Analysis
- max time kernel
149s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 11:06
General
- Target 2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe
- Size 532KB
- Sample260420-m7d1yscv4x
- SHA256 4811a34171c40e4b914174e5b1e175c9b1fa4361849a325a8b984354736f323f
Malware Config
Signatures
- Drops file in Drivers directory 4 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Drops file in System32 directory 55 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\system\gyak.exe"C:\windows\system\gyak.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\windows\dlivv.exe"C:\windows\dlivv.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\windows\system\gyak.exec:\windows\system\gyak.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\windows\dlivv.exec:\windows\dlivv.exe1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\sodwmubu.exe"C:\windows\system32\sodwmubu.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exegyak.exe_
RCX433.tmp
sodwmubu.exe
dlivv.exe
memory/112-268-0x00000000008F0000-0x0000000000986000-memory.dmp
memory/364-228-0x0000000000600000-0x0000000000696000-memory.dmp
memory/388-205-0x0000000000A60000-0x0000000000AF6000-memory.dmp
memory/432-286-0x0000000000720000-0x00000000007B6000-memory.dmp
memory/772-289-0x00000000007B0000-0x0000000000846000-memory.dmp
memory/948-232-0x0000000000580000-0x0000000000616000-memory.dmp
memory/1176-321-0x0000000000950000-0x00000000009E6000-memory.dmp
memory/1280-334-0x0000000000940000-0x00000000009D6000-memory.dmp
memory/1356-277-0x0000000000790000-0x0000000000826000-memory.dmp
memory/1388-301-0x0000000000930000-0x00000000009C6000-memory.dmp
memory/1392-262-0x0000000000940000-0x00000000009D6000-memory.dmp
memory/1508-241-0x0000000000830000-0x00000000008C6000-memory.dmp
memory/1648-280-0x0000000000820000-0x00000000008B6000-memory.dmp
memory/1848-300-0x0000000000880000-0x0000000000916000-memory.dmp
memory/1996-294-0x00000000007B0000-0x0000000000846000-memory.dmp
memory/2068-265-0x00000000005E0000-0x0000000000676000-memory.dmp
memory/2352-235-0x0000000000840000-0x00000000008D6000-memory.dmp
memory/2484-325-0x0000000000950000-0x00000000009E6000-memory.dmp
memory/2600-291-0x0000000000580000-0x0000000000616000-memory.dmp
memory/2724-340-0x0000000000910000-0x00000000009A6000-memory.dmp
memory/2824-253-0x00000000006B0000-0x0000000000746000-memory.dmp
memory/2904-211-0x0000000000850000-0x00000000008E6000-memory.dmp
memory/3008-310-0x0000000000700000-0x0000000000796000-memory.dmp
memory/3024-251-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/3128-220-0x0000000000930000-0x00000000009C6000-memory.dmp
memory/3160-231-0x0000000000850000-0x00000000008E6000-memory.dmp
memory/3184-217-0x0000000000580000-0x0000000000616000-memory.dmp
memory/3200-226-0x0000000000870000-0x0000000000906000-memory.dmp
memory/3328-223-0x00000000008F0000-0x0000000000986000-memory.dmp
memory/3340-215-0x00000000007E0000-0x0000000000876000-memory.dmp
memory/3508-312-0x0000000000980000-0x0000000000A16000-memory.dmp
memory/3640-319-0x0000000000820000-0x00000000008B6000-memory.dmp
memory/3676-327-0x00000000007B0000-0x0000000000846000-memory.dmp
memory/3708-259-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/3780-214-0x00000000007B0000-0x0000000000846000-memory.dmp
memory/3828-337-0x0000000000590000-0x0000000000626000-memory.dmp
memory/3936-341-0x0000000000970000-0x0000000000A06000-memory.dmp
memory/4008-225-0x0000000000790000-0x0000000000826000-memory.dmp
memory/4028-304-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/4036-221-0x00000000009A0000-0x0000000000A36000-memory.dmp
memory/4064-328-0x0000000000880000-0x0000000000916000-memory.dmp
memory/4284-249-0x00000000005D0000-0x0000000000666000-memory.dmp
memory/4352-210-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/4368-279-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/4384-243-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/4456-322-0x00000000007F0000-0x0000000000886000-memory.dmp
memory/4688-236-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/4904-298-0x00000000004B0000-0x0000000000546000-memory.dmp
memory/4968-244-0x00000000004B0000-0x0000000000546000-memory.dmp
memory/5204-257-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/5276-263-0x0000000000810000-0x00000000008A6000-memory.dmp
memory/5320-272-0x00000000007E0000-0x0000000000876000-memory.dmp
memory/5380-274-0x0000000000690000-0x0000000000726000-memory.dmp
memory/5408-285-0x00000000005D0000-0x0000000000666000-memory.dmp
memory/5480-283-0x0000000000580000-0x0000000000616000-memory.dmp
memory/5496-331-0x0000000000840000-0x00000000008D6000-memory.dmp
memory/5512-229-0x00000000008D0000-0x0000000000966000-memory.dmp
memory/5592-208-0x00000000006A0000-0x0000000000736000-memory.dmp
memory/5704-238-0x00000000005A0000-0x0000000000636000-memory.dmp
memory/5784-313-0x00000000004B0000-0x0000000000546000-memory.dmp
memory/5828-256-0x0000000000870000-0x0000000000906000-memory.dmp
memory/6104-307-0x0000000000600000-0x0000000000696000-memory.dmp
memory/6108-333-0x0000000000690000-0x0000000000726000-memory.dmp
memory/6120-306-0x0000000000830000-0x00000000008C6000-memory.dmp