Overview

overview

8

Static

static

3

2026-04-20...ry.exe

windows10-2004-x64

8

2026-04-20...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/04/2026, 11:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe
  • Size 532KB
  • Sample260420-m7d1yscv4x
  • SHA256 4811a34171c40e4b914174e5b1e175c9b1fa4361849a325a8b984354736f323f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 4 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Drops file in System32 directory 55 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\windows\system\gyak.exe
      "C:\windows\system\gyak.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"
      2⤵
      • Drops file in Drivers directory
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:4136
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3860
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:2968
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:4000
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4784
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1548
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3068
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:4464
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4988
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5072
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3416
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3092
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:3852
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2272
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:800
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:1528
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:3156
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        PID:1756
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1068
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4016
      • C:\windows\SysWOW64\sodwmubu.exe
        "C:\windows\system32\sodwmubu.exe"
        3⤵
          PID:228
        • C:\windows\SysWOW64\sodwmubu.exe
          "C:\windows\system32\sodwmubu.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:4320
        • C:\windows\SysWOW64\sodwmubu.exe
          "C:\windows\system32\sodwmubu.exe"
          3⤵
            PID:4336
          • C:\windows\SysWOW64\sodwmubu.exe
            "C:\windows\system32\sodwmubu.exe"
            3⤵
              PID:1920
            • C:\windows\SysWOW64\sodwmubu.exe
              "C:\windows\system32\sodwmubu.exe"
              3⤵
                PID:3712
              • C:\windows\SysWOW64\sodwmubu.exe
                "C:\windows\system32\sodwmubu.exe"
                3⤵
                  PID:3516
                • C:\windows\SysWOW64\sodwmubu.exe
                  "C:\windows\system32\sodwmubu.exe"
                  3⤵
                    PID:1020
                  • C:\windows\SysWOW64\sodwmubu.exe
                    "C:\windows\system32\sodwmubu.exe"
                    3⤵
                      PID:1768
                    • C:\windows\SysWOW64\sodwmubu.exe
                      "C:\windows\system32\sodwmubu.exe"
                      3⤵
                        PID:4576
                      • C:\windows\SysWOW64\sodwmubu.exe
                        "C:\windows\system32\sodwmubu.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:1660
                      • C:\windows\SysWOW64\sodwmubu.exe
                        "C:\windows\system32\sodwmubu.exe"
                        3⤵
                          PID:868
                        • C:\windows\SysWOW64\sodwmubu.exe
                          "C:\windows\system32\sodwmubu.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:388
                        • C:\windows\SysWOW64\sodwmubu.exe
                          "C:\windows\system32\sodwmubu.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:4964
                        • C:\windows\SysWOW64\sodwmubu.exe
                          "C:\windows\system32\sodwmubu.exe"
                          3⤵
                            PID:2632
                          • C:\windows\SysWOW64\sodwmubu.exe
                            "C:\windows\system32\sodwmubu.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2404
                          • C:\windows\SysWOW64\sodwmubu.exe
                            "C:\windows\system32\sodwmubu.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4656
                          • C:\windows\SysWOW64\sodwmubu.exe
                            "C:\windows\system32\sodwmubu.exe"
                            3⤵
                              PID:1484
                            • C:\windows\SysWOW64\sodwmubu.exe
                              "C:\windows\system32\sodwmubu.exe"
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:5004
                            • C:\windows\SysWOW64\sodwmubu.exe
                              "C:\windows\system32\sodwmubu.exe"
                              3⤵
                                PID:2164
                              • C:\windows\SysWOW64\sodwmubu.exe
                                "C:\windows\system32\sodwmubu.exe"
                                3⤵
                                  PID:4196
                                • C:\windows\SysWOW64\sodwmubu.exe
                                  "C:\windows\system32\sodwmubu.exe"
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4608
                                • C:\windows\SysWOW64\sodwmubu.exe
                                  "C:\windows\system32\sodwmubu.exe"
                                  3⤵
                                    PID:4408
                                  • C:\windows\SysWOW64\sodwmubu.exe
                                    "C:\windows\system32\sodwmubu.exe"
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1980
                                  • C:\windows\SysWOW64\sodwmubu.exe
                                    "C:\windows\system32\sodwmubu.exe"
                                    3⤵
                                      PID:1312
                                    • C:\windows\SysWOW64\sodwmubu.exe
                                      "C:\windows\system32\sodwmubu.exe"
                                      3⤵
                                        PID:4456
                                      • C:\windows\SysWOW64\sodwmubu.exe
                                        "C:\windows\system32\sodwmubu.exe"
                                        3⤵
                                          PID:4640
                                        • C:\windows\SysWOW64\sodwmubu.exe
                                          "C:\windows\system32\sodwmubu.exe"
                                          3⤵
                                            PID:1632
                                        • C:\windows\SysWOW64\sodwmubu.exe
                                          "C:\windows\system32\sodwmubu.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"
                                          2⤵
                                          • Drops file in Drivers directory
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Drops file in System32 directory
                                          • Drops file in Windows directory
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:1380
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1324
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2072
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:4528
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:4252
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:3524
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:3264
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:4860
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:3708
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:3208
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:3568
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2052
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:4420
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:3312
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:4568
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2076
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1524
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:3408
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2204
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2828
                                          • C:\windows\SysWOW64\sodwmubu.exe
