Analysis
- max time kernel
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe
- Size 74KB
- Sample260707-d1c1msd12l
- SHA256 6c98e5d11e08da818c0336ca979ff86045485773c2921c374e750a748a6c5c07
- MD5 608df2ff9dde8f56a5447e4883bb55bc
- SHA1 a1ea5f19198e64e6df5380c899944be750e13e0e
- SHA512 ae8d4a06d78aac585ed82c94870c719f1fb2c4599008dfc38f4d5f625b0772f887ae4b63e42663ec72d3c58090c5d43f32706d641d36f492ace6dfd024701647
- SSDEEP 768:FsFl3VOcV1OEqy7igfh9zuwrZXA6Wl9Oy2nfUECHpXuRNFCik5TRo7tJMW/gM:FsBOppy7/hu4A6W+D3CEgdBW/gM
- TLSH T12973FA83AE594091E6159B70462D233FDA73A4AE0B30D7A717D8DE3C78371C1AC396B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe - Executes dropped EXE 64 IoCs
pid Process 6008 rwwdw64d.exe 2972 rwwdw64d.exe 5368 rwwdw64d.exe 4816 rwwdw64d.exe 4460 rwwdw64d.exe 4964 rwwdw64d.exe 5036 rwwdw64d.exe 5476 rwwdw64d.exe 1548 rwwdw64d.exe 6032 rwwdw64d.exe 2912 rwwdw64d.exe 5092 rwwdw64d.exe 2212 rwwdw64d.exe 4284 rwwdw64d.exe 3208 rwwdw64d.exe 5140 rwwdw64d.exe 2196 rwwdw64d.exe 4308 rwwdw64d.exe 3528 rwwdw64d.exe 3408 rwwdw64d.exe 400 rwwdw64d.exe 3372 rwwdw64d.exe 3404 rwwdw64d.exe 3192 rwwdw64d.exe 5572 rwwdw64d.exe 3548 rwwdw64d.exe 1696 rwwdw64d.exe 764 rwwdw64d.exe 592 rwwdw64d.exe 5656 rwwdw64d.exe 6024 rwwdw64d.exe 3024 rwwdw64d.exe 2288 rwwdw64d.exe 3012 rwwdw64d.exe 2484 rwwdw64d.exe 3424 rwwdw64d.exe 5080 rwwdw64d.exe 5180 rwwdw64d.exe 2956 rwwdw64d.exe 5880 rwwdw64d.exe 4680 rwwdw64d.exe 1104 rwwdw64d.exe 5632 rwwdw64d.exe 2832 rwwdw64d.exe 2924 rwwdw64d.exe 3912 rwwdw64d.exe 5364 rwwdw64d.exe 3820 rwwdw64d.exe 2960 rwwdw64d.exe 2056 rwwdw64d.exe 3648 rwwdw64d.exe 5412 rwwdw64d.exe 5648 rwwdw64d.exe 3748 rwwdw64d.exe 5284 rwwdw64d.exe 4988 rwwdw64d.exe 1392 rwwdw64d.exe 1284 rwwdw64d.exe 5756 rwwdw64d.exe 3128 rwwdw64d.exe 2568 rwwdw64d.exe 1624 rwwdw64d.exe 5372 rwwdw64d.exe 5376 rwwdw64d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{B8-86-60-0C-DW} = "C:\\Windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{B8-86-60-0C-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{B8-86-60-0C-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe DWoli" 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{B8-86-60-0C-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File created \??\c:\windows\SysWOW64\rwwdw64d.exe 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File created C:\Windows\SysWOW64\msnav32.ax 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_07_07_26.log rwwdw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (data) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-1590476978-4004838454-3790292847-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2316 explorer.exe 2316 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2316 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe Token: SeShutdownPrivilege 2316 explorer.exe Token: SeCreatePagefilePrivilege 2316 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2892 sihost.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe 2316 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1092 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe 1092 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe 6008 rwwdw64d.exe 6008 rwwdw64d.exe 2972 rwwdw64d.exe 2972 rwwdw64d.exe 5368 rwwdw64d.exe 5368 rwwdw64d.exe 4816 rwwdw64d.exe 4816 rwwdw64d.exe 4460 rwwdw64d.exe 4460 rwwdw64d.exe 4964 rwwdw64d.exe 4964 rwwdw64d.exe 5036 rwwdw64d.exe 5036 rwwdw64d.exe 5476 rwwdw64d.exe 5476 rwwdw64d.exe 1548 rwwdw64d.exe 1548 rwwdw64d.exe 6032 rwwdw64d.exe 6032 rwwdw64d.exe 2912 rwwdw64d.exe 2912 rwwdw64d.exe 5092 rwwdw64d.exe 5092 rwwdw64d.exe 2212 rwwdw64d.exe 2212 rwwdw64d.exe 4284 rwwdw64d.exe 4284 rwwdw64d.exe 3208 rwwdw64d.exe 3208 rwwdw64d.exe 5140 rwwdw64d.exe 5140 rwwdw64d.exe 2196 rwwdw64d.exe 2196 rwwdw64d.exe 4308 rwwdw64d.exe 4308 rwwdw64d.exe 3528 rwwdw64d.exe 3528 rwwdw64d.exe 3408 rwwdw64d.exe 3408 rwwdw64d.exe 400 rwwdw64d.exe 400 rwwdw64d.exe 3372 rwwdw64d.exe 3372 rwwdw64d.exe 3404 rwwdw64d.exe 3404 rwwdw64d.exe 3192 rwwdw64d.exe 3192 rwwdw64d.exe 5572 rwwdw64d.exe 5572 rwwdw64d.exe 3548 rwwdw64d.exe 3548 rwwdw64d.exe 1696 rwwdw64d.exe 1696 rwwdw64d.exe 764 rwwdw64d.exe 764 rwwdw64d.exe 592 rwwdw64d.exe 592 rwwdw64d.exe 5656 rwwdw64d.exe 5656 rwwdw64d.exe 6024 rwwdw64d.exe 6024 rwwdw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 6008 1092 2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe 87 PID 6008 wrote to memory of 2972 6008 rwwdw64d.exe 89 PID 2972 wrote to memory of 4816 2972 rwwdw64d.exe 93 PID 5368 wrote to memory of 4460 5368 rwwdw64d.exe 94 PID 4816 wrote to memory of 4964 4816 rwwdw64d.exe 95 PID 4460 wrote to memory of 5036 4460 rwwdw64d.exe 97 PID 4964 wrote to memory of 5476 4964 rwwdw64d.exe 98 PID 5036 wrote to memory of 1548 5036 rwwdw64d.exe 99 PID 5476 wrote to memory of 6032 5476 rwwdw64d.exe 100 PID 1548 wrote to memory of 2912 1548 rwwdw64d.exe 101 PID 6032 wrote to memory of 5092 6032 rwwdw64d.exe 102 PID 2912 wrote to memory of 2212 2912 rwwdw64d.exe 