Analysis
- max time kernel
72s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 16:11
Behavioral task
behavioral1
Sample
2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe
- Size 348KB
- Sample260731-tnelpsdb72
- SHA256 745fe861e6f02d969c421336cf3817541618cf2c6e698cacec1ee868ee0de906
- MD5 f17b5fceba088efe1219480690a15303
- SHA1 89e8086a1a85c6a382ada5df15d7be38d45abf45
- SHA512 32eec9725884158a67a007c11cbf57932f0b710755490ee3c0eb76d00992abcff0e39aaeb21e59ce1bfaf8ed6fdb54f783a989d4d013aaf24e22a4d655d3cab6
- SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0SS:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0W
- TLSH T14A74DF01BEE740F9EAF8003C20FB2776963B6898FB085FD36319EA751837555E632256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 41 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5b5-20.dat family_gh0strat behavioral2/memory/4352-49-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c5ba-45.dat family_gh0strat behavioral2/files/0x000d00000001c5b9-34.dat family_gh0strat behavioral2/memory/5168-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2488-71-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c5bf-72.dat family_gh0strat behavioral2/files/0x000d00000001c5c3-91.dat family_gh0strat behavioral2/files/0x000d00000001c5c6-115.dat family_gh0strat behavioral2/memory/4632-119-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c5ca-142.dat family_gh0strat behavioral2/memory/364-141-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5ce-163.dat family_gh0strat behavioral2/files/0x000c00000001c5d2-185.dat family_gh0strat behavioral2/memory/1336-188-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5d6-207.dat family_gh0strat behavioral2/files/0x000c00000001c5da-233.dat family_gh0strat behavioral2/memory/6084-232-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5e2-279.dat family_gh0strat behavioral2/files/0x000c00000001c5e6-302.dat family_gh0strat behavioral2/memory/4688-301-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5eb-321.dat family_gh0strat behavioral2/memory/2584-324-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4160-349-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2400-371-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5f3-368.dat family_gh0strat behavioral2/memory/3060-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2428-409-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6000-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3820-447-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5612-466-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4212-485-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/860-505-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5ef-345.dat family_gh0strat behavioral2/memory/1140-278-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5de-255.dat family_gh0strat behavioral2/memory/1396-254-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3056-211-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2476-165-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1196-95-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5168-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28E79705-9AD6-41d5-B5EA-A2653FE2B86B}\stubpath = "C:\\Windows\\system32\\inigtklnv.exe" intcrvwiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81D8ADF8-E2E4-4acf-A28E-AEF19D8A753D} ingfvhjng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FA9B5CD-CEDD-4d4b-9589-D2B95EDA026F} innajnacf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7371798-08A8-4200-B82F-FC27E4929A52} inqqspmro.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0ED088B-1D39-45e7-B3CF-7D703A20AA4D}\stubpath = "C:\\Windows\\system32\\ineupaato.exe" invzesqzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABC838E1-A5A4-4626-8692-871878305055}\stubpath = "C:\\Windows\\system32\\inlhzufqa.exe" iniszaxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28AB34EE-8806-490c-8046-91F4C8AB8A42}\stubpath = "C:\\Windows\\system32\\inuisngbw.exe" inisglpjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C27B59E9-1AAC-4573-8398-06677362DC13} ingwobgus.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25C85D18-2957-4043-85D8-08BFB80CC112} inytozkkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02B1CCCD-40BF-4436-8F5A-1FD542CE7367} inocokdvj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E08C7306-602A-4acb-B2CE-47341CF80D48}\stubpath = "C:\\Windows\\system32\\inbbkvfva.exe" inutvwllh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F5A0B5D-B17D-4052-B472-4FDBF156451A}\stubpath = "C:\\Windows\\system32\\inqmfrmyb.exe" inkbaivic.