Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 06:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe
- Size 56KB
- Sample260801-g65vdsfj21
- SHA256 f90a3fcd731bd0955d78c44e31f9b9e4d90dd890a7d1e82aee8607b6980ab197
- MD5 08c19cd17a861c9879819a824ae45153
- SHA1 bbf93571558bcc9e2273d8284eeb4d58b479bfa4
- SHA512 e79021924683caf0e9babc9b1d8b507aacb8a0d497d555b5385f5138fbfcc9cef59bb2281aaf57f399caba8d2eb8b01aafe321a82e328903fe08bf297f326335
- SSDEEP 768:c7g1ghRYbnB1x6ge/vXJroRyrObub2wZPgsrII9XGmmEU3oJa2M3TIywOFZ3sYPa:cDhi16rvXJ6YhG/1os/P33PM3NN/ntNV
- TLSH T1F5433957EE9D4091E6155670887D233ACAB7917D4730DBAB1B98EE3C3837080EC3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe - Executes dropped EXE 64 IoCs
pid Process 1876 dwdsrngt.exe 4636 dwdsrngt.exe 3612 dwdsrngt.exe 4472 dwdsrngt.exe 4868 dwdsrngt.exe 2492 dwdsrngt.exe 4664 dwdsrngt.exe 3076 dwdsrngt.exe 2928 dwdsrngt.exe 3668 dwdsrngt.exe 4264 dwdsrngt.exe 1604 dwdsrngt.exe 756 dwdsrngt.exe 1880 dwdsrngt.exe 4656 dwdsrngt.exe 2924 dwdsrngt.exe 1028 dwdsrngt.exe 1628 dwdsrngt.exe 1384 dwdsrngt.exe 3204 dwdsrngt.exe 4492 dwdsrngt.exe 4764 dwdsrngt.exe 2348 dwdsrngt.exe 2116 dwdsrngt.exe 3584 dwdsrngt.exe 312 dwdsrngt.exe 2360 dwdsrngt.exe 1824 dwdsrngt.exe 1264 dwdsrngt.exe 3808 dwdsrngt.exe 4696 dwdsrngt.exe 1944 dwdsrngt.exe 4032 dwdsrngt.exe 4136 dwdsrngt.exe 2488 dwdsrngt.exe 5032 dwdsrngt.exe 3944 dwdsrngt.exe 4632 dwdsrngt.exe 3924 dwdsrngt.exe 4304 dwdsrngt.exe 3304 dwdsrngt.exe 4376 dwdsrngt.exe 3160 dwdsrngt.exe 3824 dwdsrngt.exe 4300 dwdsrngt.exe 3476 dwdsrngt.exe 3980 dwdsrngt.exe 1388 dwdsrngt.exe 3608 dwdsrngt.exe 3700 dwdsrngt.exe 4192 dwdsrngt.exe 1372 dwdsrngt.exe 3768 dwdsrngt.exe 4620 dwdsrngt.exe 4280 dwdsrngt.exe 2780 dwdsrngt.exe 1712 dwdsrngt.exe 3772 dwdsrngt.exe 4024 dwdsrngt.exe 400 dwdsrngt.exe 3060 dwdsrngt.exe 1376 dwdsrngt.exe 1132 dwdsrngt.exe 3084 dwdsrngt.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{9B-B5-55-55-ZN} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe CHA001" 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{9B-B5-55-55-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{9B-B5-55-55-ZN} = "C:\\Windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{9B-B5-55-55-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{4E-EC-C7-73-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHA001" dwdsrngt.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_01_08_26.log dwdsrngt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1764 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe 1764 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe 1876 dwdsrngt.exe 1876 dwdsrngt.exe 4636 dwdsrngt.exe 4636 dwdsrngt.exe 3612 dwdsrngt.exe 3612 dwdsrngt.exe 4472 dwdsrngt.exe 4472 dwdsrngt.exe 4868 dwdsrngt.exe 4868 dwdsrngt.exe 2492 dwdsrngt.exe 2492 dwdsrngt.exe 4664 dwdsrngt.exe 4664 dwdsrngt.exe 3076 dwdsrngt.exe 3076 dwdsrngt.exe 2928 dwdsrngt.exe 2928 dwdsrngt.exe 3668 dwdsrngt.exe 3668 dwdsrngt.exe 4264 dwdsrngt.exe 4264 dwdsrngt.exe 1604 dwdsrngt.exe 1604 dwdsrngt.exe 756 dwdsrngt.exe 756 dwdsrngt.exe 1880 dwdsrngt.exe 1880 dwdsrngt.exe 4656 dwdsrngt.exe 4656 dwdsrngt.exe 2924 dwdsrngt.exe 2924 dwdsrngt.exe 1028 dwdsrngt.exe 1028 dwdsrngt.exe 1628 dwdsrngt.exe 1628 dwdsrngt.exe 1384 dwdsrngt.exe 1384 dwdsrngt.exe 3204 dwdsrngt.exe 3204 dwdsrngt.exe 4492 dwdsrngt.exe 4492 dwdsrngt.exe 4764 dwdsrngt.exe 4764 dwdsrngt.exe 2348 dwdsrngt.exe 2348 dwdsrngt.exe 2116 dwdsrngt.exe 2116 dwdsrngt.exe 3584 dwdsrngt.exe 3584 dwdsrngt.exe 312 dwdsrngt.exe 312 dwdsrngt.exe 2360 dwdsrngt.exe 2360 dwdsrngt.exe 1824 dwdsrngt.exe 1824 dwdsrngt.exe 1264 dwdsrngt.exe 1264 dwdsrngt.exe 3808 dwdsrngt.exe 3808 dwdsrngt.exe 4696 dwdsrngt.exe 4696 dwdsrngt.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1764 wrote to memory of 1876 1764 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe 86 PID 1876 wrote to memory of 4636 1876 dwdsrngt.exe 88 PID 4636 wrote to memory of 4472 4636 dwdsrngt.exe 92 PID 3612 wrote to memory of 4868 3612 dwdsrngt.exe 93 PID 4472 wrote to memory of 2492 4472 dwdsrngt.exe 94 PID 4868 wrote to memory of 4664 4868 dwdsrngt.exe 96 PID 2492 wrote to memory of 3076 2492 dwdsrngt.exe 97 PID 4664 wrote to memory of 2928 4664 dwdsrngt.exe 98 PID 3076 wrote to memory of 3668 3076 dwdsrngt.exe 99 PID 2928 wrote to memory of 4264 2928 dwdsrngt.exe 100 PID 3668 wrote to memory of 1604 3668 dwdsrngt.exe 101 PID 4264 wrote to memory of 756 4264 dwdsrngt.exe 102 PID 1604 wrote to memory of 1880 1604 dwdsrngt.exe 103 PID 756 wrote to memory of 4656 756 dwdsrngt.exe 104 PID 1880 wrote to memory of 2924 1880 dwdsrngt.exe 105 PID 4656 wrote to memory of 1028 4656 dwdsrngt.exe 106 PID 2924 wrote to memory of 1628 2924 dwdsrngt.exe 107 PID 1028 wrote to memory of 1384 1028 dwdsrngt.exe 108 PID 1628 wrote to memory of 3204 1628 dwdsrngt.exe 109 PID 1384 wrote to memory of 4492 1384 dwdsrngt.exe 110 PID 3204 wrote to memory of 4764 3204 dwdsrngt.exe 111 PID 4492 wrote to memory of 2348 4492 dwdsrngt.exe 112 PID 4764 wrote to memory of 2116 4764 dwdsrngt.exe 115 PID 2348 wrote to memory of 3584 2348 dwdsrngt.exe 116 PID 2116 wrote to memory of 312 2116 dwdsrngt.exe 119 PID 3584 wrote to memory of 2360 3584 dwdsrngt.exe 120 PID 312 wrote to memory of 1824 312 dwdsrngt.exe 121 PID 2360 wrote to memory of 1264 2360 dwdsrngt.exe 122 PID 1824 wrote to memory of 3808 1824 dwdsrngt.exe 123 PID 1264 wrote to memory of 4696 1264 dwdsrngt.exe 125 PID 3808 wrote to memory of 1944 3808 dwdsrngt.exe 126 PID 4696 wrote to memory of 4032 4696 dwdsrngt.exe 127 PID 1944 wrote to memory of 4136 1944 dwdsrngt.exe 128 PID 4032 wrote to memory of 2488 4032 dwdsrngt.exe 129 PID 4136 wrote to memory of 5032 4136 dwdsrngt.exe 131 PID 2488 wrote to memory of 3944 2488 dwdsrngt.exe 133 PID 5032 wrote to memory of 4632 5032 dwdsrngt.exe 134 PID 3944 wrote to