Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 15:58
General
- Target 2026-07-29_4110261d183f99d682e47f37e3b2baa9_elex_wannacry.exe
- Size 56KB
- Sample260729-telcwsbj7v
- SHA256 48acb6d7a5cf81ace0c94d17ebf287e5891774ae43b79380fe893ee81c087b0c
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_4110261d183f99d682e47f37e3b2baa9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4110261d183f99d682e47f37e3b2baa9_elex_wannacry.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0012⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0013⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0014⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\dwdsrngt.exeC:\Windows\SysWOW64\dwdsrngt.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0012⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0013⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0014⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0015⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0016⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0017⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0018⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0019⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00110⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00111⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00112⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00113⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00114⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00115⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00116⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00117⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00118⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00120⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00121⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00122⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00123⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00124⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00125⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00126⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00127⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00128⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00129⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00130⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00131⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00132⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00133⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00134⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00135⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00136⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00137⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00138⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00139⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00140⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00141⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00142⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00143⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00144⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00145⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00146⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00147⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00148⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00149⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00150⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00151⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00152⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00153⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00154⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00155⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00156⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00157⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00158⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00159⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00160⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00161⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00162⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00163⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00164⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00165⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00166⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00167⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00168⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00169⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00170⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00171⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00172⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00173⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00174⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00175⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00176⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00177⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00178⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00179⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00180⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00181⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00182⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00183⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00184⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00185⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00186⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00187⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00188⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00189⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00190⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00191⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00192⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00193⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00194⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00195⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00196⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00197⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00198⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00199⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001100⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001101⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001102⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001103⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001104⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001105⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001106⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001107⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001108⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001109⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001110⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001111⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001112⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001113⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001114⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001115⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001116⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001117⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001118⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001119⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001120⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001121⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-