Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe
- Size 56KB
- Sample260828-bmtp5ascmf
- SHA256 a01d283d00cd04e71838d7b6a04a6b3f8111d98fca402cbe0c5f27454db591be
- MD5 f69f77b95bb60ab53d1b68e77b5f5b73
- SHA1 0592c038a5d20b5bfe139c9cca78fe8bc44c889a
- SHA512 a0f56b9a9b6f6a340421e32e88aa2547a315a4c8643e6b8549e47554f5c7660bdce225a78d5e08305b9f651a037f6297441bf45ab2f060d5814f646a3c011676
- SSDEEP 768:uEaz5G7MaEtbwQpeyjaSLyfOPT4xcsrRA9Xu/IC4X3i2AH350azknSRXJuRWQlh6:v4GYUWeypTUuuQj635cSRU3iN/ntNN
- TLSH T199433A87EE5D40D0E6155A30896D237DCAB7947E4B30DBAB1788DD3C2837480EC3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TA_Start.lnk dwdsrngt.exe - Executes dropped EXE 64 IoCs
pid Process 5500 dwdsrngt.exe 4592 dwdsrngt.exe 4704 dwdsrngt.exe 5288 dwdsrngt.exe 1192 dwdsrngt.exe 4916 dwdsrngt.exe 4312 dwdsrngt.exe 2144 dwdsrngt.exe 5144 dwdsrngt.exe 5788 dwdsrngt.exe 2780 dwdsrngt.exe 240 dwdsrngt.exe 2252 dwdsrngt.exe 3448 dwdsrngt.exe 3364 dwdsrngt.exe 3548 dwdsrngt.exe 2708 dwdsrngt.exe 5704 dwdsrngt.exe 1080 dwdsrngt.exe 2836 dwdsrngt.exe 3524 dwdsrngt.exe 4688 dwdsrngt.exe 4940 dwdsrngt.exe 4464 dwdsrngt.exe 4244 dwdsrngt.exe 4584 dwdsrngt.exe 5572 dwdsrngt.exe 2100 dwdsrngt.exe 4636 dwdsrngt.exe 932 dwdsrngt.exe 6064 dwdsrngt.exe 1240 dwdsrngt.exe 1060 dwdsrngt.exe 3748 dwdsrngt.exe 5800 dwdsrngt.exe 2388 dwdsrngt.exe 3292 dwdsrngt.exe 5656 dwdsrngt.exe 1044 dwdsrngt.exe 824 dwdsrngt.exe 1508 dwdsrngt.exe 3500 dwdsrngt.exe 752 dwdsrngt.exe 1584 dwdsrngt.exe 4784 dwdsrngt.exe 4252 dwdsrngt.exe 5984 dwdsrngt.exe 5300 dwdsrngt.exe 2956 dwdsrngt.exe 2964 dwdsrngt.exe 4768 dwdsrngt.exe 3340 dwdsrngt.exe 4364 dwdsrngt.exe 4760 dwdsrngt.exe 3112 dwdsrngt.exe 820 dwdsrngt.exe 5268 dwdsrngt.exe 5272 dwdsrngt.exe 5480 dwdsrngt.exe 1900 dwdsrngt.exe 1404 dwdsrngt.exe 4192 dwdsrngt.exe 5048 dwdsrngt.exe 5104 dwdsrngt.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{C1-1C-C8-8F-ZN} = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe CHD001" 2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{C1-1C-C8-8F-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHD001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{C1-1C-C8-8F-ZN} = "C:\\Windows\\SysWOW64\\dwdsrngt.exe CHD001" dwdsrngt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{C1-1C-C8-8F-ZN} = "c:\\windows\\SysWOW64\\dwdsrngt.exe CHD001" dwdsrngt.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File created \??\c:\windows\SysWOW64\dwdsrngt.exe 2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe File opened for modification C:\Windows\SysWOW64\dbglogfolder\n_inst_28_08_26.log dwdsrngt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwdsrngt.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm dwdsrngt.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2840 2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe 2840 2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe 5500 dwdsrngt.exe 5500 dwdsrngt.exe 4592 dwdsrngt.exe 4592 dwdsrngt.exe 4704 dwdsrngt.exe 4704 dwdsrngt.exe 5288 dwdsrngt.exe 5288 dwdsrngt.exe 1192 dwdsrngt.exe 1192 dwdsrngt.exe 4916 dwdsrngt.exe 4916 dwdsrngt.exe 4312 dwdsrngt.exe 4312 dwdsrngt.exe 2144 dwdsrngt.exe 2144 dwdsrngt.exe 5144 dwdsrngt.exe 5144 dwdsrngt.exe 5788 dwdsrngt.exe 5788 dwdsrngt.exe 2780 dwdsrngt.exe 2780 dwdsrngt.exe 240 dwdsrngt.exe 240 dwdsrngt.exe 2252 dwdsrngt.exe 2252 dwdsrngt.exe 3448 dwdsrngt.exe 3448 dwdsrngt.exe 3364 dwdsrngt.exe 3364 dwdsrngt.exe 3548 dwdsrngt.exe 3548 dwdsrngt.exe 2708 dwdsrngt.exe 2708 dwdsrngt.exe 5704 dwdsrngt.exe 5704 dwdsrngt.exe 1080 dwdsrngt.exe 1080 dwdsrngt.exe 2836 dwdsrngt.exe 2836 dwdsrngt.exe 3524 dwdsrngt.exe 3524 dwdsrngt.exe 4688 dwdsrngt.exe 4688 dwdsrngt.exe 4940 dwdsrngt.exe 4940 dwdsrngt.exe 4464 dwdsrngt.exe 4464 dwdsrngt.exe 4244 dwdsrngt.exe 4244 dwdsrngt.exe 4584 dwdsrngt.exe 4584 dwdsrngt.exe 5572 dwdsrngt.exe 5572 dwdsrngt.exe 2100 dwdsrngt.exe 2100 dwdsrngt.exe 4636 dwdsrngt.exe 4636 dwdsrngt.exe 932 dwdsrngt.exe 932 dwdsrngt.exe 6064 dwdsrngt.exe 6064 dwdsrngt.