0456D327DCB73797A0760D7771784ED3C6837182FC3AAAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe - Executes dropped EXE 64 IoCs
pid Process 1376 rwwnw64d.exe 5752 rwwnw64d.exe 4356 rwwnw64d.exe 1248 rwwnw64d.exe 5708 rwwnw64d.exe 5084 rwwnw64d.exe 4784 rwwnw64d.exe 2572 rwwnw64d.exe 2820 rwwnw64d.exe 844 rwwnw64d.exe 5288 rwwnw64d.exe 3600 rwwnw64d.exe 3916 rwwnw64d.exe 2376 rwwnw64d.exe 5536 rwwnw64d.exe 5892 rwwnw64d.exe 5100 rwwnw64d.exe 1340 rwwnw64d.exe 4772 rwwnw64d.exe 3476 rwwnw64d.exe 3548 rwwnw64d.exe 124 rwwnw64d.exe 2080 rwwnw64d.exe 3376 rwwnw64d.exe 4656 rwwnw64d.exe 4052 rwwnw64d.exe 5560 rwwnw64d.exe 700 rwwnw64d.exe 5624 rwwnw64d.exe 2164 rwwnw64d.exe 2444 rwwnw64d.exe 1956 rwwnw64d.exe 4180 rwwnw64d.exe 4064 rwwnw64d.exe 3496 rwwnw64d.exe 2336 rwwnw64d.exe 1548 rwwnw64d.exe 1148 rwwnw64d.exe 712 rwwnw64d.exe 2988 rwwnw64d.exe 5172 rwwnw64d.exe 1784 rwwnw64d.exe 1952 rwwnw64d.exe 1668 rwwnw64d.exe 5320 rwwnw64d.exe 1300 rwwnw64d.exe 5520 rwwnw64d.exe 1308 rwwnw64d.exe 1712 rwwnw64d.exe 4888 rwwnw64d.exe 624 rwwnw64d.exe 5712 rwwnw64d.exe 964 rwwnw64d.exe 3812 rwwnw64d.exe 3612 rwwnw64d.exe 2244 rwwnw64d.exe 4264 rwwnw64d.exe 3776 rwwnw64d.exe 5500 rwwnw64d.exe 4880 rwwnw64d.exe 3192 rwwnw64d.exe 5372 rwwnw64d.exe 5060 rwwnw64d.exe 4108 rwwnw64d.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{96-60-08-8A-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{31-10-07-76-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{96-60-08-8A-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe DWrvgXX" 2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{96-60-08-8A-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{96-60-08-8A-DW} = "C:\\Windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_02_07_26.log rwwnw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4228 2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe 4228 2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe 1376 rwwnw64d.exe 1376 rwwnw64d.exe 5752 rwwnw64d.exe 5752 rwwnw64d.exe 4356 rwwnw64d.exe 4356 rwwnw64d.exe 1248 rwwnw64d.exe 1248 rwwnw64d.exe 5708 rwwnw64d.exe 5708 rwwnw64d.exe 5084 rwwnw64d.exe 5084 rwwnw64d.exe 4784 rwwnw64d.exe 4784 rwwnw64d.exe 2572 rwwnw64d.exe 2572 rwwnw64d.exe 2820 rwwnw64d.exe 2820 rwwnw64d.exe 844 rwwnw64d.exe 844 rwwnw64d.exe 5288 rwwnw64d.exe 5288 rwwnw64d.exe 3600 rwwnw64d.exe 3600 rwwnw64d.exe 3916 rwwnw64d.exe 3916 rwwnw64d.exe 2376 rwwnw64d.exe 2376 rwwnw64d.exe 5536 rwwnw64d.exe 5536 rwwnw64d.exe 5892 rwwnw64d.exe 5892 rwwnw64d.exe 5100 rwwnw64d.exe 5100 rwwnw64d.exe 1340 rwwnw64d.exe 1340 rwwnw64d.exe 4772 rwwnw64d.exe 4772 rwwnw64d.exe 3476 rwwnw64d.exe 3476 rwwnw64d.exe 3548 rwwnw64d.exe 3548 rwwnw64d.exe 124 rwwnw64d.exe 124 rwwnw64d.exe 2080 rwwnw64d.exe 2080 rwwnw64d.exe 3376 rwwnw64d.exe 3376 rwwnw64d.exe 4656 rwwnw64d.exe 4656 rwwnw64d.exe 4052 rwwnw64d.exe 4052 rwwnw64d.exe 5560 rwwnw64d.exe 5560 rwwnw64d.exe 700 rwwnw64d.exe 700 rwwnw64d.exe 5624 rwwnw64d.exe 5624 rwwnw64d.exe 2164 rwwnw64d.exe 2164 rwwnw64d.exe 2444 rwwnw64d.exe 2444 rwwnw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4228 wrote to memory of 1376 4228 2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe 88 PID 1376 wrote to memory of 5752 1376 rwwnw64d.exe 90 PID 5752 wrote to memory of 1248 5752 rwwnw64d.exe 94 PID 4356 wrote to memory of 5708 4356 rwwnw64d.exe 95 PID 1248 wrote to memory of 5084 1248 rwwnw64d.exe 96 PID 5708 wrote to memory of 4784 5708 rwwnw64d.exe 98 PID 5084 wrote to memory of 2572 5084 rwwnw64d.exe 99 PID 4784 wrote to memory of 2820 4784 rwwnw64d.exe 100 PID 2572 wrote to memory of 844 2572 rwwnw64d.exe 101 PID 2820 wrote to memory of 5288 2820 rwwnw64d.exe 102 PID 844 wrote to memory of 3600 844 rwwnw64d.exe 103 PID 5288 wrote to memory of 3916 5288 rwwnw64d.exe 104 PID 3600 wrote to memory of 2376 3600 rwwnw64d.exe 105 PID 3916 wrote to memory of 5536 3916 rwwnw64d.exe 106 PID 2376 wrote to memory of 5892 2376 rwwnw64d.exe 107 PID 5536 wrote to memory of 5100 5536 rwwnw64d.exe 108 PID 5892 wrote to memory of 1340 5892 rwwnw64d.exe 109 PID 5100 wrote to memory of 4772 5100 rwwnw64d.exe 110 PID 1340 wrote to memory of 3476 1340 rwwnw64d.exe 111 PID 4772 wrote to memory of 3548 4772 rwwnw64d.exe 112 PID 3476 wrote to memory of 124 3476 rwwnw64d.exe 113 PID 3548 wrote to memory of 2080 3548 rwwnw64d.exe 114 PID 124 wrote to memory of 3376 124 rwwnw64d.exe 115 PID 2080 wrote to memory of 4656 2080 rwwnw64d.exe 116 PID 3376 wrote to memory of 4052 3376 rwwnw64d.exe 117 PID 4656 wrote to memory of 5560 4656 rwwnw64d.exe 118 PID 4052 wrote to memory of 700 4052 rwwnw64d.exe 119 PID 5560 wrote to memory of 5624 5560 rwwnw64d.exe 120 PID 700 wrote to memory of 2164 700 rwwnw64d.exe 121 PID 5624 wrote to memory of 2444 5624 rwwnw64d.exe 122 PID 2164 wrote to memory of 1956 2164 rwwnw64d.exe 123 PID 2444 wrote to memory of 4180 2444 rwwnw64d.exe 124 PID 1956 wrote to memory of 4064 1956 rwwnw64d.exe 125 PID 4180 wrote to memory of 3496 4180 rwwnw64d.exe 126 PID 4064 wrote to memory of 2336 4064 rwwnw64d.exe 127 PID 3496 wrote to memory of 1548 3496 rwwnw64d.exe 128 PID 2336 wrote to memory of 1148 2336 rwwnw64d.exe 129 PID 1548 wrote to memory of 712 1548 rwwnw64d.exe 130 PID 1148 wrote to memory of 2988 1148 rwwnw64d.exe 131 PID 712 wrote to memory