memory of 3924 3944 dwdsrngt.exe 135 PID 4632 wrote to memory of 4304 4632 dwdsrngt.exe 136 PID 3924 wrote to memory of 3304 3924 dwdsrngt.exe 137 PID 4304 wrote to memory of 4376 4304 dwdsrngt.exe 138 PID 3304 wrote to memory of 3160 3304 dwdsrngt.exe 139 PID 4376 wrote to memory of 3824 4376 dwdsrngt.exe 140 PID 3160 wrote to memory of 4300 3160 dwdsrngt.exe 141 PID 3824 wrote to memory of 3476 3824 dwdsrngt.exe 142 PID 4300 wrote to memory of 3980 4300 dwdsrngt.exe 143 PID 3476 wrote to memory of 1388 3476 dwdsrngt.exe 144 PID 3980 wrote to memory of 3608 3980 dwdsrngt.exe 146 PID 1388 wrote to memory of 3700 1388 dwdsrngt.exe 147 PID 3608 wrote to memory of 4192 3608 dwdsrngt.exe 148 PID 3700 wrote to memory of 1372 3700 dwdsrngt.exe 149 PID 4192 wrote to memory of 3768 4192 dwdsrngt.exe 150 PID 1372 wrote to memory of 4620 1372 dwdsrngt.exe 151 PID 3768 wrote to memory of 4280 3768 dwdsrngt.exe 152 PID 4620 wrote to memory of 2780 4620 dwdsrngt.exe 153 PID 4280 wrote to memory of 1712 4280 dwdsrngt.exe 154 PID 2780 wrote to memory of 3772 2780 dwdsrngt.exe 155 PID 1712 wrote to memory of 4024 1712 dwdsrngt.exe 156 PID 3772 wrote to memory of 400 3772 dwdsrngt.exe 157 PID 4024 wrote to memory of 3060 4024 dwdsrngt.exe 158 PID 400 wrote to memory of 1376 400 dwdsrngt.exe 159 PID 3060 wrote to memory of 1132 3060 dwdsrngt.exe 160 PID 1376 wrote to memory of 3084 1376 dwdsrngt.exe 161 PID 1132 wrote to memory of 892 1132 dwdsrngt.exe 162
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0012⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0013⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0014⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0015⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0016⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0017⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0018⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0019⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00110⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00111⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00112⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00113⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00114⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00115⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00116⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00118⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00119⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00120⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00121⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00122⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00123⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00124⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00125⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00126⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00127⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00128⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00129⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00130⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00131⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00132⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00133⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00134⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3084 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00135⤵PID:2264
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00136⤵
- Modifies registry class
PID:1868 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00137⤵PID:2392
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00138⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1292 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00139⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5000 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00140⤵
- Drops file in System32 directory
PID:4140 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00141⤵PID:1232
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00142⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:2424 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00143⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:4124 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00144⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4852 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00145⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:3492 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00146⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:4148 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00147⤵
- Drops file in System32 directory
PID:4568 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00148⤵
- Drops file in System32 directory
- Modifies registry class
PID:4912 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00149⤵PID:3708
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00150⤵
- Drops file in System32 directory
PID:2532 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00151⤵
- Drops file in System32 directory
PID:652 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00152⤵PID:316
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00153⤵
- Drops file in System32 directory
PID:1216 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00154⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1100 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00155⤵
- Creates a file in the Startup directory
PID:4432 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00156⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1992 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00157⤵PID:3656
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00158⤵PID:592
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00159⤵