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36A2407F-E415-4d21-A50A-8E72FCB1FA46} inbrulkss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CC6839D-0273-4dc1-8405-32C1FACBB405}\stubpath = "C:\\Windows\\system32\\inqrgtvyi.exe" indvjzcoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2D53E6D-B72D-4839-811E-B50A4D785EF1} indpalewk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9594DAE7-93A1-4a23-AD78-547218A3DB70} inqklaasr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89DE237E-92CF-462a-BB26-2FA60B5EA0C4}\stubpath = "C:\\Windows\\system32\\injlxlxig.exe" inmnccutj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABC838E1-A5A4-4626-8692-871878305055} iniszaxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B482802D-7BC4-430a-98F2-97891AA4808C}\stubpath = "C:\\Windows\\system32\\invgvfzue.exe" inddmxhxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C09E09E-9286-4dba-B24F-D45547C0240E} intekobge.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DC47CBC-F15C-42b9-8275-1D6C4C48C4F7} inpsutmlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F261D986-728F-447d-A5F0-F44945EBCBA3}\stubpath = "C:\\Windows\\system32\\inuiybnpg.exe" inqdhyock.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{915D5661-1B39-4360-A7AF-6CEB1BB059D4} inzprbebn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06E3311D-5E20-477d-952B-2BF0AFB59C38} insuxuebv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6082854-3B44-4b2a-A59E-4B43F1B261CD}\stubpath = "C:\\Windows\\system32\\infacmfam.exe" innpkjuac.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86A01E6E-D72F-4015-8ACA-59DA60592A94} infacmfam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A767559-5866-4da8-901F-D05776091F8F}\stubpath = "C:\\Windows\\system32\\inwezaozq.exe" inmvblntu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C812DA81-B0CE-40b1-AB9E-006B5405D372}\stubpath = "C:\\Windows\\system32\\inxtleici.exe" ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7F68590-B128-47bf-9806-595653D69FEF} inqjpgzht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A594B78-74DA-47ce-AB16-0B040E4E3A73}\stubpath = "C:\\Windows\\system32\\inasgqvzt.exe" inqxvmprs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50996565-3538-49f0-9D02-02AC193C4017}\stubpath = "C:\\Windows\\system32\\inlhagxpk.exe" inrurbsrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B5A063D-0DA3-4493-8073-9544B62AE9A1} inbpftoif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20C573DD-078A-49cf-AAE9-CCD8D7551DF3}\stubpath = "C:\\Windows\\system32\\inpleqlxa.exe" inxtemyti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CA7EE06-03E5-47d9-93AF-33F9A4B8D38A}\stubpath = "C:\\Windows\\system32\\inmkxopbr.exe" indhxkwmb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33644D83-279F-42b5-942C-B3817027F9BC}\stubpath = "C:\\Windows\\system32\\inyegrpfl.exe" inopeewva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{822A18AA-10BA-4764-ACB8-D40CB075BCBD}\stubpath = "C:\\Windows\\system32\\inykmqjhq.exe" inocymrvp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3963F3FE-4E1E-44c3-B2D6-D798AC1A4A33}\stubpath = "C:\\Windows\\system32\\inhfnbzwf.exe" inlhpjpqs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{299CD08B-2D0E-4641-936A-3A8E295D89D0} inddqfcew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EEBA375A-D93E-4531-9595-79989B85A027}\stubpath = "C:\\Windows\\system32\\injdwyyif.exe" infrgacrf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{597D2154-0572-43ed-8782-F4F2879576BF}\stubpath = "C:\\Windows\\system32\\inaexuhtj.exe" inykznpoh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D4E471F-6F97-4ba2-8B36-6257D22AFB50} infslrijv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFF63E7E-2000-4390-8CC4-BE2D1FCFAF62}\stubpath = "C:\\Windows\\system32\\inrvqwujd.exe" inlcfvhzy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DD4D727-EDFC-4852-BB85-AED9CC9D0B86} inwtixaeq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05C5A49E-E135-4f50-8833-E57231310A6A} inqdmufdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3963F3FE-4E1E-44c3-B2D6-D798AC1A4A33} inlhpjpqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF7CB99A-F533-4ffe-8516-45112E19D942}\stubpath = "C:\\Windows\\system32\\inhxjlpig.exe" inotjfrzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75EB517E-8945-4a83-A64C-FA55BF5D84F6}\stubpath = "C:\\Windows\\system32\\inpatbkcw.exe" inxlrthqk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E22551A-BEFA-4128-8A21-CA84B9DACDB1}\stubpath = "C:\\Windows\\system32\\inrfpuysy.exe" indtkzjxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0801A38F-CBE9-41b0-827D-941A689880FB}\stubpath = "C:\\Windows\\system32\\inalzlawr.exe" inlgphgbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5E8BCAA-79CA-45a3-95F6-8165B9085D97}\stubpath = "C:\\Windows\\system32\\inngbnczn.exe" infmbpvbz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EBAF030-2A1C-40c0-A8BB-E460918D4616}\stubpath = "C:\\Windows\\system32\\inxgusiod.exe" inebdvara.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7961425C-108F-48fa-B972-045B1D7232C7} inmrxryds.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCBBBC61-A90D-4e60-8951-0FFCF8A202F8} inhhujgdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D57E07EB-20D6-4a9b-96CE-B59BC3A26D7A} inooxsntm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D356650-B697-44d4-9D5C-FF49F8934151} inkwlklan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F971FEF-0D3D-4a8b-BC5C-35F80455AD15}\stubpath = "C:\\Windows\\system32\\inkdpokcq.exe" invkhejgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A26506FF-8EF9-4272-B7A7-CB601B0D9EF2}\stubpath = "C:\\Windows\\system32\\invaiaqlz.exe" incxuerhz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CB5538D-6CD7-46fd-97C8-E4D3191E2967}\stubpath = "C:\\Windows\\system32\\incybtpgq.exe" injidfpid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8561C79E-D455-4413-938D-9F311DA9D24F} inwhpwale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D84BEA9D-ABCE-4caa-9F40-88DDB7B582ED} intglbjrf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FEE3F54-C330-40d8-AE12-923716439757} iniszdhvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADAAC0F6-B8B6-46b6-AC64-DD554CFDE7C5}\stubpath = "C:\\Windows\\system32\\inxhvtpha.exe" inatwyxqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C617B4C-73A4-4f16-BD21-064B2AB9B8E9}\stubpath = "C:\\Windows\\system32\\incwvxbyn.exe" incsnrmiw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2F0D544-8536-4a71-80FB-58DF8C14C2C1} inpbwqegf.exe - ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000b000000019caa-4.dat acprotect behavioral2/files/0x000d00000001c5bd-52.dat acprotect behavioral2/files/0x000d00000001c5b8-28.dat acprotect behavioral2/files/0x000d00000001c5c8-123.dat acprotect behavioral2/files/0x000d00000001c5cc-144.dat acprotect behavioral2/files/0x000c00000001c5d0-169.dat acprotect behavioral2/files/0x000c00000001c5d4-192.dat acprotect behavioral2/files/0x000c00000001c5d8-215.dat acprotect behavioral2/files/0x000c00000001c5dc-237.dat acprotect behavioral2/files/0x000c00000001c5e0-260.dat acprotect behavioral2/files/0x000c00000001c5e4-281.dat acprotect behavioral2/files/0x000c00000001c5e8-304.dat acprotect behavioral2/files/0x000c00000001c5ed-329.dat acprotect behavioral2/files/0x000c00000001c5f1-352.dat acprotect behavioral2/files/0x000e00000001c5b2-99.dat acprotect behavioral2/files/0x000d00000001c5c1-76.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4352 insvxwpco.exe 2488 inzkcszdo.exe 1196 invhwkmle.exe 4632 inyjbrycn.exe 364 ineybxzdp.exe 2476 injyqkarh.exe 1336 inbuxzyre.exe 3056 inmeufqjy.exe 6084 inxtemyti.exe 1396 inpleqlxa.exe 1140 inbfyviuk.exe 4688 inrdysgih.exe 2584 inykznpoh.exe 4160 inaexuhtj.exe 2400 indwztgsi.exe 3060 incrjzdkv.exe 2428 inrngsnzc.exe 6000 ingiuiufd.exe 3820 intpaiupe.exe 5612 incgzwjvl.exe 4212 ingvetxyk.exe 860 inugvjlkd.exe 2716 inogwahsa.exe 4560 inwixlnmf.exe 5324 inbqiycju.exe 6012 inwhpwale.exe 108 inruwvobn.exe 4364 infhthtec.exe 6024 inmtnbdcu.exe 4776 inetlfmxc.exe 4332 inzloqpih.exe 3000 inuqbjvqf.exe 4064 inzvgovkd.exe 1240 inlsmacbt.exe 4132 indpalewk.exe 5652 indtwnmuu.exe 4180 injmdckxk.exe 4924 inaphxbit.exe 5916 inbqostfv.exe 3156 inkzrlbas.exe 4196 indxawycz.exe 3088 incsvmltt.exe 2196 inknedlyl.exe 2624 inazpsjiq.exe 5816 indhxkwmb.exe 2448 inmkxopbr.exe 3096 inqgdzfrf.exe 2152 ingwzqpxx.exe 5632 innuocedv.exe 2896 inadbobmd.exe 2748 intcrvwiy.exe 2168 inigtklnv.exe 2516 innlypqcs.exe 2580 inpiofygs.exe 4604 indqsmlmh.exe 4872 incanalcr.exe 5352 insbquvhx.exe 4608 inefvmlzb.exe 1296 inbpxnjbw.exe 3456 ingvnhoze.exe 3884 inxtleici.exe 2876 inqcxrfhg.exe 1416 inhwoipfi.exe 4404 insohtodl.exe - Loads dropped DLL 64 IoCs
