Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 00:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe
- Size 56KB
- Sample260720-a1f6hscy7w
- SHA256 3ecb1e80b6ebd2d1213574dba55780692d19e938c2e666c4557c019538b74ecd
- MD5 be44a3474ea1a069f4afaaad88f2b702
- SHA1 d99862a6a047b26be692d3c1b4fa67572a4eb523
- SHA512 7d2aaf50cd95fb60a4973e8739d540ec7b04b28aa141ed704bf6c351387334e49408303e7b999891451258d61581db9c1a8408ad11135db1a1ca4c96746d16ab
- SSDEEP 1536:cDhi16rvXJ6YhG/1os/P33PM3NN/ntNpr:cFIMlhy//fM3NN/ntNN
- TLSH T1E7433957FE9D4091E6155670887D233ACAB7917D4730DBAB1B98EE3C2837080EC3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe - Executes dropped EXE 64 IoCs
pid Process 4588 dwdsrngt.exe 1096 dwdsrngt.exe 4824 dwdsrngt.exe 5572 dwdsrngt.exe 5396 dwdsrngt.exe 3396 dwdsrngt.exe 5128 dwdsrngt.exe 352 dwdsrngt.exe 252 dwdsrngt.exe 4284 dwdsrngt.exe 1772 dwdsrngt.exe 5676 dwdsrngt.exe 2368 dwdsrngt.exe 4160 dwdsrngt.exe 4500 dwdsrngt.exe 2740 dwdsrngt.exe 5664 dwdsrngt.exe 4892 dwdsrngt.exe 5100 dwdsrngt.exe 1976 dwdsrngt.exe 2224 dwdsrngt.exe 2076 dwdsrngt.exe 3948 dwdsrngt.exe 4480 dwdsrngt.exe 5484 dwdsrngt.exe 672 dwdsrngt.exe 3936 dwdsrngt.exe 4604 dwdsrngt.exe 2848 dwdsrngt.exe 5044 dwdsrngt.exe 4800 dwdsrngt.exe 800 dwdsrngt.exe 5368 dwdsrngt.exe 1788 dwdsrngt.exe 1732 dwdsrngt.exe 5972 dwdsrngt.exe 2928 dwdsrngt.exe 4300 dwdsrngt.exe 4204 dwdsrngt.exe 2924 dwdsrngt.exe 4564 dwdsrngt.exe 4072 dwdsrngt.exe 1832 dwdsrngt.exe 5700 dwdsrngt.exe 5556 dwdsrngt.exe 3508 dwdsrngt.exe 4940 dwdsrngt.exe 2108 dwdsrngt.exe 1144 dwdsrngt.exe 4568 dwdsrngt.exe 3556 dwdsrngt.exe 1480 dwdsrngt.exe 1716 dwdsrngt.exe 4896 dwdsrngt.exe 3296 dwdsrngt.exe 1332 dwdsrngt.exe 5004 dwdsrngt.exe 4788 dwdsrngt.exe 2228 dwdsrngt.exe 936 dwdsrngt.exe 4540 dwdsrngt.exe 4176 dwdsrngt.exe 6116 dwdsrngt.exe 4392 dwdsrngt.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{64-4E-E7-79-ZN} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe CHA001" 2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{64-4E-E7-79-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{64-4E-E7-79-ZN} = "C:\\Windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{64-4E-E7-79-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_20_07_26.log dwdsrngt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1628 2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe 1628 2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe 4588 dwdsrngt.exe 4588 dwdsrngt.exe 1096 dwdsrngt.exe 1096 dwdsrngt.exe 4824 dwdsrngt.exe 4824 dwdsrngt.exe 5572 dwdsrngt.exe 5572 dwdsrngt.exe 5396 dwdsrngt.exe 5396 dwdsrngt.exe 3396 dwdsrngt.exe 3396 dwdsrngt.exe 5128 dwdsrngt.exe 5128 dwdsrngt.exe 352 dwdsrngt.exe 352 dwdsrngt.exe 252 dwdsrngt.exe 252 dwdsrngt.exe 4284 dwdsrngt.exe 4284 dwdsrngt.exe 1772 dwdsrngt.exe 1772 dwdsrngt.exe 5676 dwdsrngt.exe 5676 dwdsrngt.exe 2368 dwdsrngt.exe 2368 dwdsrngt.exe 4160 dwdsrngt.exe 4160 dwdsrngt.exe 4500 dwdsrngt.exe 4500 dwdsrngt.exe 2740 dwdsrngt.exe 2740 dwdsrngt.exe 5664 dwdsrngt.exe 5664 dwdsrngt.exe 4892 dwdsrngt.exe 4892 dwdsrngt.exe 5100 dwdsrngt.exe 5100 dwdsrngt.exe 1976 dwdsrngt.exe 1976 dwdsrngt.exe 2224 dwdsrngt.exe 2224 dwdsrngt.exe 2076 dwdsrngt.exe 2076 dwdsrngt.exe 3948 dwdsrngt.exe 3948 dwdsrngt.exe 4480 dwdsrngt.exe 4480 dwdsrngt.exe 5484 dwdsrngt.exe 5484 dwdsrngt.exe 672 dwdsrngt.exe 672 dwdsrngt.exe 3936 dwdsrngt.exe 3936 dwdsrngt.exe 4604 dwdsrngt.exe 4604 dwdsrngt.exe 2848 dwdsrngt.exe 2848 dwdsrngt.exe 5044 dwdsrngt.exe 5044 dwdsrngt.exe 4800 dwdsrngt.exe 4800 dwdsrngt.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4588 1628 2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe 89 PID 4588 wrote to memory of 1096 4588 dwdsrngt.exe 91 PID 1096 wrote to memory of 5572 1096 dwdsrngt.exe 95 PID 4824 wrote to memory of 5396 4824 dwdsrngt.exe 96 PID 5572 wrote to memory of 3396 5572 dwdsrngt.exe 97 PID 5396 wrote to memory of 5128 5396 dwdsrngt.exe 99 PID 3396 wrote to memory of 352 3396 dwdsrngt.exe 100 PID 5128 wrote to memory of 252 5128 dwdsrngt.exe 101 PID 352 wrote to memory of 4284 352 dwdsrngt.exe 102 PID 252 wrote to memory of 1772 252 dwdsrngt.exe 103 PID 4284 wrote to memory of 5676 4284 dwdsrngt.exe 104 PID 1772 wrote to memory of 2368 1772 dwdsrngt.exe 105 PID 5676 wrote to memory of 4160 5676 dwdsrngt.exe 106 PID 2368 wrote to memory of 4500 2368 dwdsrngt.exe 107 PID 4160 wrote to memory of 2740 4160 dwdsrngt.exe 