Analysis
- max time kernel
103s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe
- Size 74KB
- Sample260709-jsa4zafs7x
- SHA256 7850393aa657894a3aaf39553a1e2fbf777b74acede5ebb60f1e43c216f50b05
- MD5 d6ffaacbf18b05d537f3da8c4e319c8e
- SHA1 42cd6bcbcbc56d1d71a1dccc79751552298ce719
- SHA512 b83b1dd0de1b63c64fc2695e6cf81787c962eb641c49434911d1361642d77dfaa7725bc082afd4ff3a7de3d598b049dae9dbc812bc6703c8a426a2aff708211e
- SSDEEP 768:FsFl3VOcV1OEqy7igfh9zuwrZXA6Wl9Oy2nfUECHpXuRNFCik5TRo7tJMW/g9:FsBOppy7/hu4A6W+D3CEgdBW/g9
- TLSH T13B730A83AE594091E6559B70462D233FCA73A4AE0B30D7A717D8DE3C78371C1AC396B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwdw64d.exe - Executes dropped EXE 64 IoCs
pid Process 1596 rwwdw64d.exe 4476 rwwdw64d.exe 5216 rwwdw64d.exe 4568 rwwdw64d.exe 3832 rwwdw64d.exe 4616 rwwdw64d.exe 2484 rwwdw64d.exe 1976 rwwdw64d.exe 5628 rwwdw64d.exe 5892 rwwdw64d.exe 5296 rwwdw64d.exe 1040 rwwdw64d.exe 5248 rwwdw64d.exe 1120 rwwdw64d.exe 4356 rwwdw64d.exe 4708 rwwdw64d.exe 4436 rwwdw64d.exe 252 rwwdw64d.exe 2040 rwwdw64d.exe 3056 rwwdw64d.exe 1588 rwwdw64d.exe 5384 rwwdw64d.exe 2388 rwwdw64d.exe 4496 rwwdw64d.exe 4624 rwwdw64d.exe 5648 rwwdw64d.exe 2828 rwwdw64d.exe 1824 rwwdw64d.exe 4840 rwwdw64d.exe 6124 rwwdw64d.exe 5720 rwwdw64d.exe 3724 rwwdw64d.exe 4552 rwwdw64d.exe 1952 rwwdw64d.exe 1516 rwwdw64d.exe 2552 rwwdw64d.exe 6032 rwwdw64d.exe 3028 rwwdw64d.exe 4536 rwwdw64d.exe 3128 rwwdw64d.exe 3208 rwwdw64d.exe 2392 rwwdw64d.exe 2324 rwwdw64d.exe 4572 rwwdw64d.exe 1080 rwwdw64d.exe 4788 rwwdw64d.exe 5032 rwwdw64d.exe 4216 rwwdw64d.exe 5724 rwwdw64d.exe 5432 rwwdw64d.exe 5808 rwwdw64d.exe 5500 rwwdw64d.exe 1336 rwwdw64d.exe 1812 rwwdw64d.exe 2696 rwwdw64d.exe 4388 rwwdw64d.exe 1212 rwwdw64d.exe 3708 rwwdw64d.exe 1308 rwwdw64d.exe 1832 rwwdw64d.exe 2052 rwwdw64d.exe 4540 rwwdw64d.exe 924 rwwdw64d.exe 2192 rwwdw64d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{46-67-74-4A-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{46-67-74-4A-DW} = "C:\\Windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{46-67-74-4A-DW} = "c:\\windows\\SysWOW64\\rwwdw64d.exe DWoli" rwwdw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{46-67-74-4A-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe DWoli" 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File created \??\c:\windows\SysWOW64\rwwdw64d.exe 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File created C:\Windows\SysWOW64\msnav32.ax 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_09_07_26.log rwwdw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwdw64d.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (int) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{6704100E-2FCB-4AAE-9BD0-FA308A49BAF3} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Set value (data) \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm rwwdw64d.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5380 explorer.exe 5380 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe Token: SeShutdownPrivilege 5380 explorer.exe Token: SeCreatePagefilePrivilege 5380 explorer.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 4784 sihost.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe 5380 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2492 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe 2492 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe 1596 rwwdw64d.exe 1596 rwwdw64d.exe 4476 rwwdw64d.exe 4476 rwwdw64d.exe 5216 rwwdw64d.exe 5216 rwwdw64d.exe 4568 rwwdw64d.exe 4568 rwwdw64d.exe 3832 rwwdw64d.exe 3832 rwwdw64d.exe 4616 rwwdw64d.exe 4616 rwwdw64d.exe 2484 rwwdw64d.exe 2484 rwwdw64d.exe 1976 rwwdw64d.exe 1976 rwwdw64d.exe 5628 rwwdw64d.exe 5628 rwwdw64d.exe 5892 rwwdw64d.exe 5892 rwwdw64d.exe 5296 rwwdw64d.exe 5296 rwwdw64d.exe 1040 rwwdw64d.exe 1040 rwwdw64d.exe 5248 rwwdw64d.exe 5248 rwwdw64d.exe 1120 rwwdw64d.exe 1120 rwwdw64d.exe 4356 rwwdw64d.exe 4356 rwwdw64d.exe 4708 rwwdw64d.exe 4708 rwwdw64d.exe 4436 rwwdw64d.exe 4436 rwwdw64d.exe 252 rwwdw64d.exe 252 rwwdw64d.exe 2040 rwwdw64d.exe 2040 rwwdw64d.exe 3056 rwwdw64d.exe 3056 rwwdw64d.exe 1588 rwwdw64d.exe 1588 rwwdw64d.exe 5384 rwwdw64d.exe 5384 rwwdw64d.exe 2388 rwwdw64d.exe 2388 rwwdw64d.exe 4496 rwwdw64d.exe 4496 rwwdw64d.exe 4624 rwwdw64d.exe 4624 rwwdw64d.exe 5648 rwwdw64d.exe 5648 rwwdw64d.exe 2828 rwwdw64d.exe 2828 rwwdw64d.exe 1824 rwwdw64d.exe 1824 rwwdw64d.exe 4840 rwwdw64d.exe 4840 rwwdw64d.exe 6124 rwwdw64d.exe 6124 rwwdw64d.exe 5720 rwwdw64d.exe 5720 rwwdw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 1596 2492 2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe 88 PID 1596 wrote to memory of 4476 1596 rwwdw64d.exe 90 PID 4476 wrote to memory of 4568 4476 rwwdw64d.exe 94 PID 5216 wrote to memory of 3832 5216 rwwdw64d.exe 95 PID 4568 wrote to memory of 4616 4568 rwwdw64d.exe 96 PID 3832 wrote to memory of 2484 3832 rwwdw64d.exe 98 PID 4616 wrote to memory of 1976 4616 rwwdw64d.exe 99 PID 2484 wrote to memory of 5628 2484 rwwdw64d.exe 