pid Process 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe 4352 insvxwpco.exe 4352 insvxwpco.exe 2488 inzkcszdo.exe 2488 inzkcszdo.exe 1196 invhwkmle.exe 1196 invhwkmle.exe 4632 inyjbrycn.exe 4632 inyjbrycn.exe 364 ineybxzdp.exe 364 ineybxzdp.exe 2476 injyqkarh.exe 2476 injyqkarh.exe 1336 inbuxzyre.exe 1336 inbuxzyre.exe 3056 inmeufqjy.exe 3056 inmeufqjy.exe 6084 inxtemyti.exe 6084 inxtemyti.exe 1396 inpleqlxa.exe 1396 inpleqlxa.exe 1140 inbfyviuk.exe 1140 inbfyviuk.exe 4688 inrdysgih.exe 4688 inrdysgih.exe 2584 inykznpoh.exe 2584 inykznpoh.exe 4160 inaexuhtj.exe 4160 inaexuhtj.exe 2400 indwztgsi.exe 2400 indwztgsi.exe 3060 incrjzdkv.exe 3060 incrjzdkv.exe 2428 inrngsnzc.exe 2428 inrngsnzc.exe 6000 ingiuiufd.exe 6000 ingiuiufd.exe 3820 intpaiupe.exe 3820 intpaiupe.exe 5612 incgzwjvl.exe 5612 incgzwjvl.exe 4212 ingvetxyk.exe 4212 ingvetxyk.exe 860 inugvjlkd.exe 860 inugvjlkd.exe 2716 inogwahsa.exe 2716 inogwahsa.exe 4560 inwixlnmf.exe 4560 inwixlnmf.exe 5324 inbqiycju.exe 5324 inbqiycju.exe 6012 inwhpwale.exe 6012 inwhpwale.exe 108 inruwvobn.exe 108 inruwvobn.exe 4364 infhthtec.exe 4364 infhthtec.exe 6024 inmtnbdcu.exe 6024 inmtnbdcu.exe 4776 inetlfmxc.exe 4776 inetlfmxc.exe 4332 inzloqpih.exe 4332 inzloqpih.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat ingfvhjng.exe File opened for modification C:\Windows\SysWOW64\inftrnfcc.exe_lang.ini inxrycagn.exe File created C:\Windows\SysWOW64\injqftzfq.exe inknhvqeu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbwxiybi.exe File created C:\Windows\SysWOW64\inrtkbsie.exe inuisngbw.exe File opened for modification C:\Windows\SysWOW64\inilcbjwj.exe_lang.ini indscwrxb.exe File opened for modification C:\Windows\SysWOW64\inokbwlsa.exe_lang.ini inqrgtvyi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzkzjyci.exe File created C:\Windows\SysWOW64\ingwobgus.exe inpljrdzf.exe File created C:\Windows\SysWOW64\incybtpgq.exe injidfpid.exe File opened for modification C:\Windows\SysWOW64\inbqzdbaf.exe_lang.ini inkdlvlhw.exe File created C:\Windows\SysWOW64\incgzwjvl.exe intpaiupe.exe File opened for modification C:\Windows\SysWOW64\indqsmlmh.exe_lang.ini inpiofygs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhegsgsd.exe File opened for modification C:\Windows\SysWOW64\insywlfel.exe_lang.ini inmtiwity.exe File created C:\Windows\SysWOW64\inycykdza.exe inbpftoif.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpriaela.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyctgpxi.exe File opened for modification C:\Windows\SysWOW64\injflluak.exe_lang.ini inwyoarng.exe File created C:\Windows\SysWOW64\incvyzsfr.exe inljyapnv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrshhzyd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infsuonoj.exe File opened for modification C:\Windows\SysWOW64\inclzteci.exe_lang.ini inepndjtb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indkntxkp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlgisalg.exe File opened for modification C:\Windows\SysWOW64\infumgnyd.exe_lang.ini ingatvyvf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infslrijv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuvxhdct.exe File opened for modification C:\Windows\SysWOW64\inkveoutv.exe_lang.ini inuloqrtx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqswbpnw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inigkkvii.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpljrdzf.exe File created C:\Windows\SysWOW64\invaiaqlz.exe incxuerhz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innoddvuk.exe File created C:\Windows\SysWOW64\inngmlnpt.exe inkivmnpx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indscwrxb.exe File opened for modification C:\Windows\SysWOW64\ineeenyiy.exe_lang.ini inujlcwuk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inarenvge.exe File created C:\Windows\SysWOW64\inbjudnts.exe inbjwysrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inudpxert.exe File created C:\Windows\SysWOW64\invwyxcqk.exe infrfqjpo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzkcszdo.exe File opened for modification C:\Windows\SysWOW64\injyqkarh.exe_lang.ini ineybxzdp.exe File opened for modification C:\Windows\SysWOW64\indhxkwmb.exe_lang.ini inazpsjiq.exe File created C:\Windows\SysWOW64\inbxslgig.exe inhzpfbvl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhxamofz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhhsffsh.exe File created C:\Windows\SysWOW64\infcwfnxi.exe invowdwcs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inapytoun.