108 PID 4500 wrote to memory of 5664 4500 dwdsrngt.exe 109 PID 2740 wrote to memory of 4892 2740 dwdsrngt.exe 110 PID 5664 wrote to memory of 5100 5664 dwdsrngt.exe 111 PID 4892 wrote to memory of 1976 4892 dwdsrngt.exe 112 PID 5100 wrote to memory of 2224 5100 dwdsrngt.exe 113 PID 1976 wrote to memory of 2076 1976 dwdsrngt.exe 114 PID 2224 wrote to memory of 3948 2224 dwdsrngt.exe 115 PID 2076 wrote to memory of 4480 2076 dwdsrngt.exe 116 PID 3948 wrote to memory of 5484 3948 dwdsrngt.exe 117 PID 4480 wrote to memory of 672 4480 dwdsrngt.exe 118 PID 5484 wrote to memory of 3936 5484 dwdsrngt.exe 119 PID 672 wrote to memory of 4604 672 dwdsrngt.exe 120 PID 3936 wrote to memory of 2848 3936 dwdsrngt.exe 121 PID 4604 wrote to memory of 5044 4604 dwdsrngt.exe 122 PID 2848 wrote to memory of 4800 2848 dwdsrngt.exe 123 PID 5044 wrote to memory of 800 5044 dwdsrngt.exe 124 PID 4800 wrote to memory of 5368 4800 dwdsrngt.exe 125 PID 800 wrote to memory of 1788 800 dwdsrngt.exe 126 PID 5368 wrote to memory of 1732 5368 dwdsrngt.exe 127 PID 1788 wrote to memory of 5972 1788 dwdsrngt.exe 128 PID 1732 wrote to memory of 2928 1732 dwdsrngt.exe 129 PID 5972 wrote to memory of 4300 5972 dwdsrngt.exe 130 PID 2928 wrote to memory of 4204 2928 dwdsrngt.exe 131 PID 4300 wrote to memory of 2924 4300 dwdsrngt.exe 132 PID 4204 wrote to memory of 4564 4204 dwdsrngt.exe 133 PID 2924 wrote to memory of 4072 2924 dwdsrngt.exe 134 PID 4564 wrote to memory of 1832 4564 dwdsrngt.exe 135 PID 4072 wrote to memory of 5700 4072 dwdsrngt.exe 136 PID 1832 wrote to memory of 5556 1832 dwdsrngt.exe 137 PID 5700 wrote to memory of 3508 5700 dwdsrngt.exe 138 PID 5556 wrote to memory of 4940 5556 dwdsrngt.exe 139 PID 3508 wrote to memory of 2108 3508 dwdsrngt.exe 140 PID 4940 wrote to memory of 1144 4940 dwdsrngt.exe 141 PID 2108 wrote to memory of 4568 2108 dwdsrngt.exe 142 PID 1144 wrote to memory of 3556 1144 dwdsrngt.exe 143 PID 4568 wrote to memory of 1480 4568 dwdsrngt.exe 144 PID 3556 wrote to memory of 1716 3556 dwdsrngt.exe 145 PID 1480 wrote to memory of 4896 1480 dwdsrngt.exe 146 PID 1716 wrote to memory of 3296 1716 dwdsrngt.exe 147 PID 4896 wrote to memory of 1332 4896 dwdsrngt.exe 148 PID 3296 wrote to memory of 5004 3296 dwdsrngt.exe 149 PID 1332 wrote to memory of 4788 1332 dwdsrngt.exe 150 PID 5004 wrote to memory of 2228 5004 dwdsrngt.exe 151 PID 4788 wrote to memory of 936 4788 dwdsrngt.exe 152 PID 2228 wrote to memory of 4540 2228 dwdsrngt.exe 153 PID 936 wrote to memory of 4176 936 dwdsrngt.exe 154 PID 4540 wrote to memory of 6116 4540 dwdsrngt.exe 155 PID 4176 wrote to memory of 4392 4176 dwdsrngt.exe 156 PID 6116 wrote to memory of 1160 6116 dwdsrngt.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_be44a3474ea1a069f4afaaad88f2b702_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0012⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0013⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0014⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0015⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0016⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0017⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0018⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0019⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00110⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00111⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00112⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00114⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00115⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00116⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00118⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00119⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00120⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5972 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00121⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00122⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00123⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00124⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5700 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00125⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00126⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00127⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00128⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00129⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00130⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00131⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00132⤵
