Overview

overview

7

Static

static

3

2026-08-10...ry.exe

windows10-2004-x64

7

2026-08-10...ry.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 03:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_ea0108fbeaab6b7caea4e88e4fcc9233_elex_wannacry.exe
  • Size 74KB
  • Sample260810-ecwnhsvtes
  • SHA256 3be23d4149ebf589da1ab1ea91a38270208a0e696126f5daf0946977c1a064e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 64 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_ea0108fbeaab6b7caea4e88e4fcc9233_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_ea0108fbeaab6b7caea4e88e4fcc9233_elex_wannacry.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3672
    • \??\c:\windows\SysWOW64\rwwdw64d.exe
      c:\windows\system32\rwwdw64d.exe DWoli
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3348
      • \??\c:\windows\SysWOW64\rwwdw64d.exe
        c:\windows\system32\rwwdw64d.exe DWoli
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:896
        • \??\c:\windows\SysWOW64\rwwdw64d.exe
          c:\windows\system32\rwwdw64d.exe DWoli
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3444
          • \??\c:\windows\SysWOW64\rwwdw64d.exe
            c:\windows\system32\rwwdw64d.exe DWoli
            5⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5768
            • \??\c:\windows\SysWOW64\rwwdw64d.exe
              c:\windows\system32\rwwdw64d.exe DWoli
              6⤵
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:248
              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                c:\windows\system32\rwwdw64d.exe DWoli
                7⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2780
                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                  c:\windows\system32\rwwdw64d.exe DWoli
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5580
                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                    c:\windows\system32\rwwdw64d.exe DWoli
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3968
                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                      c:\windows\system32\rwwdw64d.exe DWoli
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3436
                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                        c:\windows\system32\rwwdw64d.exe DWoli
                        11⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4316
                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                          c:\windows\system32\rwwdw64d.exe DWoli
                          12⤵
                          • Creates a file in the Startup directory
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:5948
                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                            c:\windows\system32\rwwdw64d.exe DWoli
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:1284
                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                              c:\windows\system32\rwwdw64d.exe DWoli
                              14⤵
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:1100
                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                c:\windows\system32\rwwdw64d.exe DWoli
                                15⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1832
                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                  c:\windows\system32\rwwdw64d.exe DWoli
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3964
                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                    c:\windows\system32\rwwdw64d.exe DWoli
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3392
                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                      c:\windows\system32\rwwdw64d.exe DWoli
                                      18⤵
                                      • Creates a file in the Startup directory
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2116
                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                        c:\windows\system32\rwwdw64d.exe DWoli
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2836
                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                          c:\windows\system32\rwwdw64d.exe DWoli
                                          20⤵
                                          • Creates a file in the Startup directory
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:2600
                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                            c:\windows\system32\rwwdw64d.exe DWoli
                                            21⤵
                                            • Executes dropped EXE
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:2072
                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                              c:\windows\system32\rwwdw64d.exe DWoli
                                              22⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Suspicious use of WriteProcessMemory
                                              PID:4620
                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                23⤵
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of WriteProcessMemory
                                                PID:2388
                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5920
                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                    25⤵
                                                    • Creates a file in the Startup directory
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4100
                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                      26⤵
                                                      • Creates a file in the Startup directory
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3472
                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                        27⤵
                                                        • Creates a file in the Startup directory
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4228
                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3204
                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                            29⤵
                                                            • Creates a file in the Startup directory
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5472
                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4136
                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6116
                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1424
                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                    33⤵
                                                                    • Creates a file in the Startup directory
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4352
                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      PID:3564
                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                        35⤵
                                                                        • Creates a file in the Startup directory
                                                                        PID:5088
                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                          36⤵
                                                                          • Creates a file in the Startup directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2712
                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                            37⤵
                                                                            • Creates a file in the Startup directory
                                                                            • Drops file in System32 directory
                                                                            • Modifies registry class
                                                                            PID:2356
                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                              38⤵
                                                                              • Creates a file in the Startup directory
                                                                              • Drops file in System32 directory
                                                                              PID:1140
                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                39⤵
                                                                                  PID:2984
                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                    40⤵
                                                                                      PID:3196
                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                        41⤵
                                                                                          PID:5496
                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                            42⤵
                                                                                            • Modifies registry class
                                                                                            PID:5588
                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                              43⤵
                                                                                              • Modifies registry class
                                                                                              PID:4376
                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                44⤵
                                                                                                • Creates a file in the Startup directory
                                                                                                PID:1496
                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                  45⤵
                                                                                                  • Creates a file in the Startup directory
                                                                                                  • Drops file in System32 directory
                                                                                                  PID:1072
                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                    46⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:5888
                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                      47⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry class
                                                                                                      PID:3104
                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                        48⤵
                                                                                                        • Creates a file in the Startup directory
                                                                                                        • Modifies registry class
                                                                                                        PID:4516
                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                          49⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          PID:2980
                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                            50⤵
                                                                                                            • Creates a file in the Startup directory
                                                                                                            • Drops file in System32 directory
                                                                                                            PID:1672
                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                              51⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry class
                                                                                                              PID:2220
                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                52⤵
                                                                                                                • Creates a file in the Startup directory
                                                                                                                • Modifies registry class
                                                                                                                PID:4732
                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                  53⤵
                                                                                                                  • Creates a file in the Startup directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5024
                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                    54⤵
                                                                                                                    • Modifies registry class
                                                                                                                    PID:2084
                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                      55⤵
                                                                                                                      • Creates a file in the Startup directory
                                                                                                                      PID:5368
                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                        56⤵
