Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 01:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe
- Size 48KB
- Sample260817-cdl5cs1end
- SHA256 ac6d0eb2fece99954131bd89071a59ec1f8f4e3c94a0a362912f759e4a2164b2
- MD5 a5c6f9cb6f8ef6b725061438afcb9c4a
- SHA1 64698123687ec561588a9b99aaa964d7bbbcfb5c
- SHA512 9aa058e912cd6f0d0082c4c6cf11a875701547898c3c446237fff5aa0becc6dd84fe6f8062b32f19ee40fad46786abedac85e6d0fd91f88ad544d766d3a69c16
- SSDEEP 768:aTdZuu1Ao2J29ng+nqVshjKrVFRoPKDk53Rx7tfk1FuLW:CSgAo2Q9g4oshjqLbMxeuC
- TLSH T1A423F743AE4B8095E211A6B0456D327DCB7375BA0760D7771784ED3C6837182FC3AAAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk 2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_Start.lnk rwwnw64d.exe - Executes dropped EXE 64 IoCs
pid Process 2152 rwwnw64d.exe 2640 rwwnw64d.exe 3172 rwwnw64d.exe 3244 rwwnw64d.exe 5856 rwwnw64d.exe 4976 rwwnw64d.exe 368 rwwnw64d.exe 4684 rwwnw64d.exe 5064 rwwnw64d.exe 1088 rwwnw64d.exe 3980 rwwnw64d.exe 5328 rwwnw64d.exe 5172 rwwnw64d.exe 2632 rwwnw64d.exe 1692 rwwnw64d.exe 1668 rwwnw64d.exe 2480 rwwnw64d.exe 4820 rwwnw64d.exe 2404 rwwnw64d.exe 1788 rwwnw64d.exe 3432 rwwnw64d.exe 3816 rwwnw64d.exe 3136 rwwnw64d.exe 4800 rwwnw64d.exe 5720 rwwnw64d.exe 5140 rwwnw64d.exe 5016 rwwnw64d.exe 1004 rwwnw64d.exe 2012 rwwnw64d.exe 5968 rwwnw64d.exe 3448 rwwnw64d.exe 1984 rwwnw64d.exe 2460 rwwnw64d.exe 4652 rwwnw64d.exe 2228 rwwnw64d.exe 2328 rwwnw64d.exe 2668 rwwnw64d.exe 5652 rwwnw64d.exe 5032 rwwnw64d.exe 5508 rwwnw64d.exe 4308 rwwnw64d.exe 4256 rwwnw64d.exe 5828 rwwnw64d.exe 3920 rwwnw64d.exe 4844 rwwnw64d.exe 2136 rwwnw64d.exe 1976 rwwnw64d.exe 2100 rwwnw64d.exe 5008 rwwnw64d.exe 2988 rwwnw64d.exe 5424 rwwnw64d.exe 3524 rwwnw64d.exe 5340 rwwnw64d.exe 5864 rwwnw64d.exe 4000 rwwnw64d.exe 832 rwwnw64d.exe 4588 rwwnw64d.exe 2848 rwwnw64d.exe 3552 rwwnw64d.exe 4400 rwwnw64d.exe 3564 rwwnw64d.exe 904 rwwnw64d.exe 2616 rwwnw64d.exe 2088 rwwnw64d.exe - Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-CE-E5-59-DW} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe DWrvgXX" 2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-CE-E5-59-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-CE-E5-59-DW} = "C:\\Windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{8C-CE-E5-59-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{0E-E0-0E-EE-DW} = "c:\\windows\\SysWOW64\\rwwnw64d.exe DWrvgXX" rwwnw64d.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_17_08_26.log rwwnw64d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rwwnw64d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command rwwnw64d.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4580 2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe 4580 2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe 2152 rwwnw64d.exe 2152 rwwnw64d.exe 2640 rwwnw64d.exe 2640 rwwnw64d.exe 3172 rwwnw64d.exe 3172 rwwnw64d.exe 3244 rwwnw64d.exe 3244 rwwnw64d.exe 5856 rwwnw64d.exe 5856 rwwnw64d.exe 4976 rwwnw64d.exe 4976 rwwnw64d.exe 368 rwwnw64d.exe 368 rwwnw64d.exe 4684 rwwnw64d.exe 4684 rwwnw64d.exe 5064 rwwnw64d.exe 5064 rwwnw64d.exe 1088 rwwnw64d.exe 1088 rwwnw64d.exe 3980 rwwnw64d.exe 3980 rwwnw64d.exe 5328 rwwnw64d.exe 5328 rwwnw64d.exe 5172 rwwnw64d.exe 5172 rwwnw64d.exe 2632 rwwnw64d.exe 2632 rwwnw64d.exe 1692 rwwnw64d.exe 1692 rwwnw64d.exe 1668 rwwnw64d.exe 1668 rwwnw64d.exe 2480 rwwnw64d.exe 2480 rwwnw64d.exe 4820 rwwnw64d.exe 4820 rwwnw64d.exe 2404 rwwnw64d.exe 2404 rwwnw64d.exe 1788 rwwnw64d.exe 1788 rwwnw64d.exe 3432 rwwnw64d.exe 3432 rwwnw64d.exe 3816 rwwnw64d.exe 3816 rwwnw64d.exe 3136 rwwnw64d.exe 3136 rwwnw64d.exe 4800 rwwnw64d.exe 4800 rwwnw64d.exe 5720 rwwnw64d.exe 5720 rwwnw64d.exe 5140 rwwnw64d.exe 5140 rwwnw64d.exe 5016 rwwnw64d.exe 5016 rwwnw64d.exe 1004 rwwnw64d.exe 1004 rwwnw64d.exe 2012 rwwnw64d.exe 2012 rwwnw64d.exe 5968 rwwnw64d.exe 5968 rwwnw64d.exe 3448 rwwnw64d.exe 3448 rwwnw64d.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2152 4580 2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe 89 PID 2152 wrote to memory of 2640 2152 rwwnw64d.exe 91 PID 2640 wrote to memory of 3244 2640 rwwnw64d.exe 95 PID 3172 wrote to memory of 5856 3172 rwwnw64d.exe 96 PID 3244 wrote to memory of 4976 3244 rwwnw64d.exe 97 PID 5856 wrote to memory of 368 5856 rwwnw64d.exe 99 PID 4976 wrote to memory of 4684 4976 rwwnw64d.exe 100 PID 368 wrote to memory of 5064 368 rwwnw64d.exe 101 PID 4684 wrote to memory of 1088 4684 rwwnw64d.exe 102 PID 5064 wrote to memory of 3980 5064 rwwnw64d.exe 103 PID 1088 wrote to memory of 5328 1088 rwwnw64d.exe 104 PID 3980 wrote to memory of 5172 3980 rwwnw64d.exe 105 PID 5328 wrote to memory of 2632 5328 rwwnw64d.exe 106 PID 5172 wrote to memory of 1692 5172 rwwnw64d.exe 107 PID 2632 wrote to memory of 1668 2632 rwwnw64d.exe 108 PID 1692 wrote to memory of 2480 1692 rwwnw64d.exe 109 PID 1668 wrote to memory of 4820 1668 rwwnw64d.exe 110 PID 2480 wrote to memory of 2404 2480 rwwnw64d.exe 111 PID 4820 wrote to memory of 1788 4820 rwwnw64d.exe 112 PID 2404 wrote to memory of 3432 2404 rwwnw64d.exe 113 PID 1788 wrote to memory of 3816 1788 rwwnw64d.exe 114 PID 3432 wrote to memory of 3136 3432 rwwnw64d.exe 115 PID 3816 wrote to memory of 4800 3816 rwwnw64d.exe 116 PID 3136 wrote to memory of 5720 3136 rwwnw64d.exe 117 PID 4800 wrote to memory of 5140 4800 rwwnw64d.exe 118 PID 5720 wrote to memory of 5016 5720 rwwnw64d.exe 119 PID 5140 wrote to memory of 1004 5140 rwwnw64d.exe 120 PID 5016 wrote to memory of 2012 5016 rwwnw64d.exe 121 PID 1004 wrote to memory of 5968 1004 rwwnw64d.exe 122 PID 2012 wrote to memory of 3448 2012 rwwnw64d.exe 123 PID 5968 wrote to memory of 1984 5968 rwwnw64d.exe 124 PID 3448 wrote to memory of 2460 