- Drops startup file
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00133⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00134⤵
- Executes dropped EXE
- Modifies registry class
PID:4392 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00135⤵PID:4260
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00136⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4908 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00137⤵
- Drops file in System32 directory
PID:5436 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00138⤵
- Modifies registry class
PID:2792 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00139⤵
- Drops file in System32 directory
- Modifies registry class
PID:4876 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00140⤵PID:5188
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00141⤵
- Modifies registry class
PID:5104 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00142⤵
- Drops file in System32 directory
- Modifies registry class
PID:4360 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00143⤵
- Drops startup file
- Drops file in System32 directory
PID:1340 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00144⤵
- Drops file in System32 directory
- Modifies registry class
PID:5956 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00145⤵
- Drops file in System32 directory
PID:5704 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00146⤵
- Drops startup file
- Modifies registry class
PID:5016 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00147⤵
- Drops file in System32 directory
- Modifies registry class
PID:2132 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00148⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5656 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00149⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1040 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00150⤵
- Modifies registry class
PID:2344 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00151⤵
- Drops file in System32 directory
PID:3156 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00152⤵PID:6036
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00153⤵
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00154⤵
- System Location Discovery: System Language Discovery
PID:4776 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00155⤵
- Modifies registry class
PID:5624 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00156⤵
- Modifies registry class
PID:5708 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00157⤵
- Modifies registry class
PID:1320 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00158⤵
- Drops startup file
PID:1192 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00159⤵
- Drops startup file
- Drops file in System32 directory
PID:3060 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00160⤵
- Drops startup file
- Modifies registry class
PID:1928 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00161⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4288 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00162⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3660 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00163⤵
- Drops file in System32 directory
- Modifies registry class
PID:4672 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00164⤵PID:4212
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00165⤵PID:3284
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00166⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00167⤵
- Drops startup file
- Modifies registry class
PID:4676 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00168⤵
- System Location Discovery: System Language Discovery
PID:4844 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00169⤵PID:4592
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00170⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1252 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00171⤵
- Modifies registry class
PID:2964 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00172⤵
- Drops file in System32 directory
PID:244 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00173⤵
- Modifies registry class
PID:916 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00174⤵
