Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe
- Size 47KB
- Sample260805-ky2pjsgf39
- SHA256 dc667933cd590cfcb45357c8fcfff494edb95f9c94f5c06e848fc56eb49d1eed
- MD5 e95b9940af6fdc805eeb2fdeddef5eb7
- SHA1 c10f59c79845b8b3829e967c6d639aa479684d10
- SHA512 a07438110dafd4ee190ad59c608b381940b65fe6578a846ccbc2180ee5528b45e23ab147d55cd21f44cd0fe9f95b4fedaac0ee2c6c1f0be6c211fd939124412a
- SSDEEP 768:aTdZuu1Ao2J29ng+nqVshjKrVFRoPKDk53Rx7tfk1FuLQ:CSgAo2Q9g4oshjqLbMxeu0
- TLSH T1EA23F753AE4B8095E201A6B0456D237DCB73697A0760D77B1784DD3C6837182FC3BAAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe - Executes dropped EXE 64 IoCs
pid Process 4492 rwwnw64d.exe 2324 rwwnw64d.exe 2300 rwwnw64d.exe 2460 rwwnw64d.exe 4812 rwwnw64d.exe 1096 rwwnw64d.exe 2876 rwwnw64d.exe 2096 rwwnw64d.exe 4192 rwwnw64d.exe 5420 rwwnw64d.exe 5076 rwwnw64d.exe 3520 rwwnw64d.exe 2608 rwwnw64d.exe 572 rwwnw64d.exe 4240 rwwnw64d.exe 5484 rwwnw64d.exe 2828 rwwnw64d.exe 944 rwwnw64d.exe 5628 rwwnw64d.exe 3968 rwwnw64d.exe 2880 rwwnw64d.exe 1764 rwwnw64d.exe 2020 rwwnw64d.exe 2412 rwwnw64d.exe 5668 rwwnw64d.exe 4188 rwwnw64d.exe 1384 rwwnw64d.exe 5156 rwwnw64d.exe 1176 rwwnw64d.exe 4860 rwwnw64d.exe 3972 rwwnw64d.exe 3200 rwwnw64d.exe 2176 rwwnw64d.exe 6104 rwwnw64d.exe 2692 rwwnw64d.exe 3356 rwwnw64d.exe 1160 rwwnw64d.exe 3460 rwwnw64d.exe 4792 rwwnw64d.exe 2784 rwwnw64d.exe 2848 rwwnw64d.exe 5820 rwwnw64d.exe 2508 rwwnw64d.exe 4124 rwwnw64d.exe 3244 rwwnw64d.exe 4856 rwwnw64d.exe 6116 rwwnw64d.exe 2392 rwwnw64d.exe 4228 rwwnw64d.exe 3100 rwwnw64d.exe 3900 rwwnw64d.exe 5948 rwwnw64d.exe 2088 rwwnw64d.exe 3592 rwwnw64d.exe 708 rwwnw64d.exe 4516 rwwnw64d.exe 5360 rwwnw64d.exe 5392 rwwnw64d.exe 3264 rwwnw64d.exe 5508 rwwnw64d.exe 1544 rwwnw64d.exe 4732 rwwnw64d.exe 268 rwwnw64d.exe 3380 rwwnw64d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{23-38-85-55-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{23-38-85-55-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe DWrvgXX" 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{23-38-85-55-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{23-38-85-55-DW} = "C:\\Windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File created \??\c:\windows\SysWOW64\rwwnw64d.exe 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_05_08_26.log rwwnw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4512 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe 4512 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe 4492 rwwnw64d.exe 4492 rwwnw64d.exe 2324 rwwnw64d.exe 2324 rwwnw64d.exe 2300 rwwnw64d.exe 2300 rwwnw64d.exe 2460 rwwnw64d.exe 2460 rwwnw64d.exe 4812 rwwnw64d.exe 4812 rwwnw64d.exe 1096 rwwnw64d.exe 1096 rwwnw64d.exe 2876 rwwnw64d.exe 2876 rwwnw64d.exe 2096 rwwnw64d.exe 2096 rwwnw64d.exe 4192 rwwnw64d.exe 4192 rwwnw64d.exe 5420 rwwnw64d.exe 5420 rwwnw64d.exe 5076 rwwnw64d.exe 5076 rwwnw64d.exe 3520 rwwnw64d.exe 3520 rwwnw64d.exe 2608 rwwnw64d.exe 2608 rwwnw64d.exe 572 rwwnw64d.exe 572 rwwnw64d.exe 4240 rwwnw64d.exe 4240 rwwnw64d.exe 5484 rwwnw64d.exe 5484 rwwnw64d.exe 2828 rwwnw64d.exe 2828 rwwnw64d.exe 944 rwwnw64d.exe 944 rwwnw64d.exe 5628 rwwnw64d.exe 5628 rwwnw64d.exe 3968 rwwnw64d.exe 3968 rwwnw64d.exe 2880 rwwnw64d.exe 2880 rwwnw64d.exe 1764 rwwnw64d.exe 1764 rwwnw64d.exe 2020 rwwnw64d.exe 2020 rwwnw64d.exe 2412 rwwnw64d.exe 2412 rwwnw64d.exe 5668 rwwnw64d.exe 5668 rwwnw64d.exe 4188 rwwnw64d.exe 4188 rwwnw64d.exe 1384 rwwnw64d.exe 1384 rwwnw64d.exe 5156 rwwnw64d.exe 5156 rwwnw64d.exe 1176 rwwnw64d.exe 1176 rwwnw64d.exe 4860 rwwnw64d.exe 4860 rwwnw64d.exe 3972 rwwnw64d.exe 3972 rwwnw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4492 4512 2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe 89 PID 4492 wrote to memory of 2324 4492 rwwnw64d.exe 91 PID 2324 wrote to memory of 2460 2324 rwwnw64d.exe 95 PID 2300 wrote to memory of 4812 2300 rwwnw64d.exe 96 PID 2460 wrote to memory of 1096 2460 rwwnw64d.exe 98 PID 4812 wrote to memory of 2876 4812 rwwnw64d.exe 99 PID 1096 wrote to memory of 2096 1096 rwwnw64d.exe 100 PID 2876 wrote to memory of 4192 2876 rwwnw64d.exe 101 PID 2096 wrote to memory of 5420 2096 rwwnw64d.exe 102 PID 4192 wrote to memory of 5076 4192 rwwnw64d.exe 103 PID 5420 wrote to memory of 3520 5420 rwwnw64d.exe 104 PID 5076 wrote to memory of 2608 5076 rwwnw64d.exe 105 PID 3520 wrote to memory of 572 3520 rwwnw64d.exe 106 PID 2608 wrote to memory of 4240 2608 rwwnw64d.exe 107 PID 572 wrote to memory of 5484 572 rwwnw64d.exe 108 PID 4240 wrote to memory of 2828 4240 rwwnw64d.exe 109 PID 5484 wrote to memory of 944 5484 rwwnw64d.exe 110 PID 2828 wrote to memory of 5628 2828 rwwnw64d.exe 111 PID 944 wrote to memory of 3968 944 rwwnw64d.exe 112 PID 5628 wrote to memory of 2880 5628 rwwnw64d.exe 113 PID 3968 wrote to memory of 1764 3968 rwwnw64d.exe 114 PID 2880 wrote to memory of 2020 2880 rwwnw64d.exe 115 PID 1764 wrote to memory of 2412 1764 rwwnw64d.exe 116 PID 2020 wrote to memory of 5668 2020 rwwnw64d.exe 117 PID 2412 wrote to memory of 4188 2412 rwwnw64d.exe 118 PID 5668 wrote to memory of 1384 5668 rwwnw64d.exe 119 PID 4188 wrote to memory of 5156 4188 rwwnw64d.exe 120 PID 1384 wrote to memory of 1176 1384 rwwnw64d.exe 121 PID 5156 wrote to memory of 4860 5156 rwwnw64d.exe 122 PID 1176 wrote to memory of 3972 1176 rwwnw64d.exe 123 PID 