                                            "C:\windows\system32\sodwmubu.exe"
                                            3⤵
                                              PID:3748
                                            • C:\windows\SysWOW64\sodwmubu.exe
                                              "C:\windows\system32\sodwmubu.exe"
                                              3⤵
                                                PID:4672
                                              • C:\windows\SysWOW64\sodwmubu.exe
                                                "C:\windows\system32\sodwmubu.exe"
                                                3⤵
                                                  PID:3888
                                                • C:\windows\SysWOW64\sodwmubu.exe
                                                  "C:\windows\system32\sodwmubu.exe"
                                                  3⤵
                                                    PID:2388
                                                  • C:\windows\SysWOW64\sodwmubu.exe
                                                    "C:\windows\system32\sodwmubu.exe"
                                                    3⤵
                                                      PID:2476
                                                    • C:\windows\SysWOW64\sodwmubu.exe
                                                      "C:\windows\system32\sodwmubu.exe"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5108
                                                    • C:\windows\SysWOW64\sodwmubu.exe
                                                      "C:\windows\system32\sodwmubu.exe"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1652
                                                    • C:\windows\SysWOW64\sodwmubu.exe
                                                      "C:\windows\system32\sodwmubu.exe"
                                                      3⤵
                                                        PID:3848
                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                        "C:\windows\system32\sodwmubu.exe"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4860
                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                        "C:\windows\system32\sodwmubu.exe"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:460
                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                        "C:\windows\system32\sodwmubu.exe"
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3384
                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                        "C:\windows\system32\sodwmubu.exe"
                                                        3⤵
                                                          PID:3396
                                                        • C:\windows\SysWOW64\sodwmubu.exe
                                                          "C:\windows\system32\sodwmubu.exe"
                                                          3⤵
                                                            PID:1716
                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                            "C:\windows\system32\sodwmubu.exe"
                                                            3⤵
                                                              PID:2988
                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                              "C:\windows\system32\sodwmubu.exe"
                                                              3⤵
                                                                PID:2200
                                                              • C:\windows\SysWOW64\sodwmubu.exe
                                                                "C:\windows\system32\sodwmubu.exe"
                                                                3⤵
                                                                  PID:2564
                                                                • C:\windows\SysWOW64\sodwmubu.exe
                                                                  "C:\windows\system32\sodwmubu.exe"
                                                                  3⤵
                                                                    PID:5008
                                                                  • C:\windows\SysWOW64\sodwmubu.exe
                                                                    "C:\windows\system32\sodwmubu.exe"
                                                                    3⤵
                                                                      PID:2068
                                                                    • C:\windows\SysWOW64\sodwmubu.exe
                                                                      "C:\windows\system32\sodwmubu.exe"
                                                                      3⤵
                                                                        PID:3156
                                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                                        "C:\windows\system32\sodwmubu.exe"
                                                                        3⤵
                                                                          PID:5092
                                                                        • C:\windows\SysWOW64\sodwmubu.exe
                                                                          "C:\windows\system32\sodwmubu.exe"
                                                                          3⤵
                                                                            PID:2148
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1016
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            3⤵
                                                                              PID:4016
                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:944
                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4320
                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:2708
                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                              3⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1808
                                                                          • C:\windows\dlivv.exe
                                                                            "C:\windows\dlivv.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:4880
                                                                        • \??\c:\windows\system\gyak.exe
                                                                          c:\windows\system\gyak.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:1560
                                                                        • \??\c:\windows\dlivv.exe
                                                                          c:\windows\dlivv.exe
                                                                          1⤵
                                                                          • Drops file in Drivers directory
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • Drops file in System32 directory
                                                                          • Drops file in Windows directory
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3100
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:4160
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3972
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5108
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:4344
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2676
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:3284
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1844
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:5052
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:484
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3252
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1120
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3872
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:1840
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3884
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            PID:848