                                                                                                                        • Creates a file in the Startup directory
                                                                                                                        • Drops file in System32 directory
                                                                                                                        PID:5628
                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                          57⤵
                                                                                                                          • Creates a file in the Startup directory
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:5936
                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                            58⤵
                                                                                                                            • Drops file in System32 directory
                                                                                                                            PID:2432
                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                              59⤵
                                                                                                                              • Creates a file in the Startup directory
                                                                                                                              PID:2596
                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                60⤵
                                                                                                                                  PID:4128
                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                    61⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:1604
                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                      62⤵
                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                      PID:5752
                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                        63⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:4260
                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                          64⤵
                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:4624
                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                            65⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:2636
                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                              66⤵
                                                                                                                                                PID:3004
                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                  67⤵
                                                                                                                                                    PID:3008
                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                      68⤵
                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                      PID:4560
                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                        69⤵
                                                                                                                                                          PID:5136
                • C:\Windows\SysWOW64\rwwdw64d.exe
                  C:\Windows\SysWOW64\rwwdw64d.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2856
                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                    c:\windows\system32\rwwdw64d.exe DWoli
                    2⤵
                    • Creates a file in the Startup directory
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1520
                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                      c:\windows\system32\rwwdw64d.exe DWoli
                      3⤵
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:5928
                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                        c:\windows\system32\rwwdw64d.exe DWoli
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4764
                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                          c:\windows\system32\rwwdw64d.exe DWoli
                          5⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2748
                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                            c:\windows\system32\rwwdw64d.exe DWoli
                            6⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:3056
                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                              c:\windows\system32\rwwdw64d.exe DWoli
                              7⤵
                              • Creates a file in the Startup directory
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:6104
                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                c:\windows\system32\rwwdw64d.exe DWoli
                                8⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:4180
                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                  c:\windows\system32\rwwdw64d.exe DWoli
                                  9⤵
                                  • Creates a file in the Startup directory
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3384
                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                    c:\windows\system32\rwwdw64d.exe DWoli
                                    10⤵
                                    • Creates a file in the Startup directory
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3636
                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                      c:\windows\system32\rwwdw64d.exe DWoli
                                      11⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:5776
                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                        c:\windows\system32\rwwdw64d.exe DWoli
                                        12⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:5596
                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                          c:\windows\system32\rwwdw64d.exe DWoli
                                          13⤵
                                          • Creates a file in the Startup directory
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4108
                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                            c:\windows\system32\rwwdw64d.exe DWoli
                                            14⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1964
                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                              c:\windows\system32\rwwdw64d.exe DWoli
                                              15⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:5784
                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                16⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2400
                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                  17⤵
                                                  • Creates a file in the Startup directory
                                                  • Executes dropped EXE
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5864
                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                    18⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:696
                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                      19⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4844
                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                        20⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5064
                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                          21⤵
                                                          • Creates a file in the Startup directory
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3264
                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                            22⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2340
                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                              23⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3608
                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                24⤵
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5880
                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                  25⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:6000
                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                    26⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5576
                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                      27⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in System32 directory
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4408
                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                        28⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • Modifies registry class
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3520
                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                          29⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3756
                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                            30⤵
                                                                            • Creates a file in the Startup directory
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1800
                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                              31⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1616
                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                32⤵
                                                                                • Drops file in System32 directory
                                                                                • Modifies registry class
                                                                                PID:928
                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                  33⤵
                                                                                  • Drops file in System32 directory
                                                                                  PID:2420
                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                    34⤵
                                                                                      PID:480
                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                        35⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:3320
                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                          36⤵
                                                                                          • Modifies registry class
                                                                                          PID:260
                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                            37⤵
                                                                                            • Modifies registry class
                                                                                            PID:3824
                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                              38⤵
                                                                                              • Creates a file in the Startup directory
                                                                                              • Modifies registry class
                                                                                              PID:5276
                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                39⤵
                                                                                                • Creates a file in the Startup directory
                                                                                                • Drops file in System32 directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4456
                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                  40⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1620
                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                    41⤵
                                                                                                    • Creates a file in the Startup directory
                                                                                                    • Drops file in System32 directory
                                                                                                    PID:1084
                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                      42⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2500
                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                        43⤵
                                                                                                          PID:2716
                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                            44⤵
                                                                                                            • Creates a file in the Startup directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5380
                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                              45⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3736