103 PID 5092 wrote to memory of 4284 5092 rwwdw64d.exe 104 PID 2212 wrote to memory of 3208 2212 rwwdw64d.exe 105 PID 4284 wrote to memory of 5140 4284 rwwdw64d.exe 106 PID 3208 wrote to memory of 2196 3208 rwwdw64d.exe 107 PID 5140 wrote to memory of 4308 5140 rwwdw64d.exe 108 PID 2196 wrote to memory of 3528 2196 rwwdw64d.exe 109 PID 4308 wrote to memory of 3408 4308 rwwdw64d.exe 110 PID 3528 wrote to memory of 400 3528 rwwdw64d.exe 111 PID 3408 wrote to memory of 3372 3408 rwwdw64d.exe 112 PID 400 wrote to memory of 3404 400 rwwdw64d.exe 113 PID 3372 wrote to memory of 3192 3372 rwwdw64d.exe 114 PID 3404 wrote to memory of 5572 3404 rwwdw64d.exe 115 PID 3192 wrote to memory of 3548 3192 rwwdw64d.exe 116 PID 5572 wrote to memory of 1696 5572 rwwdw64d.exe 117 PID 3548 wrote to memory of 764 3548 rwwdw64d.exe 118 PID 1696 wrote to memory of 592 1696 rwwdw64d.exe 119 PID 764 wrote to memory of 5656 764 rwwdw64d.exe 120 PID 592 wrote to memory of 6024 592 rwwdw64d.exe 121 PID 5656 wrote to memory of 3024 5656 rwwdw64d.exe 122 PID 6024 wrote to memory of 2288 6024 rwwdw64d.exe 123 PID 3024 wrote to memory of 3012 3024 rwwdw64d.exe 124 PID 2288 wrote to memory of 2484 2288 rwwdw64d.exe 125 PID 3012 wrote to memory of 3424 3012 rwwdw64d.exe 126 PID 2484 wrote to memory of 5080 2484 rwwdw64d.exe 127 PID 3424 wrote to memory of 5180 3424 rwwdw64d.exe 128 PID 5080 wrote to memory of 2956 5080 rwwdw64d.exe 129 PID 5180 wrote to memory of 5880 5180 rwwdw64d.exe 130 PID 2956 wrote to memory of 4680 2956 rwwdw64d.exe 131 PID 5880 wrote to memory of 1104 5880 rwwdw64d.exe 132 PID 4680 wrote to memory of 5632 4680 rwwdw64d.exe 133 PID 1104 wrote to memory of 2832 1104 rwwdw64d.exe 134 PID 5632 wrote to memory of 2924 5632 rwwdw64d.exe 135 PID 2832 wrote to memory of 3912 2832 rwwdw64d.exe 136 PID 2924 wrote to memory of 5364 2924 rwwdw64d.exe 137 PID 3912 wrote to memory of 3820 3912 rwwdw64d.exe 138 PID 5364 wrote to memory of 2960 5364 rwwdw64d.exe 139 PID 3820 wrote to memory of 2056 3820 rwwdw64d.exe 140 PID 2960 wrote to memory of 3648 2960 rwwdw64d.exe 141 PID 2056 wrote to memory of 5412 2056 rwwdw64d.exe 142 PID 3648 wrote to memory of 5648 3648 rwwdw64d.exe 143 PID 5412 wrote to memory of 3748 5412 rwwdw64d.exe 144 PID 5648 wrote to memory of 5284 5648 rwwdw64d.exe 145 PID 3748 wrote to memory of 4988 3748 rwwdw64d.exe 146 PID 5284 wrote to memory of 1392 5284 rwwdw64d.exe 147 PID 4988 wrote to memory of 1284 4988 rwwdw64d.exe 148 PID 1392 wrote to memory of 5756 1392 rwwdw64d.exe 149 PID 1284 wrote to memory of 3128 1284 rwwdw64d.exe 150 PID 5756 wrote to memory of 2568 5756 rwwdw64d.exe 151 PID 3128 wrote to memory of 1624 3128 rwwdw64d.exe 152 PID 2568 wrote to memory of 5372 2568 rwwdw64d.exe 153 PID 1624 wrote to memory of 5376 1624 rwwdw64d.exe 154 PID 5372 wrote to memory of 1120 5372 rwwdw64d.exe 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_608df2ff9dde8f56a5447e4883bb55bc_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5180 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5412 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
PID:5376 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Drops startup file
- Modifies registry class
PID:2032 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵PID:5484
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵
- Drops file in System32 directory
PID:5888 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵
- Drops startup file
PID:3084 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵PID:5992
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Modifies registry class
PID:4972 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵PID:4180
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵PID:3668
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- Drops file in System32 directory
PID:4944 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵
- Drops file in System32 directory
- Modifies registry class
PID:5208 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Drops file in System32 directory
PID:1988 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Drops file in System32 directory
- Modifies registry class
PID:2656 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵PID:1192
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵PID:3816
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- Drops startup file
PID:2372 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Drops startup file
- Drops file in System32 directory
PID:3560 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵PID:4896
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- Drops file in System32 directory
PID:3856 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Drops file in System32 directory
PID:1144 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5624 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
- Drops startup file
PID:3772 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- Drops startup file