4860 wrote to memory of 3200 4860 rwwnw64d.exe 124 PID 3972 wrote to memory of 2176 3972 rwwnw64d.exe 125 PID 3200 wrote to memory of 6104 3200 rwwnw64d.exe 126 PID 2176 wrote to memory of 2692 2176 rwwnw64d.exe 127 PID 6104 wrote to memory of 3356 6104 rwwnw64d.exe 128 PID 2692 wrote to memory of 1160 2692 rwwnw64d.exe 129 PID 3356 wrote to memory of 3460 3356 rwwnw64d.exe 130 PID 1160 wrote to memory of 4792 1160 rwwnw64d.exe 131 PID 3460 wrote to memory of 2784 3460 rwwnw64d.exe 132 PID 4792 wrote to memory of 2848 4792 rwwnw64d.exe 133 PID 2784 wrote to memory of 5820 2784 rwwnw64d.exe 134 PID 2848 wrote to memory of 2508 2848 rwwnw64d.exe 135 PID 5820 wrote to memory of 4124 5820 rwwnw64d.exe 136 PID 2508 wrote to memory of 3244 2508 rwwnw64d.exe 137 PID 4124 wrote to memory of 4856 4124 rwwnw64d.exe 138 PID 3244 wrote to memory of 6116 3244 rwwnw64d.exe 139 PID 4856 wrote to memory of 2392 4856 rwwnw64d.exe 140 PID 6116 wrote to memory of 4228 6116 rwwnw64d.exe 141 PID 2392 wrote to memory of 3100 2392 rwwnw64d.exe 143 PID 4228 wrote to memory of 3900 4228 rwwnw64d.exe 144 PID 3100 wrote to memory of 5948 3100 rwwnw64d.exe 145 PID 3900 wrote to memory of 2088 3900 rwwnw64d.exe 146 PID 5948 wrote to memory of 3592 5948 rwwnw64d.exe 147 PID 2088 wrote to memory of 708 2088 rwwnw64d.exe 148 PID 3592 wrote to memory of 4516 3592 rwwnw64d.exe 149 PID 708 wrote to memory of 5360 708 rwwnw64d.exe 150 PID 4516 wrote to memory of 5392 4516 rwwnw64d.exe 151 PID 5360 wrote to memory of 3264 5360 rwwnw64d.exe 152 PID 5392 wrote to memory of 5508 5392 rwwnw64d.exe 153 PID 3264 wrote to memory of 1544 3264 rwwnw64d.exe 154 PID 5508 wrote to memory of 4732 5508 rwwnw64d.exe 155 PID 1544 wrote to memory of 268 1544 rwwnw64d.exe 156 PID 4732 wrote to memory of 3380 4732 rwwnw64d.exe 157 PID 268 wrote to memory of 4932 268 rwwnw64d.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e95b9940af6fdc805eeb2fdeddef5eb7_elex_wannacry.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX7⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX12⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX23⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX25⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX27⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX30⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX31⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5508 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX34⤵
- Executes dropped EXE
- Modifies registry class
PID:3380 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX35⤵
- Drops file in System32 directory
PID:2488 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX36⤵PID:4428
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX37⤵
- Drops file in System32 directory
PID:2532 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX38⤵
- Drops file in System32 directory
- Modifies registry class
PID:4280 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX39⤵
- Modifies registry class
PID:1108 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX40⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1292 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX41⤵
- Modifies registry class
PID:4796 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX42⤵
- Modifies registry class
PID:2672 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX43⤵PID:3828
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX44⤵PID:4072
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX45⤵
- Creates a file in the Startup directory
PID:5972 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX46⤵PID:6052
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX47⤵PID:5768
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX48⤵PID:5832
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX49⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX50⤵PID:2432
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX51⤵PID:2980
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX52⤵
- Creates a file in the Startup directory
PID:5544 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX53⤵
- Modifies registry class
PID:1428 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX54⤵PID:3676
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX55⤵
- Creates a file in the Startup directory
PID:4112 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX56⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:2824 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX57⤵
- System Location Discovery: System Language Discovery
PID:2900 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX58⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3256 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX59⤵
- Creates a file in the Startup directory
PID:1976 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX60⤵
- System Location Discovery: System Language Discovery
PID:5124 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX61⤵PID:4944
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX62⤵PID:3352