of 5172 712 rwwnw64d.exe 132 PID 2988 wrote to memory of 1784 2988 rwwnw64d.exe 133 PID 5172 wrote to memory of 1952 5172 rwwnw64d.exe 134 PID 1784 wrote to memory of 1668 1784 rwwnw64d.exe 135 PID 1952 wrote to memory of 5320 1952 rwwnw64d.exe 136 PID 1668 wrote to memory of 1300 1668 rwwnw64d.exe 137 PID 5320 wrote to memory of 5520 5320 rwwnw64d.exe 138 PID 1300 wrote to memory of 1308 1300 rwwnw64d.exe 139 PID 5520 wrote to memory of 1712 5520 rwwnw64d.exe 140 PID 1308 wrote to memory of 4888 1308 rwwnw64d.exe 142 PID 1712 wrote to memory of 624 1712 rwwnw64d.exe 143 PID 4888 wrote to memory of 5712 4888 rwwnw64d.exe 144 PID 624 wrote to memory of 964 624 rwwnw64d.exe 145 PID 5712 wrote to memory of 3812 5712 rwwnw64d.exe 146 PID 964 wrote to memory of 3612 964 rwwnw64d.exe 147 PID 3812 wrote to memory of 2244 3812 rwwnw64d.exe 148 PID 3612 wrote to memory of 4264 3612 rwwnw64d.exe 149 PID 2244 wrote to memory of 3776 2244 rwwnw64d.exe 150 PID 4264 wrote to memory of 5500 4264 rwwnw64d.exe 151 PID 3776 wrote to memory of 4880 3776 rwwnw64d.exe 152 PID 5500 wrote to memory of 3192 5500 rwwnw64d.exe 153 PID 4880 wrote to memory of 5372 4880 rwwnw64d.exe 154 PID 3192 wrote to memory of 5060 3192 rwwnw64d.exe 155 PID 5372 wrote to memory of 4108 5372 rwwnw64d.exe 156 PID 5060 wrote to memory of 2940 5060 rwwnw64d.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_afd7eae42c4152517a4d6fe99401c327_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX12⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX13⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX14⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX15⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX16⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX18⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX20⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX23⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX24⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX30⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX32⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX33⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5372 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX34⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4108 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX35⤵
- Drops startup file
PID:2776 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX36⤵
- Drops startup file
- Modifies registry class
PID:5864 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX37⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1604 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX38⤵
- System Location Discovery: System Language Discovery
PID:3248 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX39⤵
- Modifies registry class
PID:6040 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX40⤵
- System Location Discovery: System Language Discovery
PID:5408 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX41⤵PID:4472
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX42⤵
- Drops file in System32 directory
- Modifies registry class
PID:5680 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX43⤵
- Drops startup file
PID:4432 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX44⤵
- Drops startup file
PID:5228 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX45⤵PID:1388
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX46⤵PID:3156
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX47⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2660 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX48⤵
- Modifies registry class
PID:1552 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX49⤵
- Drops startup file
- Drops file in System32 directory
PID:2612 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX50⤵
- Modifies registry class
PID:5524 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX51⤵PID:1816
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX52⤵
- Drops file in System32 directory
PID:5744 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX53⤵PID:4140
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX54⤵
- System Location Discovery: System Language Discovery
PID:3404 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX55⤵
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX56⤵
- Drops startup file
- Modifies registry class
PID:1128 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX57⤵PID:5308
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX58⤵
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX59⤵
- Modifies registry class
PID:5304 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX60⤵
- Drops file in System32 directory
PID:2780 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX61⤵
- Drops startup file
PID:2876 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX62⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5856 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX63⤵
- Drops startup file
PID:4632 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX64⤵PID:1848
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX65⤵
- Drops file in System32 directory
PID:5364 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX66⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6048 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX67⤵