- System Location Discovery: System Language Discovery
PID:4804 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00175⤵
- Modifies registry class
PID:2044 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00176⤵PID:3380
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00177⤵
- Drops file in System32 directory
PID:3224 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00178⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3092 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00179⤵
- Drops startup file
PID:4044 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00180⤵PID:1336
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00181⤵
- Drops file in System32 directory
- Modifies registry class
PID:4332 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00182⤵PID:1916
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00183⤵PID:1132
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00184⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1532 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00185⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2428 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00186⤵
- Drops startup file
PID:5320 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00187⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1724 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00188⤵PID:776
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00189⤵PID:944
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00190⤵
- Modifies registry class
PID:3148 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00191⤵
- Drops file in System32 directory
PID:2452 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00192⤵PID:4628
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00193⤵
- Modifies registry class
PID:4972 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00194⤵PID:3108
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00195⤵
- Drops file in System32 directory
PID:5900 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00196⤵PID:2032
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00197⤵PID:6140
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00198⤵
- Drops startup file
PID:5048 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00199⤵
- Drops startup file
PID:2600 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001100⤵
- System Location Discovery: System Language Discovery
PID:3124 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001101⤵
- Drops startup file
- Drops file in System32 directory
PID:5376 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001102⤵
- Drops file in System32 directory
PID:3160 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001103⤵
- Modifies registry class
PID:3424 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001104⤵
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001105⤵
- Drops startup file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1244 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001106⤵
- Drops startup file
- Modifies registry class
PID:2196 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001107⤵PID:4968
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001108⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3576 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001109⤵
- System Location Discovery: System Language Discovery
PID:4612 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001110⤵
- Drops file in System32 directory
- Modifies registry class
PID:3496 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001111⤵PID:4052
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001112⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001113⤵
- Drops file in System32 directory
PID:2636 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001114⤵PID:1856
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001115⤵
- System Location Discovery: System Language Discovery
PID:4244 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001116⤵
- Drops startup file
PID:5844 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001117⤵
- Drops startup file
- Modifies registry class
PID:4404 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001118⤵PID:2744
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001119⤵PID:3188
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001120⤵PID:3656
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-