Analysis
- max time kernel
74s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 21:28
Behavioral task
behavioral1
Sample
2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe
- Size 897KB
- Sample261111-1btcnaca98
- SHA256 638bc8a46b8d0431b4b2ba20e5310d2d09b2bd8e45d7a54c476c03019ac3fdc1
- MD5 bef95474cb778f3d30927a51f569a31c
- SHA1 19f8787a5dbd964368ba15ee2c5ba6448d816161
- SHA512 71bb679fba2833a09ef78d484fb664bf9a0b091e50e8dad5bdb95048e0cf207715819bb3a063feb2fa51bb998c3d64c748acc06f5fea8eb0be236542eb999866
- SSDEEP 24576:ouLwoR5RNPjKoOwuLwoR5RNPjKoO6uLwoR5RNPD:RPjOJPjOfPD
- TLSH T1FE15CF01BEE740F9EAE8003C24FB2776963B6998FB085FD36319EE755833551E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 50 IoCs
resource yara_rule behavioral2/memory/5960-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c463-13.dat family_gh0strat behavioral2/files/0x000d00000001c467-22.dat family_gh0strat behavioral2/memory/5960-26-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c480-41.dat family_gh0strat behavioral2/memory/2336-50-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c484-70.dat family_gh0strat behavioral2/memory/5472-123-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2468-147-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6080-172-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ad-264.dat family_gh0strat behavioral2/memory/1896-364-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3704-468-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3248-668-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1448-648-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/612-628-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4180-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2652-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4892-568-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3008-548-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3924-528-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5376-508-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4964-488-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2456-448-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1348-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1604-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4704-388-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c5-384.dat family_gh0strat behavioral2/files/0x000d00000001c4bf-360.dat family_gh0strat behavioral2/memory/3084-340-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ba-336.dat family_gh0strat behavioral2/memory/1300-316-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b5-312.dat family_gh0strat behavioral2/memory/4204-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b1-288.dat family_gh0strat behavioral2/memory/976-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3140-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a9-240.dat family_gh0strat behavioral2/memory/5088-220-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c49f-216.dat family_gh0strat behavioral2/memory/1240-196-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c49a-192.dat family_gh0strat behavioral2/files/0x000d00000001c496-168.dat family_gh0strat behavioral2/files/0x000d00000001c491-143.dat family_gh0strat behavioral2/files/0x000d00000001c48d-119.dat family_gh0strat behavioral2/memory/4848-99-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c489-95.dat family_gh0strat behavioral2/memory/2336-74-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1860-51-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000700000001cda8-10092.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0AADA0F-0D1B-4387-8630-3FA34F6999C7} invapablb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{044D0CDB-515B-40b1-9F85-F760FC9543E9}\stubpath = "C:\\Windows\\system32\\insohtodl.exe" inyjbrycn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0939E403-229E-499b-BB7C-7B592F051417} inngmlnpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{406ABC13-FB16-4086-8E9A-76A57100C2D8} intojzuff.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F724918F-DE0B-44ee-AA7E-372328C211D7} inueaqidm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2396B30B-199F-4a64-A03B-D71E1386FFEE}\stubpath = "C:\\Windows\\system32\\iniaooxbd.exe" injqkgmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EA71530-DBCF-4c07-9A73-9F93A2C9EF24}\stubpath = "C:\\Windows\\system32\\inzzjgeaz.exe" insuxuebv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2DA7A24F-4029-4bad-9891-3C4879402E02}\stubpath = "C:\\Windows\\system32\\infslrijv.exe" inbqostfv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6E5F904-8828-432f-B5AB-5979B318D8CA} invpovkyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C54CA38-F6A6-4cac-87B9-9B59D0ECDFEA} intfuikjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBD8E524-82A1-4f7d-AB52-7E0A236F0B38}\stubpath = "C:\\Windows\\system32\\inddmxhxc.exe" inbqiycju.