Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
24/08/2026, 23:53
General
- Target 2026-08-24_d4e899c033cbb753b84b36457f8a5a8a_elex_wannacry.exe
- Size 48KB
- Sample260824-3xeshavene
- SHA256 ecab6b152720dd5183f48b3183ad99344bc641205c1cd91e2125cb8f69e51c2c
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_d4e899c033cbb753b84b36457f8a5a8a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_d4e899c033cbb753b84b36457f8a5a8a_elex_wannacry.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg4⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg6⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg9⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg11⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg12⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg15⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg16⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg22⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg23⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg25⤵
- Executes dropped EXE
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\rwwnw64d.exeC:\Windows\SysWOW64\rwwnw64d.exe1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg4⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg6⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg7⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg9⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg10⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg11⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg13⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg15⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg16⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg17⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg23⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg24⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg26⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg28⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg29⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg30⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg31⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg32⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg34⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg38⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg39⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg40⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg41⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg42⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg43⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg44⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg45⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg46⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg47⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg48⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg49⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg50⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg51⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg52⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg53⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg54⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg55⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg56⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg57⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg58⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg59⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg60⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg61⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg62⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg63⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg64⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg65⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg66⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg67⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg68⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg69⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg70⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg71⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg72⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg73⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg74⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg75⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg76⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg77⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg78⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg79⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg80⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg81⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg82⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg83⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg84⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg85⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg86⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg87⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg88⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg89⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg90⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg91⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg92⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg93⤵
- Drops file in System32 directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg94⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg95⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg96⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg97⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg98⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg99⤵
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg100⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg101⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg102⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg103⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg104⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg105⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg106⤵
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg107⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg108⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg109⤵
- Creates a file in the Startup directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg110⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg111⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg113⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg114⤵
- Creates a file in the Startup directory
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg115⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg116⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg117⤵
- Drops file in System32 directory
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg118⤵
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg119⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg120⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
\??\c:\windows\SysWOW64\rwwnw64d.exec:\windows\system32\rwwnw64d.exe DWrvg121⤵
- Creates a file in the Startup directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-