Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 06:25
General
- Target 2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe
- Size 56KB
- Sample260801-g65vdsfj21
- SHA256 f90a3fcd731bd0955d78c44e31f9b9e4d90dd890a7d1e82aee8607b6980ab197
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 5 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_08c19cd17a861c9879819a824ae45153_elex_wannacry.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0012⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0013⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0014⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0015⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0016⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0017⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0018⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA0019⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00110⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00111⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00112⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00113⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00114⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00115⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00116⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00117⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00118⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00119⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00120⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00121⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00122⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00123⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00124⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00125⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00126⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00127⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00128⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00129⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00130⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00131⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00132⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00133⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00134⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00135⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00136⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00137⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00138⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00139⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00140⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00141⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00142⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00143⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00144⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00145⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00146⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00147⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00148⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00149⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00150⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00151⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00152⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00153⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00154⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00155⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00156⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00157⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00158⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00159⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00160⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00161⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00162⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00163⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00164⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00165⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00166⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00167⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00168⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00169⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00170⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00171⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00172⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00173⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00174⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00175⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00176⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00177⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00178⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00179⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00180⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00181⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00182⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00183⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00184⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00185⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00186⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00187⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00188⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00189⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00190⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00191⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00192⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00193⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00194⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00195⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00196⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00197⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00198⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA00199⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001100⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001101⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001102⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001103⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001104⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001105⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001106⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001107⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001108⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001109⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001110⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001111⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001112⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001113⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001114⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001115⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001116⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001117⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001118⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001119⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001120⤵
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHA001121⤵
- Creates a file in the Startup directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-