Overview

overview

7

Static

static

3

2026-07-27...ry.exe

windows10-2004-x64

7

2026-07-27...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 00:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_f80405319efdf78938f60e93e23ff1a0_elex_wannacry.exe
  • Size 56KB
  • Sample260727-a1cs4afl21
  • SHA256 4b8c26120e8af5d208251d2d6370f9741d2b09e82c6279fd1c07f91eb5aed5e8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Drops startup file 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_f80405319efdf78938f60e93e23ff1a0_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_f80405319efdf78938f60e93e23ff1a0_elex_wannacry.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2288
    • \??\c:\windows\SysWOW64\dwdsrngt.exe
      c:\windows\system32\dwdsrngt.exe CHA001
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1052
      • \??\c:\windows\SysWOW64\dwdsrngt.exe
        c:\windows\system32\dwdsrngt.exe CHA001
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1844
        • \??\c:\windows\SysWOW64\dwdsrngt.exe
          c:\windows\system32\dwdsrngt.exe CHA001
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2556
          • \??\c:\windows\SysWOW64\dwdsrngt.exe
            c:\windows\system32\dwdsrngt.exe CHA001
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2920
            • \??\c:\windows\SysWOW64\dwdsrngt.exe
              c:\windows\system32\dwdsrngt.exe CHA001
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4176
              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                c:\windows\system32\dwdsrngt.exe CHA001
                7⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:900
                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                  c:\windows\system32\dwdsrngt.exe CHA001
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4632
                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                    c:\windows\system32\dwdsrngt.exe CHA001
                    9⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3920
                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                      c:\windows\system32\dwdsrngt.exe CHA001
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1208
                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                        c:\windows\system32\dwdsrngt.exe CHA001
                        11⤵
                        • Drops startup file
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1280
                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                          c:\windows\system32\dwdsrngt.exe CHA001
                          12⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4680
                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                            c:\windows\system32\dwdsrngt.exe CHA001
                            13⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:5036
                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                              c:\windows\system32\dwdsrngt.exe CHA001
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3792
                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                c:\windows\system32\dwdsrngt.exe CHA001
                                15⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:3560
                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                  c:\windows\system32\dwdsrngt.exe CHA001
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:4716
                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                    c:\windows\system32\dwdsrngt.exe CHA001
                                    17⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:4108
                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                      c:\windows\system32\dwdsrngt.exe CHA001
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:1260
                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                        c:\windows\system32\dwdsrngt.exe CHA001
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:1012
                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                          c:\windows\system32\dwdsrngt.exe CHA001
                                          20⤵
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Suspicious use of WriteProcessMemory
                                          PID:4320
                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                            c:\windows\system32\dwdsrngt.exe CHA001
                                            21⤵
                                            • Drops startup file
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3552
                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                              c:\windows\system32\dwdsrngt.exe CHA001
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:2396
                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:572
                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2928
                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:468
                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                      26⤵
                                                      • Drops startup file
                                                      • Executes dropped EXE
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2620
                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3844
                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3824
                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4464
                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4404
                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                31⤵
                                                                • Drops startup file
                                                                • Executes dropped EXE
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1904
                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4840
                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:112
                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:2984
                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                        35⤵
                                                                        • Drops startup file
                                                                        PID:3572
                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                          36⤵
                                                                          • Drops startup file
                                                                          • Modifies registry class
                                                                          PID:1272
                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                            37⤵
                                                                              PID:3536
                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                38⤵
                                                                                • Modifies registry class
                                                                                PID:3840
                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                  39⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  PID:1748
                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                    40⤵
                                                                                    • Drops file in System32 directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1460
                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                      41⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      PID:3960
                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                        42⤵
                                                                                          PID:2472
                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                            43⤵
                                                                                            • Drops file in System32 directory
                                                                                            PID:812
                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                              44⤵
                                                                                              • Drops startup file
                                                                                              • Modifies registry class
                                                                                              PID:2764
                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                45⤵
                                                                                                  PID:1768
                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                    46⤵
                                                                                                    • Drops startup file
                                                                                                    PID:3444
                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                      47⤵
                                                                                                        PID:2032
                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                          48⤵
                                                                                                          • Drops file in System32 directory
                                                                                                          PID:1584
                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                            49⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:4888
                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                              50⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4456
                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                51⤵
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4896
                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                  52⤵
                                                                                                                  • Drops startup file
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4552
                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                    53⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:2564
                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                      54⤵
                                                                                                                        PID:820
                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                          55⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1736
                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                            56⤵
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:2332
                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                              57⤵
                                                                                                                                PID:1968
                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                  58⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4732
                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                    59⤵
                                                                                                                                    • Drops startup file
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:1396
                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                      60⤵
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:1072
                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                        61⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:1116
                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                          62⤵
                                                                                                                                            PID:4312
                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                              63⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4248
                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                64⤵
                                                                                                                                                • Drops startup file
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                PID:1780
                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                  65⤵
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:1412
                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                    66⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:2520
                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                      67⤵
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      PID:1724
                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                        68⤵
                                                                                                                                                          PID:2444
                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                            69⤵
                                                                                                                                                              PID:760
                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                70⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4604
                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                  71⤵
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  PID:848
                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                    72⤵
                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                    PID:4664
                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                      73⤵
                                                                                                                                                                        PID:3512
                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                          74⤵
                                                                                                                                                                          • Drops startup file
                                                                                                                                                                          PID:3644
                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                            75⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            PID:1500
                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                              76⤵
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              PID:2180
                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                77⤵
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:5048
                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                  78⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  PID:3804
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                    79⤵
                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:784
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                      80⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4424
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                        81⤵
                                                                                                                                                                                          PID:1068
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                            82⤵
                                                                                                                                                                                              PID:5004
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                83⤵
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3928
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                  PID:1496
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                      PID:4024
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                        86⤵
                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                            PID:204
                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:228
                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:176
                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      PID:3340
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2660
                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                            PID:1896
                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              PID:1884
                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                95⤵
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                  96⤵
                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                  PID:4256
                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                            PID:4116
                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                              • Drops startup file
                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                              PID:4480
                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                PID:3440
                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:3588
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                      PID:3484
                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3872
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                          PID:3124
                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                                                                                            PID:1788
                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                                              • Drops startup file
                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                                    PID:368
                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                                        PID:2968
                                            • C:\Windows\SysWOW64\dwdsrngt.exe
                                              C:\Windows\SysWOW64\dwdsrngt.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Drops file in System32 directory
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:3544
                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:4804
                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                  3⤵
                                                  • Drops startup file
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3740
                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1728
                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4332
                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3692