100 PID 1976 wrote to memory of 5892 1976 rwwdw64d.exe 101 PID 5628 wrote to memory of 5296 5628 rwwdw64d.exe 102 PID 5892 wrote to memory of 1040 5892 rwwdw64d.exe 103 PID 5296 wrote to memory of 5248 5296 rwwdw64d.exe 104 PID 1040 wrote to memory of 1120 1040 rwwdw64d.exe 105 PID 5248 wrote to memory of 4356 5248 rwwdw64d.exe 106 PID 1120 wrote to memory of 4708 1120 rwwdw64d.exe 107 PID 4356 wrote to memory of 4436 4356 rwwdw64d.exe 108 PID 4708 wrote to memory of 252 4708 rwwdw64d.exe 109 PID 4436 wrote to memory of 2040 4436 rwwdw64d.exe 110 PID 252 wrote to memory of 3056 252 rwwdw64d.exe 111 PID 2040 wrote to memory of 1588 2040 rwwdw64d.exe 112 PID 3056 wrote to memory of 5384 3056 rwwdw64d.exe 113 PID 1588 wrote to memory of 2388 1588 rwwdw64d.exe 114 PID 5384 wrote to memory of 4496 5384 rwwdw64d.exe 115 PID 2388 wrote to memory of 4624 2388 rwwdw64d.exe 116 PID 4496 wrote to memory of 5648 4496 rwwdw64d.exe 117 PID 4624 wrote to memory of 2828 4624 rwwdw64d.exe 118 PID 5648 wrote to memory of 1824 5648 rwwdw64d.exe 119 PID 2828 wrote to memory of 4840 2828 rwwdw64d.exe 120 PID 1824 wrote to memory of 6124 1824 rwwdw64d.exe 121 PID 4840 wrote to memory of 5720 4840 rwwdw64d.exe 122 PID 6124 wrote to memory of 3724 6124 rwwdw64d.exe 123 PID 5720 wrote to memory of 4552 5720 rwwdw64d.exe 124 PID 3724 wrote to memory of 1952 3724 rwwdw64d.exe 125 PID 4552 wrote to memory of 1516 4552 rwwdw64d.exe 126 PID 1952 wrote to memory of 2552 1952 rwwdw64d.exe 127 PID 1516 wrote to memory of 6032 1516 rwwdw64d.exe 128 PID 2552 wrote to memory of 3028 2552 rwwdw64d.exe 129 PID 6032 wrote to memory of 4536 6032 rwwdw64d.exe 130 PID 3028 wrote to memory of 3128 3028 rwwdw64d.exe 131 PID 4536 wrote to memory of 3208 4536 rwwdw64d.exe 132 PID 3128 wrote to memory of 2392 3128 rwwdw64d.exe 133 PID 3208 wrote to memory of 2324 3208 rwwdw64d.exe 134 PID 2392 wrote to memory of 4572 2392 rwwdw64d.exe 135 PID 2324 wrote to memory of 1080 2324 rwwdw64d.exe 136 PID 4572 wrote to memory of 4788 4572 rwwdw64d.exe 137 PID 1080 wrote to memory of 5032 1080 rwwdw64d.exe 138 PID 4788 wrote to memory of 4216 4788 rwwdw64d.exe 139 PID 5032 wrote to memory of 5724 5032 rwwdw64d.exe 140 PID 4216 wrote to memory of 5432 4216 rwwdw64d.exe 142 PID 5724 wrote to memory of 5808 5724 rwwdw64d.exe 143 PID 5432 wrote to memory of 5500 5432 rwwdw64d.exe 144 PID 5808 wrote to memory of 1336 5808 rwwdw64d.exe 145 PID 5500 wrote to memory of 1812 5500 rwwdw64d.exe 146 PID 1336 wrote to memory of 2696 1336 rwwdw64d.exe 147 PID 1812 wrote to memory of 4388 1812 rwwdw64d.exe 148 PID 2696 wrote to memory of 1212 2696 rwwdw64d.exe 149 PID 4388 wrote to memory of 3708 4388 rwwdw64d.exe 150 PID 1212 wrote to memory of 1308 1212 rwwdw64d.exe 151 PID 3708 wrote to memory of 1832 3708 rwwdw64d.exe 152 PID 1308 wrote to memory of 2052 1308 rwwdw64d.exe 153 PID 1832 wrote to memory of 4540 1832 rwwdw64d.exe 154 PID 2052 wrote to memory of 924 2052 rwwdw64d.exe 155 PID 4540 wrote to memory of 2192 4540 rwwdw64d.exe 156 PID 924 wrote to memory of 3124 924 rwwdw64d.exe 157 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_d6ffaacbf18b05d537f3da8c4e319c8e_elex_wannacry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Executes dropped EXE
- Modifies registry class
PID:2192 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3080 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Drops file in System32 directory
PID:712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\rwwdw64d.exeC:\Windows\SysWOW64\rwwdw64d.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6032 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5724 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5808 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵PID:3124
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3820 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3416 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3372 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4588 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵
- Drops startup file
- Modifies registry class
PID:2888 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵PID:1848
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5524 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2940 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3696 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵
- Drops startup file
- Modifies registry class
PID:1056 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- Drops startup file
PID:1388 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5388 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵
- Drops file in System32 directory
PID:1652 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- System Location Discovery: System Language Discovery
PID:468 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2580 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4516 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5036 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:4164 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Drops startup file
