Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 05:55
General
- Target 2026-08-10_bd2b3e602ccaeda9f98583d943fdbeea_elex_wannacry.exe
- Size 74KB
- Sample260810-gmgcpaed54
- SHA256 2e90ca92fe69ce75d39f3ece0bcbf14572f885407e07b805c2e3e8e014f82816
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_bd2b3e602ccaeda9f98583d943fdbeea_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_bd2b3e602ccaeda9f98583d943fdbeea_elex_wannacry.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli5⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli7⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli8⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli9⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli10⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli11⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli15⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli16⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli17⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli18⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli19⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli24⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli25⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli26⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli29⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli30⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli31⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli33⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli35⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli36⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli37⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli38⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli39⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli41⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli44⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli45⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli50⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli52⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli54⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli55⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli58⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli59⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli61⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli62⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli65⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli66⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli67⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli68⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli69⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli70⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli71⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli72⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli73⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli74⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli75⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli76⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli78⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli79⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli80⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli81⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli82⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli83⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli84⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli85⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli86⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli87⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli88⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli89⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli90⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli91⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli92⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli93⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli94⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli95⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli96⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli97⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli98⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli99⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli100⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli101⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli102⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli103⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli104⤵
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli105⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli106⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli107⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli108⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli109⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli110⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli111⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli112⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli113⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli114⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli115⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli116⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli117⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli118⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli119⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli120⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwdw64d.exec:\windows\system32\rwwdw64d.exe DWoli121⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-