                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                          7⤵
                                                          • Drops startup file
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1876
                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                            8⤵
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3984
                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                              9⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3408
                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                10⤵
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3516
                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                  11⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4672
                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                    12⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3532
                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                      13⤵
                                                                      • Drops startup file
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4316
                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                        14⤵
                                                                        • Drops startup file
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1948
                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                          15⤵
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2400
                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                            16⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2060
                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                              17⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3296
                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                18⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5044
                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                  19⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2448
                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                    20⤵
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3876
                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                      21⤵
                                                                                      • Drops startup file
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in System32 directory
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3980
                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                        22⤵
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2728
                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                          23⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1380
                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                            24⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4128
                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                              25⤵
                                                                                              • Drops startup file
                                                                                              • Executes dropped EXE
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2316
                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                26⤵
                                                                                                • Drops startup file
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5064
                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                  27⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4200
                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                    28⤵
                                                                                                    • Drops startup file
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4044
                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                      29⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:716
                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                        30⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4560
                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                          31⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1440
                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                            32⤵
                                                                                                              PID:116
                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                33⤵
                                                                                                                • Drops startup file
                                                                                                                PID:3652
                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                  34⤵
                                                                                                                    PID:3564
                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                      35⤵
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3472
                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                        36⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1464
                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                          37⤵
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:3164
                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                            38⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Modifies registry class
                                                                                                                            PID:3312
                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                              39⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              PID:1236
                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                40⤵
                                                                                                                                  PID:1224
                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                    41⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:4356
                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                      42⤵
                                                                                                                                        PID:2380
                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                          43⤵
                                                                                                                                          • Drops startup file
                                                                                                                                          • Drops file in System32 directory
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:4484
                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                            44⤵
                                                                                                                                              PID:5056
                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                45⤵
                                                                                                                                                  PID:3828
                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                    46⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:2360
                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                      47⤵
                                                                                                                                                      • Drops startup file
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      PID:1588
                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                        48⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:4952
                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                          49⤵
                                                                                                                                                          • Drops startup file
                                                                                                                                                          PID:4028
                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                            50⤵
                                                                                                                                                              PID:1776
                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                51⤵
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                PID:3216
                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                  52⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:180
                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                    53⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4328
                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                      54⤵
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:2864
                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                        55⤵
                                                                                                                                                                          PID:4908
                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                            56⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4588
                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                              57⤵
                                                                                                                                                                                PID:4508
                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                  58⤵
                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                  PID:1668
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                    59⤵
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    PID:3784
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                      60⤵
                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1816
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                        61⤵
                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                        PID:4468
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                          62⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:4780
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                            63⤵
                                                                                                                                                                                              PID:2240
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                64⤵
                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                PID:1176
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                  PID:2508
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:748
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                      67⤵
                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                      PID:1900
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                        68⤵
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                            70⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                              71⤵
                                                                                                                                                                                                                PID:1376
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                  72⤵
                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  PID:2124
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                    73⤵
                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5040
                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                        PID:2964
                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                          75⤵
                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                          PID:656
                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                            76⤵
                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                              77⤵
                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                  78⤵
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                  PID:2872
                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                      80⤵
                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:1856
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                        81⤵
                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                        PID:3104
                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                          82⤵
                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                          PID:4960
                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                              PID:3640
                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                84⤵
                                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                                PID:4008
                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                    86⤵
                                                                                                                                                                                                                                                      PID:5080
                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:3812
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                            89⤵
                                                                                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                              90⤵
                                                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                                                                    PID:3964
                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        PID:4208
                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                                          PID:4212
                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                                                                              PID:3628
                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:3936
                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                                                      PID:2932
                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:988
                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:364
                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                            PID:372
                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                              • Drops startup file
                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2156
                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                                                                                    PID:3420
                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:3200
                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                        PID:4112
                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:1432
                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                                                                                              • Drops startup file
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                              PID:2944
                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                                                                                  PID:4388
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                        PID:2976
                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                            PID:2392
                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                              PID:3900
                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                                                                                    PID:3808
                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                                        PID:1032
                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                                                                                • Drops startup file
                                                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                  c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                  122⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops startup file
                                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                  PID:4976
                                                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                    c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4728
                                                                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                      c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops startup file
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                        PID:1636
                                                                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                          c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                          PID:3520
                                                                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                            c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                            PID:3508
                                                                                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                              c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4380
                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\dwdsrngt.exe
                                                                                                                                                                                                                                                                                                                                                                c:\windows\system32\dwdsrngt.exe CHA001
                                                                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2388