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 5500 2840 2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe 89 PID 5500 wrote to memory of 4592 5500 dwdsrngt.exe 91 PID 4592 wrote to memory of 5288 4592 dwdsrngt.exe 95 PID 4704 wrote to memory of 1192 4704 dwdsrngt.exe 96 PID 5288 wrote to memory of 4916 5288 dwdsrngt.exe 97 PID 1192 wrote to memory of 4312 1192 dwdsrngt.exe 99 PID 4916 wrote to memory of 2144 4916 dwdsrngt.exe 100 PID 4312 wrote to memory of 5144 4312 dwdsrngt.exe 101 PID 2144 wrote to memory of 5788 2144 dwdsrngt.exe 102 PID 5144 wrote to memory of 2780 5144 dwdsrngt.exe 103 PID 5788 wrote to memory of 240 5788 dwdsrngt.exe 104 PID 2780 wrote to memory of 2252 2780 dwdsrngt.exe 105 PID 240 wrote to memory of 3448 240 dwdsrngt.exe 106 PID 2252 wrote to memory of 3364 2252 dwdsrngt.exe 107 PID 3448 wrote to memory of 3548 3448 dwdsrngt.exe 108 PID 3364 wrote to memory of 2708 3364 dwdsrngt.exe 109 PID 3548 wrote to memory of 5704 3548 dwdsrngt.exe 110 PID 2708 wrote to memory of 1080 2708 dwdsrngt.exe 111 PID 5704 wrote to memory of 2836 5704 dwdsrngt.exe 112 PID 1080 wrote to memory of 3524 1080 dwdsrngt.exe 113 PID 2836 wrote to memory of 4688 2836 dwdsrngt.exe 114 PID 3524 wrote to memory of 4940 3524 dwdsrngt.exe 115 PID 4688 wrote to memory of 4464 4688 dwdsrngt.exe 116 PID 4940 wrote to memory of 4244 4940 dwdsrngt.exe 117 PID 4464 wrote to memory of 4584 4464 dwdsrngt.exe 118 PID 4244 wrote to memory of 5572 4244 dwdsrngt.exe 119 PID 4584 wrote to memory of 2100 4584 dwdsrngt.exe 120 PID 5572 wrote to memory of 4636 5572 dwdsrngt.exe 121 PID 2100 wrote to memory of 932 2100 dwdsrngt.exe 122 PID 4636 wrote to memory of 6064 4636 dwdsrngt.exe 123 PID 932 wrote to memory of 1240 932 dwdsrngt.exe 124 PID 6064 wrote to memory of 1060 6064 dwdsrngt.exe 125 PID 1240 wrote to memory of 3748 1240 dwdsrngt.exe 126 PID 1060 wrote to memory of 5800 1060 dwdsrngt.exe 127 PID 3748 wrote to memory of 2388 3748 dwdsrngt.exe 128 PID 5800 wrote to memory of 3292 5800 dwdsrngt.exe 129 PID 2388 wrote to memory of 5656 2388 dwdsrngt.exe 130 PID 3292 wrote to memory of 1044 3292 dwdsrngt.exe 131 PID 5656 wrote to memory of 824 5656 dwdsrngt.exe 132 PID 1044 wrote to memory of 1508 1044 dwdsrngt.exe 133 PID 824 wrote to memory of 3500 824 dwdsrngt.exe 134 PID 1508 wrote to memory of 752 1508 dwdsrngt.exe 135 PID 3500 wrote to memory of 1584 3500 dwdsrngt.exe 136 PID 752 wrote to memory of 4784 752 dwdsrngt.exe 137 PID 1584 wrote to memory of 4252 1584 dwdsrngt.exe 138 PID 4784 wrote to memory of 5984 4784 dwdsrngt.exe 139 PID 4252 wrote to memory of 5300 4252 dwdsrngt.exe 140 PID 5984 wrote to memory of 2956 5984 dwdsrngt.exe 141 PID 5300 wrote to memory of 2964 5300 dwdsrngt.exe 142 PID 2956 wrote to memory of 4768 2956 dwdsrngt.exe 143 PID 2964 wrote to memory of 3340 2964 dwdsrngt.exe 144 PID 4768 wrote to memory of 4364 4768 dwdsrngt.exe 145 PID 3340 wrote to memory of 4760 3340 dwdsrngt.exe 146 PID 4364 wrote to memory of 3112 4364 dwdsrngt.exe 147 PID 4760 wrote to memory of 820 4760 dwdsrngt.exe 148 PID 3112 wrote to memory of 5268 3112 dwdsrngt.exe 149 PID 820 wrote to memory of 5272 820 dwdsrngt.exe 150 PID 5268 wrote to memory of 5480 5268 dwdsrngt.exe 151 PID 5272 wrote to memory of 1900 5272 dwdsrngt.exe 152 PID 5480 wrote to memory of 1404 5480 dwdsrngt.exe 153 PID 1900 wrote to memory of 4192 1900 dwdsrngt.exe 154 PID 1404 wrote to memory of 5048 1404 dwdsrngt.exe 155 PID 4192 wrote to memory of 5104 4192 dwdsrngt.exe 156 PID 5048 wrote to memory of 5044 5048 dwdsrngt.exe 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f69f77b95bb60ab53d1b68e77b5f5b73_elex_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0012⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0013⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0014⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0015⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0016⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0017⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0018⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD0019⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00110⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00111⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00112⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00113⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00114⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00115⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00116⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00117⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00118⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00119⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00120⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00121⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5656 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00122⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00123⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00124⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00125⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00126⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5300 