PID:1068 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵PID:4356
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- Drops startup file
PID:2272 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵PID:2920
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Modifies registry class
PID:4812 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2168 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4396 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4884 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
- System Location Discovery: System Language Discovery
PID:5852 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- Drops startup file
- Modifies registry class
PID:5564 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- Modifies registry class
PID:2688 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Drops file in System32 directory
- Modifies registry class
PID:3848 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵PID:1464
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4796 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:960 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops file in System32 directory
PID:4824 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵
- Modifies registry class
PID:3392 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Drops file in System32 directory
- Modifies registry class
PID:3000 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- Modifies registry class
PID:3464 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4124 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3564 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3416 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- Drops startup file
- Modifies registry class
PID:3004 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4868 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:936 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵
- Drops file in System32 directory
PID:2488 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
- Drops file in System32 directory
- Modifies registry class
PID:5928 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4632 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵PID:4664
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵PID:4572
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:956 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵
- Drops file in System32 directory
- Modifies registry class
PID:5148 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5448 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- Drops startup file
PID:5924 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵PID:4476
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵
- Drops startup file
PID:5644 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵
- System Location Discovery: System Language Discovery
PID:4608 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4576 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵
- Modifies registry class
PID:4552 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
- Modifies registry class
PID:4312 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵PID:2768
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Modifies registry class
PID:4876 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵
- System Location Discovery: System Language Discovery
PID:4216 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:828 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵
- Modifies registry class
PID:552 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵PID:1264
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵
- Drops file in System32 directory
PID:2436 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5516 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵
- Drops startup file
PID:1372 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵
- Drops startup file
- Drops file in System32 directory
PID:848 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6020 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵
- Drops file in System32 directory
- Modifies registry class
PID:3364 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵
- Drops startup file
- Drops file in System32 directory
PID:2440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵PID:4904
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵PID:2028
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵
- Drops startup file
PID:4120 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵
- Drops startup file
PID:3360 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5996 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵
- Modifies registry class
PID:4208 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵
- System Location Discovery: System Language Discovery
PID:900 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵PID:1300
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵PID:4256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-