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4644
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3292
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:956
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:776
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:5016
                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                            2⤵
                                                                              PID:652
                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1376
                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                              2⤵
                                                                                PID:2880
                                                                              • C:\windows\SysWOW64\sodwmubu.exe
                                                                                "C:\windows\system32\sodwmubu.exe"
                                                                                2⤵
                                                                                  PID:3956
                                                                                • C:\windows\SysWOW64\sodwmubu.exe
                                                                                  "C:\windows\system32\sodwmubu.exe"
                                                                                  2⤵
                                                                                    PID:2176
                                                                                  • C:\windows\SysWOW64\sodwmubu.exe
                                                                                    "C:\windows\system32\sodwmubu.exe"
                                                                                    2⤵
                                                                                      PID:4524
                                                                                    • C:\windows\SysWOW64\sodwmubu.exe
                                                                                      "C:\windows\system32\sodwmubu.exe"
                                                                                      2⤵
                                                                                        PID:3524
                                                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                                                        "C:\windows\system32\sodwmubu.exe"
                                                                                        2⤵
                                                                                          PID:3068
                                                                                        • C:\windows\SysWOW64\sodwmubu.exe
                                                                                          "C:\windows\system32\sodwmubu.exe"
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4488
                                                                                        • C:\windows\SysWOW64\sodwmubu.exe
                                                                                          "C:\windows\system32\sodwmubu.exe"
                                                                                          2⤵
                                                                                            PID:664
                                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4248
                                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                                            2⤵
                                                                                              PID:4816
                                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                                              2⤵
                                                                                                PID:4720
                                                                                              • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                "C:\windows\system32\sodwmubu.exe"
                                                                                                2⤵
                                                                                                  PID:840
                                                                                                • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                  "C:\windows\system32\sodwmubu.exe"
                                                                                                  2⤵
                                                                                                    PID:4984
                                                                                                  • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                    "C:\windows\system32\sodwmubu.exe"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1076
                                                                                                  • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                    "C:\windows\system32\sodwmubu.exe"
                                                                                                    2⤵
                                                                                                      PID:3188
                                                                                                    • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                      "C:\windows\system32\sodwmubu.exe"
                                                                                                      2⤵
                                                                                                        PID:4424
                                                                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                        "C:\windows\system32\sodwmubu.exe"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3408
                                                                                                      • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                        "C:\windows\system32\sodwmubu.exe"
                                                                                                        2⤵
                                                                                                          PID:1720
                                                                                                        • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                          "C:\windows\system32\sodwmubu.exe"
                                                                                                          2⤵
                                                                                                            PID:1068
                                                                                                          • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                            "C:\windows\system32\sodwmubu.exe"
                                                                                                            2⤵
                                                                                                              PID:244
                                                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:1560
                                                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2408
                                                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:3172
                                                                                                            • C:\windows\SysWOW64\sodwmubu.exe
                                                                                                              "C:\windows\system32\sodwmubu.exe"
                                                                                                              2⤵
                                                                                                                PID:2092