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX63⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:1264 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX64⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5260 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX65⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2612 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX66⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:252 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX67⤵PID:1872
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX68⤵PID:976
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX69⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:704 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX70⤵PID:4452
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX71⤵PID:4588
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX72⤵
- Drops file in System32 directory
PID:3188 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX73⤵PID:1788
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX74⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3260 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX75⤵
- System Location Discovery: System Language Discovery
PID:5396 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX76⤵PID:3452
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX77⤵
- Drops file in System32 directory
PID:4740 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX78⤵PID:4892
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX79⤵PID:6076
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX80⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3220 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX81⤵
- Creates a file in the Startup directory
PID:2344 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX82⤵PID:2012
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX83⤵
- Creates a file in the Startup directory
PID:4484 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX84⤵
- Creates a file in the Startup directory
PID:5904 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX85⤵
- Creates a file in the Startup directory
PID:3856 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX86⤵
- System Location Discovery: System Language Discovery
PID:1164 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX87⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:4140 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX88⤵
- Modifies registry class
PID:5028 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX89⤵
- Creates a file in the Startup directory
PID:5292 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX90⤵
- Modifies registry class
PID:2604 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX91⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:5372 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX92⤵PID:5128
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX93⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4668 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX94⤵
- Drops file in System32 directory
PID:6124 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX95⤵
- System Location Discovery: System Language Discovery
PID:248 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX96⤵PID:1156
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX97⤵PID:1472
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX98⤵
- Creates a file in the Startup directory
PID:3144 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX99⤵
- Drops file in System32 directory
PID:5976 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX100⤵
- Creates a file in the Startup directory
PID:5452 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX101⤵PID:5592
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX102⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:5888 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX103⤵PID:6072
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX104⤵
- Creates a file in the Startup directory
PID:4248 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX105⤵PID:5268
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX106⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:6128 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX107⤵PID:476
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX108⤵
- System Location Discovery: System Language Discovery
PID:3168 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX109⤵PID:5572
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX110⤵
- Creates a file in the Startup directory
PID:5892 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX111⤵
- Drops file in System32 directory
PID:5464 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX112⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX113⤵
- Modifies registry class
PID:2004 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX114⤵PID:2956
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX115⤵
- Modifies registry class
PID:4520 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX116⤵PID:4908
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX117⤵
- Modifies registry class
PID:5516 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX118⤵PID:3332
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX119⤵
- Drops file in System32 directory
PID:4800 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX120⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:5040 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX121⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-