- Adds Run key to start application
PID:1056 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX68⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1312 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX69⤵
- Drops startup file
- Drops file in System32 directory
PID:2904 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX70⤵
- Drops file in System32 directory
PID:1136 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX71⤵
- Modifies registry class
PID:4400 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX72⤵PID:4916
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX73⤵
- System Location Discovery: System Language Discovery
PID:4960 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX74⤵
- Drops startup file
PID:2192 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX75⤵
- Modifies registry class
PID:200 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX76⤵PID:3504
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX77⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1336 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX78⤵PID:1772
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX79⤵
- Drops startup file
- Drops file in System32 directory
PID:2332 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX80⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4388 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX81⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX82⤵
- System Location Discovery: System Language Discovery
PID:2932 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX83⤵
- Drops startup file
PID:1268 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX84⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2852 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX85⤵
- Drops startup file
- Drops file in System32 directory
PID:900 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX86⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5956 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX87⤵
- System Location Discovery: System Language Discovery
PID:672 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX88⤵
- Modifies registry class
PID:2960 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX89⤵
- Drops startup file
PID:3860 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX90⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3676 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX91⤵
- Drops startup file
- Drops file in System32 directory
PID:5016 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX92⤵
- Drops file in System32 directory
- Modifies registry class
PID:4744 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX93⤵
- Modifies registry class
PID:5352 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX94⤵
- System Location Discovery: System Language Discovery
PID:4488 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX95⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5284 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX96⤵
- Drops startup file
- Modifies registry class
PID:4220 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX97⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6064 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX98⤵PID:4704
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX99⤵PID:2136
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX100⤵
- Modifies registry class
PID:4200 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX101⤵
- Drops file in System32 directory
PID:6052 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX102⤵
- Drops file in System32 directory
PID:5784 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX103⤵PID:5764
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX104⤵
- System Location Discovery: System Language Discovery
PID:1100 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX105⤵PID:4396
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX106⤵
- Drops file in System32 directory
PID:6016 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX107⤵
- Drops file in System32 directory
PID:5144 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX108⤵PID:4776
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX109⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1116 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX110⤵PID:2464
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX111⤵PID:5336
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX112⤵
- Modifies registry class
PID:5512 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX113⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:5440 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX114⤵
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX115⤵PID:2548
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX117⤵PID:4624
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX118⤵
- Modifies registry class
PID:3064 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX119⤵PID:1564
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX120⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2656 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX121⤵
- System Location Discovery: System Language Discovery
PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-