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exegyak.exe_
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\2026-04-20_00697bd7c2e1ebc05814409c94255895_elex_wannacry.exegyak.exe_
                                                                                                                  • Size 824KB
                                                                                                                  • SHA256 c8d92651367eb1d441fab3c48621c6742e4b48d50d56265749a124e048600943
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  RCX55DD.tmp
                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\RCX55DD.tmp
                                                                                                                  • Size 532KB
                                                                                                                  • SHA256 cc5cab56dca8cc1c75ad7566afa661a23293503a40853218ecbcc680418424e5
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  sodwmubu.exe
                                                                                                                  • Path C:\Windows\SysWOW64\sodwmubu.exe
                                                                                                                  • Size 629KB
                                                                                                                  • SHA256 c6f78704b405116813d2baac7625dcdc927c1fb9f5d37a18ada47c9fb78eff66
                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                  Submit Download

                                                                                                                  memory/484-267-0x0000000000AC0000-0x0000000000AE5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/776-335-0x00000000006F0000-0x0000000000715000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/800-308-0x00000000006C0000-0x00000000006E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/848-309-0x0000000000710000-0x0000000000735000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/956-330-0x00000000006B0000-0x00000000006D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1068-334-0x0000000000810000-0x0000000000835000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1120-282-0x0000000000A10000-0x0000000000A35000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1324-215-0x0000000000620000-0x0000000000645000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1380-228-0x00000000005E0000-0x0000000000605000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1524-320-0x00000000008D0000-0x00000000008F5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1528-314-0x00000000006C0000-0x00000000006E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1548-245-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1560-208-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1756-329-0x00000000008B0000-0x00000000008D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1800-205-0x0000000000B30000-0x0000000000B55000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1840-297-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/1844-255-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2052-284-0x00000000005C0000-0x00000000005E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2072-221-0x0000000000A00000-0x0000000000A25000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2076-311-0x00000000008B0000-0x00000000008D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2204-332-0x00000000006B0000-0x00000000006D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2272-302-0x0000000000700000-0x0000000000725000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2676-240-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2828-339-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2884-227-0x0000000000AE0000-0x0000000000B05000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/2968-224-0x00000000006B0000-0x00000000006D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3068-254-0x00000000008C0000-0x00000000008E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3092-287-0x00000000008B0000-0x00000000008D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3100-231-0x00000000005F0000-0x0000000000615000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3156-323-0x00000000007B0000-0x00000000007D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3208-269-0x00000000008C0000-0x00000000008E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3252-276-0x00000000006F0000-0x0000000000715000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3264-251-0x0000000000800000-0x0000000000825000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3284-246-0x0000000000A10000-0x0000000000A35000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3292-324-0x0000000000700000-0x0000000000725000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3312-299-0x00000000005F0000-0x0000000000615000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3408-326-0x0000000000C20000-0x0000000000C45000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3416-281-0x00000000008B0000-0x00000000008D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3524-243-0x0000000000A10000-0x0000000000A35000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3568-278-0x00000000008D0000-0x00000000008F5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3708-263-0x0000000000A10000-0x0000000000A35000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3852-293-0x0000000000A10000-0x0000000000A35000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3860-218-0x00000000006B0000-0x00000000006D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3872-288-0x0000000000A00000-0x0000000000A25000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3884-303-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/3972-219-0x0000000000A20000-0x0000000000A45000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4000-233-0x0000000000640000-0x0000000000665000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4016-342-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4136-211-0x00000000007E0000-0x0000000000805000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4160-213-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4252-236-0x0000000000A20000-0x0000000000A45000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4344-234-0x0000000000A20000-0x0000000000A45000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4420-290-0x00000000005D0000-0x00000000005F5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4464-260-0x00000000006B0000-0x00000000006D5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4528-229-0x0000000000A00000-0x0000000000A25000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4568-305-0x0000000000630000-0x0000000000655000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4644-315-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4784-239-0x0000000000710000-0x0000000000735000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4860-257-0x0000000000620000-0x0000000000645000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4880-212-0x00000000008C0000-0x00000000008E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/4988-266-0x00000000006C0000-0x00000000006E5000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5052-261-0x00000000009F0000-0x0000000000A15000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5072-274-0x00000000006F0000-0x0000000000715000-memory.dmp
                                                                                                                  Download

                                                                                                                  memory/5108-225-0x00000000007D0000-0x00000000007F5000-memory.dmp
                                                                                                                  Download