Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe
- Size 48KB
- Sample260705-gr329ady9m
- SHA256 a5fa551ed620361349093bbfa3f6116e6a8b2aa1d0a4b3a3725b885362aa41bf
- MD5 cf68e86128a457f448cc11b927a5a368
- SHA1 3bbed8b5ebab38179e75d3968714ceecf964f027
- SHA512 1f794a5961afa6013efebc82671e3722704fa2d4da50d0f1f2faf92ca2125080a29f3df0a8a41f26d896a253a1d00d8eccc64ee2da33a01fdfe15eda249a73b6
- SSDEEP 768:aTdZuu1Ao2J29ng+nqVshjKrVFRoPKDk53Rx7tfk1FuL4:CSgAo2Q9g4oshjqLbMxeuc
- TLSH T13E23F743AD4B8095E211A6B0456D327DCB73797A0760D7771784ED3C6837182FC3AAAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe - Executes dropped EXE 64 IoCs
pid Process 2652 rwwnw64d.exe 3696 rwwnw64d.exe 3428 rwwnw64d.exe 5156 rwwnw64d.exe 4768 rwwnw64d.exe 2520 rwwnw64d.exe 7008 rwwnw64d.exe 1040 rwwnw64d.exe 5572 rwwnw64d.exe 5504 rwwnw64d.exe 3692 rwwnw64d.exe 5740 rwwnw64d.exe 6756 rwwnw64d.exe 6540 rwwnw64d.exe 2508 rwwnw64d.exe 5164 rwwnw64d.exe 6120 rwwnw64d.exe 5988 rwwnw64d.exe 4748 rwwnw64d.exe 1252 rwwnw64d.exe 6124 rwwnw64d.exe 900 rwwnw64d.exe 4512 rwwnw64d.exe 6908 rwwnw64d.exe 5996 rwwnw64d.exe 4840 rwwnw64d.exe 3760 rwwnw64d.exe 4540 rwwnw64d.exe 3684 rwwnw64d.exe 4856 rwwnw64d.exe 2156 rwwnw64d.exe 3936 rwwnw64d.exe 4148 rwwnw64d.exe 6084 rwwnw64d.exe 1952 rwwnw64d.exe 5040 rwwnw64d.exe 4724 rwwnw64d.exe 2560 rwwnw64d.exe 880 rwwnw64d.exe 6868 rwwnw64d.exe 6832 rwwnw64d.exe 7028 rwwnw64d.exe 692 rwwnw64d.exe 2448 rwwnw64d.exe 4276 rwwnw64d.exe 4240 rwwnw64d.exe 7152 rwwnw64d.exe 2820 rwwnw64d.exe 1156 rwwnw64d.exe 5484 rwwnw64d.exe 2028 rwwnw64d.exe 2924 rwwnw64d.exe 456 rwwnw64d.exe 292 rwwnw64d.exe 256 rwwnw64d.exe 6468 rwwnw64d.exe 6548 rwwnw64d.exe 6304 rwwnw64d.exe 7036 rwwnw64d.exe 3660 rwwnw64d.exe 6356 rwwnw64d.exe 3068 rwwnw64d.exe 6596 rwwnw64d.exe 5456 rwwnw64d.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-24-46-6E-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe DWrvgXX" 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-24-46-6E-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-24-46-6E-DW} = "C:\\Windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{42-24-46-6E-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{0E-E2-2F-F2-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File created \??\c:\windows\SysWOW64\rwwnw64d.exe 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification \??\c:\windows\SysWOW64\rwwnw64d.exe 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_07_26.log rwwnw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5396 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe 5396 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe 2652 rwwnw64d.exe 2652 rwwnw64d.exe 3696 rwwnw64d.exe 3696 rwwnw64d.exe 3428 rwwnw64d.exe 3428 rwwnw64d.exe 5156 rwwnw64d.exe 5156 rwwnw64d.exe 4768 rwwnw64d.exe 4768 rwwnw64d.exe 2520 rwwnw64d.exe 2520 rwwnw64d.exe 7008 rwwnw64d.exe 7008 rwwnw64d.exe 1040 rwwnw64d.exe 1040 rwwnw64d.exe 5572 rwwnw64d.exe 5572 rwwnw64d.exe 5504 rwwnw64d.exe 5504 rwwnw64d.exe 3692 rwwnw64d.exe 3692 rwwnw64d.exe 5740 rwwnw64d.exe 5740 rwwnw64d.exe 6756 rwwnw64d.exe 6756 rwwnw64d.exe 6540 rwwnw64d.exe 6540 rwwnw64d.exe 2508 rwwnw64d.exe 2508 rwwnw64d.exe 5164 rwwnw64d.exe 5164 rwwnw64d.exe 6120 rwwnw64d.exe 6120 rwwnw64d.exe 5988 rwwnw64d.exe 5988 rwwnw64d.exe 4748 rwwnw64d.exe 4748 rwwnw64d.exe 1252 rwwnw64d.exe 1252 rwwnw64d.exe 6124 rwwnw64d.exe 6124 rwwnw64d.exe 900 rwwnw64d.exe 900 rwwnw64d.exe 4512 rwwnw64d.exe 4512 rwwnw64d.exe 6908 rwwnw64d.exe 6908 rwwnw64d.exe 5996 rwwnw64d.exe 5996 rwwnw64d.exe 4840 rwwnw64d.exe 4840 rwwnw64d.exe 3760 rwwnw64d.exe 3760 rwwnw64d.exe 4540 rwwnw64d.exe 4540 rwwnw64d.exe 3684 rwwnw64d.exe 3684 rwwnw64d.exe 4856 rwwnw64d.exe 4856 rwwnw64d.exe 2156 rwwnw64d.exe 2156 rwwnw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5396 wrote to memory of 2652 5396 2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe 89 PID 2652 wrote to memory of 3696 2652 rwwnw64d.exe 91 PID 3696 wrote to memory of 5156 3696 rwwnw64d.exe 95 PID 3428 wrote to memory of 4768 3428 rwwnw64d.exe 96 PID 5156 wrote to memory of 2520 5156 rwwnw64d.exe 97 PID 4768 wrote to memory of 7008 4768 rwwnw64d.exe 99 PID 2520 wrote to memory of 1040 2520 rwwnw64d.exe 100 PID 7008 wrote to memory of 5572 7008 rwwnw64d.exe 101 PID 1040 wrote to memory of 5504 1040 rwwnw64d.exe 102 PID 5572 wrote to memory of 3692 5572 rwwnw64d.exe 103 PID 5504 wrote to memory of 5740 5504 rwwnw64d.exe 104 PID 3692 wrote to memory of 6756 3692 rwwnw64d.exe 105 PID 5740 wrote to memory of 6540 5740 rwwnw64d.exe 106 PID 6756 wrote to memory of 2508 6756 rwwnw64d.exe 107 PID 6540 wrote to memory of 5164 6540 rwwnw64d.exe 108 PID 2508 wrote to memory of 6120 2508 rwwnw64d.exe 109 PID 5164 wrote to memory of 5988 5164 rwwnw64d.exe 110 PID 6120 wrote to memory of 4748 6120 rwwnw64d.exe 111 PID 5988 wrote to memory of 1252 5988 rwwnw64d.exe 112 PID 4748 wrote to memory of 6124 4748 rwwnw64d.exe 113 PID 1252 wrote to memory of 900 1252 rwwnw64d.exe 114 PID 6124 wrote to memory of 4512 6124 rwwnw64d.exe 115 PID 900 wrote to memory of 6908 900 rwwnw64d.exe 116 PID 4512 wrote to memory of 5996 4512 rwwnw64d.exe 117 PID 6908 wrote to memory of 4840 6908 rwwnw64d.exe 118 PID 5996 wrote to memory of 3760 5996 rwwnw64d.exe 119 PID 4840 wrote to memory of 4540 4840 rwwnw64d.exe 120 PID 3760 wrote to