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inruwvobn.exe File opened for modification C:\Windows\SysWOW64\intcrvwiy.exe_lang.ini inadbobmd.exe File opened for modification C:\Windows\SysWOW64\injvkjzkm.exe_lang.ini inlgwrccv.exe File created C:\Windows\SysWOW64\indskelwb.exe inhiypoew.exe File opened for modification C:\Windows\SysWOW64\inhbuwzwg.exe_lang.ini ingvfeugi.exe File created C:\Windows\SysWOW64\inqswbpnw.exe inochlfll.exe File opened for modification C:\Windows\SysWOW64\inpdimgmm.exe_lang.ini inrtkbsie.exe File created C:\Windows\SysWOW64\inmvblntu.exe inqjvuqid.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingiuiufd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhfsfaqh.exe File opened for modification C:\Windows\SysWOW64\inpkvggzd.exe_lang.ini inejnhnnw.exe File opened for modification C:\Windows\SysWOW64\inmnccutj.exe_lang.ini incwvxbyn.exe File created C:\Windows\SysWOW64\inwgusogd.exe inzhuwqpq.exe File created C:\Windows\SysWOW64\inkwblfyk.exe inpbwqegf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxavmale.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjdjvkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrcangym.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrdysgih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlcfvhzy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxuxrboe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injhulmow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwegjgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclwgwbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incldxuje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvnhoze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuinrlrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhnmoqun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhxamofz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyjbrycn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inazpsjiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyufnzuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhscspdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuiybnpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intcrvwiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inixpjqgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkfxleq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhmcksg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwixlnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnxzhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incmhaqvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insylvfcw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inetlfmxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfsfaqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqceivb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intojzuff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intetdxsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insulctjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingerepgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingfvhjng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwmpgfnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insywlfel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infgqgwzc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaphxbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invuwaxma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inumafjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indjvakex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxsdoolp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invudbffq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfzcyeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpprolqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwmcsiky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inboqtqar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineybxzdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insbquvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyodrton.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkwlklan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztkqidm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpwglkgm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infgwnmcy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbwxiybi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe 4352 insvxwpco.exe 4352 insvxwpco.exe 2488 inzkcszdo.exe 2488 inzkcszdo.exe 1196 invhwkmle.exe 1196 invhwkmle.exe 4632 inyjbrycn.exe 4632 inyjbrycn.exe 364 ineybxzdp.exe 364 ineybxzdp.exe 2476 injyqkarh.exe 2476 injyqkarh.exe 1336 inbuxzyre.exe 1336 inbuxzyre.exe 3056 inmeufqjy.exe 3056 inmeufqjy.exe 6084 inxtemyti.exe 6084 inxtemyti.exe 1396 inpleqlxa.exe 1396 inpleqlxa.exe 1140 inbfyviuk.exe 1140 inbfyviuk.exe 4688 inrdysgih.exe 4688 inrdysgih.exe 2584 inykznpoh.exe 2584 inykznpoh.exe 4160 inaexuhtj.exe 4160 inaexuhtj.exe 2400 indwztgsi.exe 2400 indwztgsi.exe 3060 incrjzdkv.exe 3060 incrjzdkv.exe 2428 inrngsnzc.exe 2428 inrngsnzc.exe 6000 ingiuiufd.exe 6000 ingiuiufd.exe 3820 intpaiupe.exe 3820 intpaiupe.exe 5612 incgzwjvl.exe 5612 incgzwjvl.exe 4212 ingvetxyk.exe 4212 ingvetxyk.exe 860 inugvjlkd.exe 860 inugvjlkd.exe 2716 inogwahsa.exe 2716 inogwahsa.exe 4560 inwixlnmf.exe 4560 inwixlnmf.exe 5324 inbqiycju.exe 5324 inbqiycju.exe 6012 inwhpwale.exe 6012 inwhpwale.exe 108 inruwvobn.exe 108 inruwvobn.exe 4364 infhthtec.exe 4364 infhthtec.exe 6024 inmtnbdcu.exe 6024 inmtnbdcu.exe 4776 inetlfmxc.exe 4776 inetlfmxc.exe 4332 inzloqpih.exe 4332 inzloqpih.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe Token: SeDebugPrivilege 4352 insvxwpco.exe Token: SeDebugPrivilege 2488 inzkcszdo.exe Token: SeDebugPrivilege 1196 invhwkmle.exe Token: SeDebugPrivilege 4632 inyjbrycn.exe Token: SeDebugPrivilege 364 ineybxzdp.exe Token: SeDebugPrivilege 2476 injyqkarh.exe Token: SeDebugPrivilege 1336 inbuxzyre.exe Token: SeDebugPrivilege 3056 inmeufqjy.exe Token: SeDebugPrivilege 6084 inxtemyti.exe Token: SeDebugPrivilege 1396 inpleqlxa.exe Token: SeDebugPrivilege 1140 inbfyviuk.exe Token: SeDebugPrivilege 4688 inrdysgih.exe Token: SeDebugPrivilege 2584 inykznpoh.exe Token: SeDebugPrivilege 4160 inaexuhtj.exe Token: SeDebugPrivilege 2400 indwztgsi.exe Token: SeDebugPrivilege 3060 incrjzdkv.exe Token: SeDebugPrivilege 2428 inrngsnzc.exe Token: SeDebugPrivilege 6000 ingiuiufd.exe Token: SeDebugPrivilege 3820 intpaiupe.exe Token: SeDebugPrivilege 5612 incgzwjvl.exe Token: SeDebugPrivilege 4212 ingvetxyk.exe Token: SeDebugPrivilege 860 inugvjlkd.exe Token: SeDebugPrivilege 2716 inogwahsa.exe Token: SeDebugPrivilege 4560 inwixlnmf.exe Token: SeDebugPrivilege 5324 inbqiycju.exe Token: SeDebugPrivilege 6012 inwhpwale.exe Token: SeDebugPrivilege 108 inruwvobn.exe Token: SeDebugPrivilege 4364 infhthtec.exe Token: SeDebugPrivilege 6024 inmtnbdcu.exe Token: SeDebugPrivilege 4776 inetlfmxc.exe Token: SeDebugPrivilege 4332 inzloqpih.exe Token: SeDebugPrivilege 3000 inuqbjvqf.exe Token: SeDebugPrivilege 4064 inzvgovkd.exe Token: SeDebugPrivilege 1240 inlsmacbt.exe Token: SeDebugPrivilege 4132 indpalewk.exe Token: SeDebugPrivilege 5652 indtwnmuu.exe Token: SeDebugPrivilege 4180 injmdckxk.exe Token: SeDebugPrivilege 4924 inaphxbit.exe Token: SeDebugPrivilege 5916 inbqostfv.exe Token: SeDebugPrivilege 3156 inkzrlbas.exe Token: SeDebugPrivilege 4196 indxawycz.exe Token: SeDebugPrivilege 3088 incsvmltt.exe Token: SeDebugPrivilege 2196 inknedlyl.exe Token: SeDebugPrivilege 2624 inazpsjiq.exe Token: SeDebugPrivilege 5816 indhxkwmb.exe Token: SeDebugPrivilege 2448 inmkxopbr.exe Token: SeDebugPrivilege 3096 inqgdzfrf.exe Token: SeDebugPrivilege 2152 ingwzqpxx.exe Token: SeDebugPrivilege 5632 innuocedv.exe Token: SeDebugPrivilege 2896 inadbobmd.exe Token: SeDebugPrivilege 2748 intcrvwiy.exe Token: SeDebugPrivilege 2168 inigtklnv.exe Token: SeDebugPrivilege 2516 innlypqcs.exe Token: SeDebugPrivilege 2580 inpiofygs.exe Token: SeDebugPrivilege 4604 indqsmlmh.exe Token: SeDebugPrivilege 4872 incanalcr.exe Token: SeDebugPrivilege 5352 insbquvhx.exe Token: SeDebugPrivilege 4608 inefvmlzb.exe Token: SeDebugPrivilege 1296 inbpxnjbw.exe Token: SeDebugPrivilege 3456 ingvnhoze.exe Token: SeDebugPrivilege 3884 inxtleici.exe Token: SeDebugPrivilege 2876 inqcxrfhg.exe Token: SeDebugPrivilege 1416 inhwoipfi.