Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 12:33
General
- Target 2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exe
- Size 824KB
- Sample260415-prk6fag13s
- SHA256 6cf6caae9a0753a12a355a40b34f4b3b6ec5918c263755a717a3f4f4b4a3b867
Malware Config
Signatures
- Drops file in Drivers directory 4 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Drops file in System32 directory 55 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\system\msbsu.exe"C:\windows\system\msbsu.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"3⤵
-
-
-
C:\windows\nqfrtvk.exe"C:\windows\nqfrtvk.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\windows\nqfrtvk.exec:\windows\nqfrtvk.exe1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\ujexsw.exe"C:\windows\system32\ujexsw.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
\??\c:\windows\system\msbsu.exec:\windows\system\msbsu.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-15_f3ac7b12063ff3136f4830de8af4e7cd_elex_wannacry.exemsbsu.exe_
ujexsw.exe
nqfrtvk.exe
memory/396-298-0x00000000007A0000-0x0000000000836000-memory.dmp
memory/440-316-0x00000000009A0000-0x0000000000A36000-memory.dmp
memory/752-267-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/780-336-0x0000000000930000-0x00000000009C6000-memory.dmp
memory/1072-309-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/1216-231-0x0000000000860000-0x00000000008F6000-memory.dmp
memory/1288-312-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/1292-285-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/1372-235-0x00000000008B0000-0x0000000000946000-memory.dmp
memory/1408-220-0x0000000000950000-0x00000000009E6000-memory.dmp
memory/1668-222-0x0000000000760000-0x00000000007F6000-memory.dmp
memory/1808-331-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/2112-230-0x00000000005B0000-0x0000000000646000-memory.dmp
memory/2152-268-0x0000000000880000-0x0000000000916000-memory.dmp
memory/2176-225-0x00000000005C0000-0x0000000000656000-memory.dmp
memory/2312-247-0x0000000000850000-0x00000000008E6000-memory.dmp
memory/2484-255-0x0000000000970000-0x0000000000A06000-memory.dmp
memory/2536-282-0x0000000000920000-0x00000000009B6000-memory.dmp
memory/2600-240-0x0000000000870000-0x0000000000906000-memory.dmp
memory/2696-229-0x0000000000820000-0x00000000008B6000-memory.dmp
memory/2712-303-0x0000000000590000-0x0000000000626000-memory.dmp
memory/2716-261-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/2856-234-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/2944-214-0x0000000000970000-0x0000000000A06000-memory.dmp
memory/3084-340-0x00000000006E0000-0x0000000000776000-memory.dmp
memory/3268-209-0x00000000008A0000-0x0000000000936000-memory.dmp
memory/3424-246-0x0000000000820000-0x00000000008B6000-memory.dmp
memory/3448-288-0x00000000005F0000-0x0000000000686000-memory.dmp
memory/3472-310-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/3780-212-0x00000000006C0000-0x0000000000756000-memory.dmp
memory/3928-228-0x0000000000830000-0x00000000008C6000-memory.dmp
memory/4084-219-0x0000000000650000-0x00000000006E6000-memory.dmp
memory/4136-226-0x00000000006F0000-0x0000000000786000-memory.dmp
memory/4152-262-0x0000000000860000-0x00000000008F6000-memory.dmp
memory/4428-264-0x00000000007C0000-0x0000000000856000-memory.dmp
memory/4536-277-0x0000000000630000-0x00000000006C6000-memory.dmp
memory/4568-243-0x00000000006B0000-0x0000000000746000-memory.dmp
memory/4608-216-0x0000000000710000-0x00000000007A6000-memory.dmp
memory/4836-270-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/4864-283-0x00000000007E0000-0x0000000000876000-memory.dmp
memory/4896-241-0x00000000008F0000-0x0000000000986000-memory.dmp
memory/4924-275-0x0000000000960000-0x00000000009F6000-memory.dmp
memory/5096-213-0x00000000007E0000-0x0000000000876000-memory.dmp
memory/5100-205-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/5100-206-0x0000000004D50000-0x0000000004FE1000-memory.dmp
memory/5112-325-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/5160-251-0x0000000000630000-0x00000000006C6000-memory.dmp
memory/5228-289-0x0000000000920000-0x00000000009B6000-memory.dmp
memory/5440-304-0x00000000007A0000-0x0000000000836000-memory.dmp
memory/5476-306-0x0000000000900000-0x0000000000996000-memory.dmp
memory/5632-335-0x00000000007C0000-0x0000000000856000-memory.dmp
memory/5692-324-0x0000000000800000-0x0000000000896000-memory.dmp
memory/5712-258-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/5724-300-0x00000000005C0000-0x0000000000656000-memory.dmp
memory/5764-256-0x00000000007A0000-0x0000000000836000-memory.dmp
memory/5832-279-0x0000000000620000-0x00000000006B6000-memory.dmp
memory/5892-291-0x0000000000590000-0x0000000000626000-memory.dmp
memory/5904-333-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/5960-321-0x0000000000830000-0x00000000008C6000-memory.dmp
memory/5980-237-0x0000000000850000-0x00000000008E6000-memory.dmp
memory/5992-297-0x00000000007A0000-0x0000000000836000-memory.dmp
memory/6036-327-0x0000000000860000-0x00000000008F6000-memory.dmp
memory/6108-315-0x00000000006F0000-0x0000000000786000-memory.dmp
memory/6124-330-0x0000000000590000-0x0000000000626000-memory.dmp