                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                46⤵
                                                                                                                • Creates a file in the Startup directory
                                                                                                                PID:5716
                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                  47⤵
                                                                                                                  • Modifies registry class
                                                                                                                  PID:1600
                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                    48⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:4488
                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                      49⤵
                                                                                                                      • Drops file in System32 directory
                                                                                                                      PID:4932
                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                        50⤵
                                                                                                                        • Modifies registry class
                                                                                                                        PID:4524
                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                          51⤵
                                                                                                                            PID:3400
                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                              52⤵
                                                                                                                              • Drops file in System32 directory
                                                                                                                              PID:3580
                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                53⤵
                                                                                                                                • Creates a file in the Startup directory
                                                                                                                                PID:4120
                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                  54⤵
                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                  PID:1120
                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                    55⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4384
                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                      56⤵
                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Modifies registry class
                                                                                                                                      PID:5156
                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                        57⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:5468
                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                          58⤵
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:2296
                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                            59⤵
                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                            • Drops file in System32 directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:1376
                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                              60⤵
                                                                                                                                              • Creates a file in the Startup directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3232
                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                61⤵
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Modifies registry class
                                                                                                                                                PID:4888
                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                  62⤵
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  PID:792
                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                    63⤵
                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                    PID:2484
                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                      64⤵
                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                      PID:1480
                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                        65⤵
                                                                                                                                                          PID:5616
                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                            66⤵
                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            PID:4536
                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                              67⤵
                                                                                                                                                              • Creates a file in the Startup directory
                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:5464
                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                68⤵
                                                                                                                                                                  PID:4412
                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                    69⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:5736
                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                      70⤵
                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                      PID:5592
                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                        71⤵
                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5932
                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                          72⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:5516
                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                            73⤵
                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                            PID:5212
                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                              74⤵
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              PID:4640
                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                75⤵
                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:4600
                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                  76⤵
                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                  PID:2424
                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                    77⤵
                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                    PID:5816
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                      78⤵
                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                      PID:4852
                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                        79⤵
                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                        PID:3428
                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                          80⤵
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5940
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                            81⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2656
                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                              82⤵
                                                                                                                                                                                              • Creates a file in the Startup directory
                                                                                                                                                                                              PID:5644
                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                83⤵
                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                  PID:3764
                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                    85⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3108
                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                      PID:5060
                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                        87⤵
                                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                              89⤵
                                                                                                                                                                                                              • Creates a file in the Startup directory
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                90⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4996
                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                                          PID:3368
                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                                    PID:4692
                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      PID:5528
                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:5176
                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:3888
                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:2552
                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:5248
                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      PID:2812
                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                            PID:1244
                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:5500
                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                      PID:3552
                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                          PID:1336
                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                                              PID:4172
                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                PID:3596
                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                      PID:52
                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        PID:4340
                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                            • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                              c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                                                • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                  c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                    • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                      c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                                      PID:3284
                                                                                                                                                                                                                                                                                                      • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                        c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                        PID:1712
                                                                                                                                                                                                                                                                                                        • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                          c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                          PID:1968
                                                                                                                                                                                                                                                                                                          • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                            c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                              PID:4608
                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                                                                                                  • \??\c:\windows\SysWOW64\rwwdw64d.exe
                                                                                                                                                                                                                                                                                                                    c:\windows\system32\rwwdw64d.exe DWoli
                                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                                      PID:1196