                                                                                                Network

                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      TA_Start.lnk
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk
                                                                                                      • Size 985B
                                                                                                      • SHA256 5f75d2f34ca899d75f613cb653da0fe298131e12d6e962f85be664d6ff3dcd72
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      TA_Start.lnk
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk
                                                                                                      • Size 985B
                                                                                                      • SHA256 f63fb40e37ff4f56c06f65d369f3b073fc1b88dca7e00d29d389ad5f546f2bb4
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      TA_Start.lnk
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk
                                                                                                      • Size 985B
                                                                                                      • SHA256 03b54b684dda3725f3cc0d4df65b753571bdcd0c09b07ee618078ae4c1bdf7b8
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      TA_Start.lnk
                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk
                                                                                                      • Size 985B
                                                                                                      • SHA256 6caf2625cc4e347292e476d4911d240252d78bfaf69bbbd7c0711e1e7412ea62
                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                      Submit Download

                                                                                                      dwdsrngt.exe
                                                                                                      • Path C:\Windows\SysWOW64\dwdsrngt.exe
                                                                                                      • Size 56KB
                                                                                                      • SHA256 59d26557ceab081e59ddbe40bbdeb5e527ce7c948433f9ddb79c0df70b336059
                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                      Submit Download

                                                                                                      msnav32.ax
                                                                                                      • Path C:\Windows\SysWOW64\msnav32.ax
                                                                                                      • Size 17B
                                                                                                      • SHA256 3ba47095ed2c7339dd5801f3dfa7143a7bc2f547c2f156f431732e5e5a3f8d10
                                                                                                      • MD5 SHA1 SHA512
                                                                                                      Submit Download