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe 4352 insvxwpco.exe 2488 inzkcszdo.exe 1196 invhwkmle.exe 4632 inyjbrycn.exe 364 ineybxzdp.exe 2476 injyqkarh.exe 1336 inbuxzyre.exe 3056 inmeufqjy.exe 6084 inxtemyti.exe 1396 inpleqlxa.exe 1140 inbfyviuk.exe 4688 inrdysgih.exe 2584 inykznpoh.exe 4160 inaexuhtj.exe 2400 indwztgsi.exe 3060 incrjzdkv.exe 2428 inrngsnzc.exe 6000 ingiuiufd.exe 3820 intpaiupe.exe 5612 incgzwjvl.exe 4212 ingvetxyk.exe 860 inugvjlkd.exe 2716 inogwahsa.exe 4560 inwixlnmf.exe 5324 inbqiycju.exe 6012 inwhpwale.exe 108 inruwvobn.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5168 wrote to memory of 4352 5168 2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe 89 PID 4352 wrote to memory of 2488 4352 insvxwpco.exe 90 PID 2488 wrote to memory of 1196 2488 inzkcszdo.exe 91 PID 1196 wrote to memory of 4632 1196 invhwkmle.exe 92 PID 4632 wrote to memory of 364 4632 inyjbrycn.exe 93 PID 364 wrote to memory of 2476 364 ineybxzdp.exe 94 PID 2476 wrote to memory of 1336 2476 injyqkarh.exe 95 PID 1336 wrote to memory of 3056 1336 inbuxzyre.exe 96 PID 3056 wrote to memory of 6084 3056 inmeufqjy.exe 97 PID 6084 wrote to memory of 1396 6084 inxtemyti.exe 98 PID 1396 wrote to memory of 1140 1396 inpleqlxa.exe 99 PID 1140 wrote to memory of 4688 1140 inbfyviuk.exe 100 PID 4688 wrote to memory of 2584 4688 inrdysgih.exe 101 PID 2584 wrote to memory of 4160 2584 inykznpoh.exe 102 PID 4160 wrote to memory of 2400 4160 inaexuhtj.exe 103 PID 2400 wrote to memory of 3060 2400 indwztgsi.exe 104 PID 3060 wrote to memory of 2428 3060 incrjzdkv.exe 105 PID 2428 wrote to memory of 6000 2428 inrngsnzc.exe 106 PID 6000 wrote to memory of 3820 6000 ingiuiufd.exe 107 PID 3820 wrote to memory of 5612 3820 intpaiupe.exe 108 PID 5612 wrote to memory of 4212 5612 incgzwjvl.exe 109 PID 4212 wrote to memory of 860 4212 ingvetxyk.exe 110 PID 860 wrote to memory of 2716 860 inugvjlkd.exe 111 PID 2716 wrote to memory of 4560 2716 inogwahsa.exe 112 PID 4560 wrote to memory of 5324 4560 inwixlnmf.exe 113 PID 5324 wrote to memory of 6012 5324 inbqiycju.exe 114 PID 6012 wrote to memory of 108 6012 inwhpwale.exe 115 PID 108 wrote to memory of 4364 108 inruwvobn.exe 116 PID 4364 wrote to memory of 6024 4364 infhthtec.exe 117 PID 6024 wrote to memory of 4776 6024 inmtnbdcu.exe 118 PID 4776 wrote to memory of 4332 4776 inetlfmxc.exe 119 PID 4332 wrote to memory of 3000 4332 inzloqpih.exe 120 PID 3000 wrote to memory of 4064 3000 inuqbjvqf.exe 121 PID 4064 wrote to memory of 1240 4064 inzvgovkd.exe 122 PID 1240 wrote to memory of 4132 1240 inlsmacbt.exe 123 PID 4132 wrote to memory of 5652 4132 indpalewk.exe 124 PID 5652 wrote to memory of 4180 5652 indtwnmuu.exe 125 PID 4180 wrote to memory of 4924 4180 injmdckxk.exe 126 PID 4924 wrote to memory of 5916 4924 inaphxbit.exe 127 PID 5916 wrote to memory of 3156 5916 inbqostfv.exe 128 PID 3156 wrote to memory of 4196 3156 inkzrlbas.exe 129 PID 4196 wrote to memory of 3088 4196 indxawycz.exe 130 PID 3088 wrote to memory of 2196 3088 incsvmltt.exe 131 PID 2196 wrote to memory of 2624 2196 inknedlyl.exe 132 PID 2624 wrote to memory of 5816 2624 inazpsjiq.exe 133 PID 5816 wrote to memory of 2448 5816 indhxkwmb.exe 134 PID 2448 wrote to memory of 3096 2448 inmkxopbr.exe 135 PID 3096 wrote to memory of 2152 3096 inqgdzfrf.exe 136 PID 2152 wrote to memory of 5632 2152 ingwzqpxx.exe 137 PID 5632 wrote to memory of 2896 5632 innuocedv.exe 138 PID 2896 wrote to memory of 2748 2896 inadbobmd.exe 139 PID 2748 wrote to memory of 2168 2748 intcrvwiy.exe 140 PID 2168 wrote to memory of 2516 2168 inigtklnv.exe 141 PID 2516 wrote to memory of 2580 2516 innlypqcs.exe 142 PID 2580 wrote to memory of 4604 2580 inpiofygs.exe 143 PID 4604 wrote to memory of 4872 4604 indqsmlmh.exe 144 PID 4872 wrote to memory of 5352 4872 incanalcr.exe 145 PID 5352 wrote to memory of 4608 5352 insbquvhx.exe 146 PID 4608 wrote to memory of 1296 4608 inefvmlzb.exe 147 PID 1296 wrote to memory of 3456 1296 inbpxnjbw.exe 148 PID 3456 wrote to memory of 3884 3456 ingvnhoze.exe 149 PID 3884 wrote to memory of 2876 3884 inxtleici.exe 150 PID 2876 wrote to memory of 1416 2876 inqcxrfhg.exe 151 PID 1416 wrote to memory of 4404 1416 inhwoipfi.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_f17b5fceba088efe1219480690a15303_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe27⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe36⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe46⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe52⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe61⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe65⤵