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 4b5e2b3faf75900291d0c71fc53005fce76ada6d8c7bfb749b40cd3708464010
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 daccbdee19b0beb7d034b135a0c86dc4c87ca05170f88aa5813acb4d54af0ebc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 67aa41f3b5081998e81cd01d3d3c821aa0b0f0d7d68f4e43c83a417fb63e6b9c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 bfebcaf2e2bf5564690e44e1d3928480014308265eb353844462f9c789643d36
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 c0347d45f34c9d109fadf55c0fbda586b47ae1caa9182cb7aa5b5c0e75f3ccdf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 a0b1c128b5d28135eebbba26f6e34ac9bbb676210bbfc505565d333090705a4f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 4e6a87a5f57384557f74c34781c839b0131c48d0afbc1dfe2024f631df401466
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 73426a09ff9fe7d4e6f559da6327dea0dde77e3f65e17916aa4d3420cba0ceaa
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 999c7c42061f400bf3ae8aa2fc44bcced7e40c0a81a8b40a179b183c1b04960a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 c6e1c0351cdf0bcc9fcb04dd63c97a557ae86cb7b314bb3ca20d729a006d794e
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 7f13c4ca7355f938b906c8b076d1d05277e3f62a3a871512cc487543c130edc5
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 4b7e1ab7449dd4d992ac24e51eab6e922d0aa2ba9e13090f4f399e03371e86bf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 d7e4ac759437e8d7cc7acca648ba958e831660101daedf0e145370c4ac910a88
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 987B
                                                    • SHA256 d17c2f6fdcda6597fc93aa8376b6d77a8f52f55cdc4cf04e0491f3fdedc4ad88
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    DW_Start.lnk
                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk
                                                    • Size 1KB
                                                    • SHA256 9c82e0fc09441eedceabfc58313d10c1d60046195ca50cb01a7e04bb19421f34
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    msnav32.ax
                                                    • Path C:\Windows\SysWOW64\msnav32.ax
                                                    • Size 16B
                                                    • SHA256 085fd403608dbdb9b5dac45db2f43ed16dfe6076acc9ba69080719e4380316d7
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    rwwdw64d.exe
                                                    • Path C:\Windows\SysWOW64\rwwdw64d.exe
                                                    • Size 74KB
                                                    • SHA256 aa28eedc1b7d2f0c1df808e78f5dba117cf8ec1d02da225115363bcd929fda11
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download