Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 11:03
General
- Target 2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exe
- Size 629KB
- Sample260415-m56cese17t
- SHA256 5cc3af592d94433f64960895d654fe923aa440b45cdf90cc05e703ec14b67918
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 4 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Drops file in System32 directory 55 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\system\jyqucr.exe"C:\windows\system\jyqucr.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"3⤵
-
-
-
C:\windows\mwyqvoc.exe"C:\windows\mwyqvoc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\windows\system\jyqucr.exec:\windows\system\jyqucr.exe1⤵
- Executes dropped EXE
-
\??\c:\windows\mwyqvoc.exec:\windows\mwyqvoc.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
-
-
C:\windows\SysWOW64\ogvqqxrc.exe"C:\windows\system32\ogvqqxrc.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-15_74bc66dd0aecf08e38be756c1128de3b_elex_wannacry.exejyqucr.exe_
ogvqqxrc.exe
memory/400-302-0x0000000000A10000-0x0000000000B5D000-memory.dmp
memory/484-289-0x0000000000AA0000-0x0000000000BED000-memory.dmp
memory/580-280-0x0000000000B40000-0x0000000000C8D000-memory.dmp
memory/600-312-0x0000000000900000-0x0000000000A4D000-memory.dmp
memory/716-226-0x00000000009F0000-0x0000000000B3D000-memory.dmp
memory/732-310-0x00000000009E0000-0x0000000000B2D000-memory.dmp
memory/912-307-0x00000000009F0000-0x0000000000B3D000-memory.dmp
memory/1012-341-0x0000000000BA0000-0x0000000000CED000-memory.dmp
memory/1016-317-0x00000000008E0000-0x0000000000A2D000-memory.dmp
memory/1060-284-0x0000000000DE0000-0x0000000000F2D000-memory.dmp
memory/1092-218-0x00000000009F0000-0x0000000000B3D000-memory.dmp
memory/1324-256-0x0000000000A10000-0x0000000000B5D000-memory.dmp
memory/1348-333-0x0000000000B60000-0x0000000000CAD000-memory.dmp
memory/1372-324-0x0000000000950000-0x0000000000A9D000-memory.dmp
memory/1468-262-0x00000000008A0000-0x00000000009ED000-memory.dmp
memory/1472-215-0x00000000008C0000-0x0000000000A0D000-memory.dmp
memory/1476-211-0x00000000008A0000-0x00000000009ED000-memory.dmp
memory/1656-259-0x0000000000900000-0x0000000000A4D000-memory.dmp
memory/1676-227-0x0000000000A00000-0x0000000000B4D000-memory.dmp
memory/1748-232-0x00000000008D0000-0x0000000000A1D000-memory.dmp
memory/1752-321-0x0000000000920000-0x0000000000A6D000-memory.dmp
memory/1888-313-0x0000000000B50000-0x0000000000C9D000-memory.dmp
memory/1920-249-0x0000000000A00000-0x0000000000B4D000-memory.dmp
memory/1924-228-0x00000000008A0000-0x00000000009ED000-memory.dmp
memory/2124-252-0x0000000000A80000-0x0000000000BCD000-memory.dmp
memory/2144-334-0x0000000000A30000-0x0000000000B7D000-memory.dmp
memory/2184-294-0x0000000000920000-0x0000000000A6D000-memory.dmp
memory/2320-213-0x00000000008B0000-0x00000000009FD000-memory.dmp
memory/2388-205-0x0000000000A00000-0x0000000000B4D000-memory.dmp
memory/2404-327-0x0000000000A50000-0x0000000000B9D000-memory.dmp
memory/2436-298-0x0000000000960000-0x0000000000AAD000-memory.dmp
memory/2552-236-0x00000000008B0000-0x00000000009FD000-memory.dmp
memory/2588-229-0x0000000000950000-0x0000000000A9D000-memory.dmp
memory/2704-338-0x0000000000A40000-0x0000000000B8D000-memory.dmp
memory/2756-328-0x00000000009E0000-0x0000000000B2D000-memory.dmp
memory/2832-306-0x0000000000A10000-0x0000000000B5D000-memory.dmp
memory/3140-268-0x0000000000A50000-0x0000000000B9D000-memory.dmp
memory/3164-330-0x0000000000A20000-0x0000000000B6D000-memory.dmp
memory/3172-221-0x0000000000940000-0x0000000000A8D000-memory.dmp
memory/3184-279-0x00000000009A0000-0x0000000000AED000-memory.dmp
memory/3224-283-0x0000000000BB0000-0x0000000000CFD000-memory.dmp
memory/3296-240-0x0000000000B50000-0x0000000000C9D000-memory.dmp
memory/3328-219-0x00000000008B0000-0x00000000009FD000-memory.dmp
memory/3444-277-0x00000000009E0000-0x0000000000B2D000-memory.dmp
memory/3508-322-0x0000000000980000-0x0000000000ACD000-memory.dmp
memory/3652-247-0x0000000000D80000-0x0000000000ECD000-memory.dmp
memory/3672-243-0x0000000000900000-0x0000000000A4D000-memory.dmp
memory/3728-264-0x00000000008A0000-0x00000000009ED000-memory.dmp
memory/3792-274-0x0000000000940000-0x0000000000A8D000-memory.dmp
memory/3888-286-0x00000000008C0000-0x0000000000A0D000-memory.dmp
memory/3988-244-0x0000000000910000-0x0000000000A5D000-memory.dmp
memory/4100-238-0x00000000008D0000-0x0000000000A1D000-memory.dmp
memory/4156-224-0x00000000008D0000-0x0000000000A1D000-memory.dmp
memory/4352-258-0x00000000008C0000-0x0000000000A0D000-memory.dmp
memory/4356-235-0x0000000000930000-0x0000000000A7D000-memory.dmp
memory/4436-231-0x00000000008A0000-0x00000000009ED000-memory.dmp
memory/4456-304-0x00000000008B0000-0x00000000009FD000-memory.dmp
memory/4472-265-0x0000000000A60000-0x0000000000BAD000-memory.dmp
memory/4536-208-0x00000000008D0000-0x0000000000A1D000-memory.dmp
memory/4544-299-0x0000000000910000-0x0000000000A5D000-memory.dmp
memory/4576-335-0x0000000000A30000-0x0000000000B7D000-memory.dmp
memory/5072-212-0x0000000000910000-0x0000000000A5D000-memory.dmp
memory/5084-291-0x00000000009E0000-0x0000000000B2D000-memory.dmp
memory/5088-270-0x00000000008B0000-0x00000000009FD000-memory.dmp