PID:5336 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:472 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- Drops startup file
- Drops file in System32 directory
PID:3440 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵
- Modifies registry class
PID:4952 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- Drops file in System32 directory
- Modifies registry class
PID:2876 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5532 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5828 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5544 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
- Drops startup file
PID:4200 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:5660 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
- Drops startup file
- Drops file in System32 directory
PID:3576 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- Modifies registry class
PID:3700 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵PID:4852
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4704 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Drops startup file
- Modifies registry class
PID:1288 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6024 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵
- Drops file in System32 directory
- Modifies registry class
PID:2776 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵
- Drops file in System32 directory
PID:4596 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵
- System Location Discovery: System Language Discovery
PID:5156 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Drops startup file
- Modifies registry class
PID:264 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵
- Drops startup file
- Modifies registry class
PID:4600 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Drops startup file
- Drops file in System32 directory
- Modifies registry class
PID:2672 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- Drops startup file
- Drops file in System32 directory
PID:4296 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:696 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5864 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4344 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4384 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3344 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵PID:1484
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3692 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:948 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵
- Drops file in System32 directory
PID:5536 -
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵PID:6080
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵PID:4100
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵PID:2312
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵PID:3212
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵PID:4488
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵PID:4924
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵PID:4912
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵PID:2236
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵PID:5896
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵PID:5456
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵PID:4280
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵PID:1536
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵PID:4856
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵PID:2712
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵PID:2564
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵PID:552
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵PID:4920
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵PID:6096
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵PID:3432
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵PID:3216
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵PID:4392
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵PID:4312
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵PID:5264
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵PID:2156
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵PID:4668
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵PID:5124
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵PID:2364
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵PID:4628
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵PID:4368
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵PID:1708
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵PID:4964
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵PID:5908
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵PID:5152
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵PID:1696
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵PID:1692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-