- Drops file in System32 directory
PID:2968 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00160⤵
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00161⤵
- Drops file in System32 directory
- Modifies registry class
PID:540 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00162⤵PID:3504
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00163⤵PID:3296
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00164⤵PID:3348
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00165⤵
- Modifies registry class
PID:1768 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00166⤵PID:3648
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00167⤵
- Drops file in System32 directory
PID:1276 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00168⤵PID:4904
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00169⤵PID:2776
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00170⤵
- Modifies registry class
PID:2600 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00171⤵
- System Location Discovery: System Language Discovery
PID:1536 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00172⤵
- Drops file in System32 directory
PID:1900 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00173⤵
- Modifies registry class
PID:1200 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00174⤵
- Creates a file in the Startup directory
PID:3512 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00175⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:4036 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00176⤵
- Drops file in System32 directory
PID:2428 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00177⤵PID:3536
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00178⤵
- Modifies registry class
PID:404 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00179⤵
- Drops file in System32 directory
PID:4744 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00180⤵
- System Location Discovery: System Language Discovery
PID:3956 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00181⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00182⤵
- System Location Discovery: System Language Discovery
PID:3392 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00183⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1988 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00184⤵
- Modifies registry class
PID:1656 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00185⤵PID:1996
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00186⤵PID:2788
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00187⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
PID:3816 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00188⤵PID:3776
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00189⤵
- Drops file in System32 directory
- Modifies registry class
PID:4392 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00190⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00191⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1244 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00192⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3660 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00193⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3760 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00194⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3424 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00195⤵PID:3516
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00196⤵
- Modifies registry class
PID:2940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00197⤵
- Drops file in System32 directory
PID:2528 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00198⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00199⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1432 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001100⤵PID:2404
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001101⤵PID:5004
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001102⤵PID:4860
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001103⤵PID:2060
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001104⤵
- Drops file in System32 directory
PID:4112 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001105⤵
- Modifies registry class
PID:4540 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001106⤵
- Modifies registry class
PID:4332 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001107⤵PID:4512
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001108⤵PID:4640
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001109⤵
- Modifies registry class
PID:3884 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001110⤵
- System Location Discovery: System Language Discovery
PID:4708 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001111⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001112⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4672 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001113⤵PID:2496
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001114⤵
- Creates a file in the Startup directory
PID:2628 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001115⤵
- System Location Discovery: System Language Discovery
PID:3196 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001116⤵
- Creates a file in the Startup directory
PID:4648 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001117⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:3024 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001118⤵
- Creates a file in the Startup directory
PID:3332 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001119⤵
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001120⤵PID:3964
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001121⤵
- Drops file in System32 directory
PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-