3448 rwwnw64d.exe 125 PID 1984 wrote to memory of 4652 1984 rwwnw64d.exe 126 PID 2460 wrote to memory of 2228 2460 rwwnw64d.exe 127 PID 4652 wrote to memory of 2328 4652 rwwnw64d.exe 128 PID 2228 wrote to memory of 2668 2228 rwwnw64d.exe 129 PID 2328 wrote to memory of 5652 2328 rwwnw64d.exe 130 PID 2668 wrote to memory of 5032 2668 rwwnw64d.exe 131 PID 5652 wrote to memory of 5508 5652 rwwnw64d.exe 132 PID 5032 wrote to memory of 4308 5032 rwwnw64d.exe 133 PID 5508 wrote to memory of 4256 5508 rwwnw64d.exe 134 PID 4308 wrote to memory of 5828 4308 rwwnw64d.exe 135 PID 4256 wrote to memory of 3920 4256 rwwnw64d.exe 136 PID 5828 wrote to memory of 4844 5828 rwwnw64d.exe 137 PID 3920 wrote to memory of 2136 3920 rwwnw64d.exe 138 PID 4844 wrote to memory of 1976 4844 rwwnw64d.exe 139 PID 2136 wrote to memory of 2100 2136 rwwnw64d.exe 140 PID 1976 wrote to memory of 5008 1976 rwwnw64d.exe 141 PID 2100 wrote to memory of 2988 2100 rwwnw64d.exe 142 PID 5008 wrote to memory of 5424 5008 rwwnw64d.exe 143 PID 2988 wrote to memory of 3524 2988 rwwnw64d.exe 144 PID 5424 wrote to memory of 5340 5424 rwwnw64d.exe 145 PID 3524 wrote to memory of 5864 3524 rwwnw64d.exe 146 PID 5340 wrote to memory of 4000 5340 rwwnw64d.exe 147 PID 5864 wrote to memory of 832 5864 rwwnw64d.exe 148 PID 4000 wrote to memory of 4588 4000 rwwnw64d.exe 149 PID 832 wrote to memory of 2848 832 rwwnw64d.exe 150 PID 4588 wrote to memory of 3552 4588 rwwnw64d.exe 151 PID 2848 wrote to memory of 4400 2848 rwwnw64d.exe 152 PID 3552 wrote to memory of 3564 3552 rwwnw64d.exe 153 PID 4400 wrote to memory of 904 4400 rwwnw64d.exe 154 PID 3564 wrote to memory of 2616 3564 rwwnw64d.exe 155 PID 904 wrote to memory of 2088 904 rwwnw64d.exe 156 PID 2616 wrote to memory of 1356 2616 rwwnw64d.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_a5c6f9cb6f8ef6b725061438afcb9c4a_elex_wannacry.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX4⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX6⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX9⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX13⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX16⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX17⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX21⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5652 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX22⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5508 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX26⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX30⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX31⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX32⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX33⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX35⤵PID:1980
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX36⤵
- Drops file in System32 directory
PID:4792 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX37⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1532 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX38⤵
- Creates a file in the Startup directory
PID:3212 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX39⤵
- Drops file in System32 directory
PID:248 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX40⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:708 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX41⤵
- Creates a file in the Startup directory
PID:2524 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX42⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1204 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX43⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:3192 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX44⤵
- System Location Discovery: System Language Discovery
PID:4696 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX45⤵PID:5524
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX46⤵
- Creates a file in the Startup directory
PID:3264 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX47⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2808 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX48⤵PID:5676
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX49⤵
- Drops file in System32 directory
- Modifies registry class
PID:1132 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX50⤵PID:2072
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX51⤵
- System Location Discovery: System Language Discovery
PID:5320 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX52⤵
- Drops file in System32 directory
- Modifies registry class
PID:1660 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX53⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:3708 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX54⤵
- Drops file in System32 directory
- Modifies registry class
PID:2324 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX55⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4548 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX56⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:1452 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX57⤵PID:1376
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX58⤵PID:1368
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX59⤵
- Modifies registry class
PID:4300 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX60⤵
- Drops file in System32 directory
PID:4460 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX61⤵
- System Location Discovery: System Language Discovery
PID:4468 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX62⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
PID:1292 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX63⤵