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00127⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00128⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00129⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00130⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00131⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5272 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00132⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00133⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00134⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00135⤵PID:1424
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00136⤵PID:5632
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00137⤵PID:2644
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00138⤵
- Modifies registry class
PID:4808 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00139⤵
- Modifies registry class
PID:3360 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00140⤵
- System Location Discovery: System Language Discovery
PID:5900 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00141⤵PID:3476
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00142⤵PID:5716
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00143⤵
- Modifies registry class
PID:1316 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00144⤵PID:4804
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00145⤵PID:2404
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00146⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
PID:1100 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00147⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:3084 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00148⤵
- Modifies registry class
PID:2588 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00149⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2420 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00150⤵
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00151⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00152⤵
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00153⤵PID:5328
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00154⤵
- Creates a file in the Startup directory
PID:3700 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00155⤵
- System Location Discovery: System Language Discovery
PID:3940 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00156⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:5976 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00157⤵PID:3976
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00158⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00159⤵
- Drops file in System32 directory
- Modifies registry class
PID:4644 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00160⤵
- Drops file in System32 directory
PID:4304 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00161⤵
- Modifies registry class
PID:5264 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00162⤵PID:1904
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00163⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:6096 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00164⤵
- Drops file in System32 directory
- Modifies registry class
PID:6036 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00165⤵PID:5068
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00166⤵PID:568
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00167⤵
- Modifies registry class
PID:5904 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00168⤵
- Creates a file in the Startup directory
PID:6072 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00169⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4736 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00170⤵PID:1860
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00171⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1432 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00172⤵
- Drops file in System32 directory
PID:1076 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00173⤵
- Drops file in System32 directory
- Modifies registry class
PID:5688 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00174⤵PID:5880
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00175⤵
- Drops file in System32 directory
PID:1160 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00176⤵PID:6048
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00177⤵
- Drops file in System32 directory
- Modifies registry class