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe66⤵PID:2440
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe67⤵PID:5340
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe68⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3736 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe69⤵PID:1848
-
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe70⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4532 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe71⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe72⤵PID:3304
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe73⤵PID:824
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe74⤵PID:4852
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe75⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5476 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe76⤵PID:1268
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe78⤵PID:6036
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe79⤵PID:2464
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe80⤵PID:5832
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe81⤵PID:1924
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe82⤵PID:2032
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe83⤵PID:1444
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe84⤵PID:4904
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe85⤵PID:3372
-
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe86⤵PID:5888
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe87⤵PID:4208
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4964 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe89⤵PID:4436
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe90⤵PID:5716
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe91⤵PID:2452
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe92⤵
- System Location Discovery: System Language Discovery
PID:668 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe93⤵
- Boot or Logon Autostart Execution: Active Setup
PID:348 -
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe94⤵PID:2100
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe95⤵PID:3960
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe96⤵PID:1144
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe97⤵PID:2752
-
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe98⤵PID:1732
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe99⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2704 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe100⤵PID:2088
-
C:\Windows\SysWOW64\inbuzcxoc.exeC:\Windows\system32\inbuzcxoc.exe101⤵PID:2852
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe102⤵PID:1116
-
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe103⤵PID:3240
-
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe104⤵PID:4276
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe105⤵PID:1964
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe106⤵PID:3032
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe107⤵PID:972
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe108⤵
- Drops file in System32 directory
PID:616 -
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe109⤵PID:2632
-
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe110⤵
- Drops file in System32 directory
PID:1716 -
C:\Windows\SysWOW64\inngmlnpt.exeC:\Windows\system32\inngmlnpt.exe111⤵PID:5032
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe112⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4720 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe113⤵PID:5500
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe114⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe115⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2828 -
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe116⤵PID:3868
-
C:\Windows\SysWOW64\invbdruwx.exeC:\Windows\system32\invbdruwx.exe117⤵PID:52
-
C:\Windows\SysWOW64\inmflkmos.exeC:\Windows\system32\inmflkmos.exe118⤵PID:1204
-
C:\Windows\SysWOW64\indscwrxb.exeC:\Windows\system32\indscwrxb.exe119⤵
- Drops file in System32 directory
PID:5344 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe120⤵PID:708
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe121⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-