- System Location Discovery: System Language Discovery
PID:4732 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX64⤵
- System Location Discovery: System Language Discovery
PID:3156 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX65⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4380 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX66⤵
- Modifies registry class
PID:2728 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX67⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5040 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX68⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4276 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX69⤵PID:3884
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX70⤵PID:3988
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX71⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:560 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX72⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4132 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX73⤵
- Drops file in System32 directory
PID:2348 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX74⤵PID:5048
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX75⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:3532 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX76⤵
- Modifies registry class
PID:1108 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX77⤵
- Modifies registry class
PID:4544 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX78⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX79⤵
- Creates a file in the Startup directory
PID:4196 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX80⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:240 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX81⤵PID:3484
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX82⤵PID:2780
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX83⤵
- Creates a file in the Startup directory
PID:4668 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3000 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX85⤵PID:5152
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX86⤵PID:3528
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX87⤵PID:6052
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX88⤵PID:3280
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX89⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1040 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX90⤵
- Creates a file in the Startup directory
PID:4932 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX91⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3216 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX92⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
PID:1784 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX93⤵
- Creates a file in the Startup directory
PID:1172 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX94⤵
- Drops file in System32 directory
PID:5332 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX95⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:704 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX96⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:1148 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX97⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX98⤵PID:4864
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX99⤵
- Creates a file in the Startup directory
PID:5688 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX100⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3856 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX101⤵
- Drops file in System32 directory
PID:3764 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX102⤵
- Drops file in System32 directory
PID:5116 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX103⤵PID:5660
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX104⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4532 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX105⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4704 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX106⤵
- System Location Discovery: System Language Discovery
PID:4836 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX107⤵
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX108⤵
- Drops file in System32 directory
PID:1224 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX109⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1380 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX110⤵
- Creates a file in the Startup directory
PID:1596 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX111⤵
- Modifies registry class
PID:4568 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX112⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX113⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:1836 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX114⤵
- Modifies registry class
PID:4916 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX115⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4760 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX116⤵
- Adds Run key to start application
PID:4008 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX117⤵
- Drops file in System32 directory
- Modifies registry class
PID:3712 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX118⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5500 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX119⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX120⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4740 -
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvgXX121⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-