PID:944 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00178⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5608 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00179⤵PID:4164
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00180⤵PID:4948
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00181⤵
- Drops file in System32 directory
PID:2572 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00182⤵
- Drops file in System32 directory
PID:1352 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00183⤵PID:3012
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00184⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4836 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00185⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:4196 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00186⤵
- System Location Discovery: System Language Discovery
PID:2872 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00187⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2468 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00188⤵PID:2192
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00189⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:4152 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00190⤵
- System Location Discovery: System Language Discovery
PID:5160 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00191⤵
- Creates a file in the Startup directory
PID:1652 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00192⤵PID:1148
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00193⤵PID:4696
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00194⤵
- Modifies registry class
PID:2536 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00195⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
PID:2268 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00196⤵
- Modifies registry class
PID:4240 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00197⤵
- Creates a file in the Startup directory
PID:3088 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00198⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5960 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD00199⤵
- Drops file in System32 directory
- Modifies registry class
PID:3440 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001100⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
PID:1472 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001101⤵
- System Location Discovery: System Language Discovery
PID:8 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001102⤵
- Drops file in System32 directory
- Modifies registry class
PID:1632 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001103⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
PID:5504 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001104⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- Modifies registry class
PID:784 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001105⤵
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001106⤵
- System Location Discovery: System Language Discovery
PID:4788 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001107⤵PID:3896
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001108⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4128 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001109⤵
- Modifies registry class
PID:1420 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001110⤵PID:5840
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001111⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1772 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001112⤵
- Creates a file in the Startup directory
- Modifies registry class
PID:4628 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001113⤵PID:4868
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001114⤵PID:596
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001115⤵
- Creates a file in the Startup directory
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001116⤵
- Creates a file in the Startup directory
PID:4552 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001117⤵
- Drops file in System32 directory
PID:4388 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001118⤵PID:1504
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001119⤵PID:5428
-
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001120⤵
- Creates a file in the Startup directory
PID:1612 -
\??\c:\windows\SysWOW64\dwdsrngt.exec:\windows\system32\dwdsrngt.exe CHD001121⤵
- Creates a file in the Startup directory
PID:1008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-