memory of 3684 3760 rwwnw64d.exe 121 PID 4540 wrote to memory of 4856 4540 rwwnw64d.exe 122 PID 3684 wrote to memory of 2156 3684 rwwnw64d.exe 123 PID 4856 wrote to memory of 3936 4856 rwwnw64d.exe 124 PID 2156 wrote to memory of 4148 2156 rwwnw64d.exe 125 PID 3936 wrote to memory of 6084 3936 rwwnw64d.exe 126 PID 4148 wrote to memory of 1952 4148 rwwnw64d.exe 127 PID 6084 wrote to memory of 5040 6084 rwwnw64d.exe 128 PID 1952 wrote to memory of 4724 1952 rwwnw64d.exe 129 PID 5040 wrote to memory of 2560 5040 rwwnw64d.exe 130 PID 4724 wrote to memory of 880 4724 rwwnw64d.exe 131 PID 2560 wrote to memory of 6868 2560 rwwnw64d.exe 132 PID 880 wrote to memory of 6832 880 rwwnw64d.exe 133 PID 6868 wrote to memory of 7028 6868 rwwnw64d.exe 134 PID 6832 wrote to memory of 692 6832 rwwnw64d.exe 135 PID 7028 wrote to memory of 2448 7028 rwwnw64d.exe 136 PID 692 wrote to memory of 4276 692 rwwnw64d.exe 137 PID 2448 wrote to memory of 4240 2448 rwwnw64d.exe 138 PID 4276 wrote to memory of 7152 4276 rwwnw64d.exe 139 PID 4240 wrote to memory of 2820 4240 rwwnw64d.exe 140 PID 7152 wrote to memory of 1156 7152 rwwnw64d.exe 141 PID 2820 wrote to memory of 5484 2820 rwwnw64d.exe 142 PID 1156 wrote to memory of 2028 1156 rwwnw64d.exe 143 PID 5484 wrote to memory of 2924 5484 rwwnw64d.exe 144 PID 2028 wrote to memory of 456 2028 rwwnw64d.exe 145 PID 2924 wrote to memory of 292 2924 rwwnw64d.exe 146 PID 456 wrote to memory of 256 456 rwwnw64d.exe 147 PID 292 wrote to memory of 6468 292 rwwnw64d.exe 148 PID 256 wrote to memory of 6548 256 rwwnw64d.exe 149 PID 6468 wrote to memory of 6304 6468 rwwnw64d.exe 150 PID 6548 wrote to memory of 7036 6548 rwwnw64d.exe 151 PID 6304 wrote to memory of 3660 6304 rwwnw64d.exe 152 PID 7036 wrote to memory of 6356 7036 rwwnw64d.exe 153 PID 3660 wrote to memory of 3068 3660 rwwnw64d.exe 154 PID 6356 wrote to memory of 6596 6356 rwwnw64d.exe 155 PID 3068 wrote to memory of 5456 3068 rwwnw64d.exe 156 PID 6596 wrote to memory of 996 6596 rwwnw64d.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_cf68e86128a457f448cc11b927a5a368_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX6⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6540 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX12⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6908 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX15⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX16⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6084 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX20⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX21⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6868 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7028 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX26⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX27⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6468 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6304 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:5456 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX35⤵
- Drops startup file
- Drops file in System32 directory
PID:4292 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX36⤵PID:1380
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX37⤵PID:5496
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX38⤵
- Drops startup file
PID:6416 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX39⤵
- Drops file in System32 directory
PID:6484 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX40⤵PID:6392
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX41⤵
- Drops startup file
- Modifies registry class
PID:2132 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX42⤵
- Drops startup file
PID:4360 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX43⤵
- Modifies registry class
PID:5936 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX44⤵PID:6112
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX45⤵
- Modifies registry class
PID:7104 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX46⤵
- Drops file in System32 directory
PID:6668 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX47⤵
- Adds Run key to start application
PID:5424 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX48⤵
- System Location Discovery: System Language Discovery
PID:3088 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX49⤵PID:2988
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX50⤵
- Modifies registry class
PID:7096 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX51⤵
- Drops startup file
- Modifies registry class
PID:2232 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX52⤵PID:5696
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX53⤵
- Drops startup file
PID:4456 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX54⤵
- System Location Discovery: System Language Discovery
PID:4088 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX55⤵
- Drops startup file
- Modifies registry class
PID:5532 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX56⤵
- Drops startup file
PID:4988 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX57⤵PID:796
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX58⤵
- Drops file in System32 directory
PID:1204 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX59⤵
- Drops file in System32 directory
PID:6140 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX60⤵
- System Location Discovery: System Language Discovery
PID:4312 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX61⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6900 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX62⤵PID:4208
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX63⤵
- Drops startup file
PID:6300 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX64⤵
- Drops startup file
PID:776 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX65⤵PID:5816
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX66⤵
- Drops file in System32 directory
PID:2772 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX67⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6216 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX68⤵PID:6820
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX69⤵
- Drops startup file
PID:828 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX70⤵
- Modifies registry class
PID:5332 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX71⤵
- Drops file in System32 directory
PID:940 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX72⤵
- Drops file in System32 directory
PID:6180 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX73⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX74⤵PID:6992
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX75⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3388 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX76⤵PID:5708
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX77⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6960 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX78⤵
- Modifies registry class
PID:252 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX79⤵PID:6752
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX80⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6508 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX81⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4196 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX82⤵PID:6724
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX83⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1348 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX84⤵PID:3856
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX85⤵
- Modifies registry class
PID:6008 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX86⤵
- Modifies registry class
PID:6700 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX87⤵PID:5508
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX88⤵PID:6936
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX89⤵PID:6828
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX90⤵
- Modifies registry class
PID:1988 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX91⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX92⤵
- Modifies registry class
PID:1964 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX93⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX94⤵
- Drops startup file
PID:6736 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX95⤵
- Drops startup file
PID:2480 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX96⤵PID:3152
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX97⤵
- Drops file in System32 directory
- Modifies registry class
PID:5628 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX98⤵
- Drops startup file
PID:7080 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX99⤵PID:5264
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX100⤵PID:1976
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX101⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3788 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX102⤵PID:3896
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX103⤵PID:2660
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX104⤵
- Drops file in System32 directory
- Modifies registry class
PID:5200 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX105⤵
- Drops startup file
PID:3188 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX106⤵PID:1296
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX107⤵
- Drops startup file
PID:3644 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX108⤵
- Drops file in System32 directory
PID:6028 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX109⤵
- Drops file in System32 directory
- Modifies registry class
PID:2336 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX110⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX111⤵
- Drops startup file
PID:5364 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX112⤵PID:1748
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX113⤵
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX114⤵
- Drops startup file
PID:4408 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX115⤵
- Drops startup file
- Drops file in System32 directory
PID:3772 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5712 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX117⤵PID:5800
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX118⤵
- Drops file in System32 directory
PID:6228 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX119⤵PID:992
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX120⤵PID:1216
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX121⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-