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED5AB6FD-76A1-45ba-94B8-A887686B2916} inhbuwzwg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7BC42349-FA6F-4fed-9007-65C202711677}\stubpath = "C:\\Windows\\system32\\ingwobgus.exe" inztjzmib.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CE5CAF2-BD5B-4220-AED5-CF8DC3F3D37C} intphcved.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1A6E1B6-FB56-4f52-9BE4-25A34806E9B0}\stubpath = "C:\\Windows\\system32\\invhwkmle.exe" inqcxrfhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B6B2050-64F9-4f48-BE0E-84A0DA44B01E} inbkyszdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67DDE69E-A876-48d3-B426-8A018FD1C1E1}\stubpath = "C:\\Windows\\system32\\inueaqidm.exe" ineamubie.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3000B702-7CB1-4744-BC42-3EE87EA1498D} inxtemyti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9878C91-6CE1-4b4d-B2CD-A407A4348786}\stubpath = "C:\\Windows\\system32\\inbmkzbqa.exe" inirmhzng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8000A31D-EEF1-4a95-8FE0-A4F5924A4920}\stubpath = "C:\\Windows\\system32\\incvyzsfr.exe" inaivxrqr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{992511B7-1C32-46a0-A943-1AC75A58E2BD}\stubpath = "C:\\Windows\\system32\\inewrcnnk.exe" infhthtec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B29B076-E949-4dea-8D89-3C0AFD3E7B5C}\stubpath = "C:\\Windows\\system32\\inowmiavg.exe" inzyhfjju.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32334703-8617-4656-B3C7-E41EF3DA3D35} inmflkmos.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8F0FB39-147E-4042-9D83-6DE01C40459B} inaqgiwze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B675A9FD-6E54-4339-B757-3E454378E93B} intxcqoxe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6C5C4DF-3A00-447e-97CA-A27FEA1BB6B7} inblsqhkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DDB4F60-E696-4d5c-97A9-C60DFB0866C6} inlmosntr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F907717E-C0CB-4cfd-BC4F-3C6C4FCF4652} inqrgtvyi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59D6C0EA-D0EA-46ef-8A3A-5BC1D2A8A9BE} inptcowdq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6639398-2F19-4be8-AD71-3C5B0BC09186}\stubpath = "C:\\Windows\\system32\\inhoiekzn.exe" inprouzhr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60841A2A-ACA5-43e9-913F-7387171DBF61} inqklaasr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F07C2507-C44D-4e71-91D2-1B3910FB6526} indtkzjxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB10F310-842B-42df-B166-26A3A6F059B4} innfajbav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AC9FE08-ACAE-4d22-89D5-E968EBCE2491}\stubpath = "C:\\Windows\\system32\\inkesnbrx.exe" inucuflpc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48912BDF-2AF7-446e-8FC3-BB7E99FBFBC8} iniszaxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9F7EC09-936F-451e-9128-0DEBF33CCD9E}\stubpath = "C:\\Windows\\system32\\inldtepix.exe" inhfsfaqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8000A31D-EEF1-4a95-8FE0-A4F5924A4920} inaivxrqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68EB1F9B-9274-41cb-ACD4-5E795B9788CA} innusjmop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21EFBD2D-B870-4c9a-B2FC-2B1D70D0B42D}\stubpath = "C:\\Windows\\system32\\inypsuvxw.exe" inlfbhwkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF402063-F8A4-402d-8D38-CA1184AC7836}\stubpath = "C:\\Windows\\system32\\infudswxj.exe" insgwlney.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6234E36D-FA4D-4899-AB9E-A40388810AF0}\stubpath = "C:\\Windows\\system32\\incqysiyz.exe" injqftzfq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BBC3492-8D13-4252-ABAD-00AD3262C0DD} inxavmale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{970ACC79-22D0-4925-BD87-F78E8B78AB7A}\stubpath = "C:\\Windows\\system32\\intpaiupe.exe" inldtepix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF402063-F8A4-402d-8D38-CA1184AC7836} insgwlney.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4F24113-5A61-4d01-A469-4E07F9C48163}\stubpath = "C:\\Windows\\system32\\injmdckxk.exe" ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95C199EF-1C40-4c0e-A1DD-11295ABCD16F} infnwdvwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD05A3AE-40DB-48f0-A762-15BD482C9780} inewhnrej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20FB3FED-BE85-4f36-A642-04F500699AC6}\stubpath = "C:\\Windows\\system32\\inbjdjvkm.exe" infhrodsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAC25312-49D4-453f-9B2D-4BA6FE082900} inzydrlkr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5DAF1C8-55D7-4bb3-B0B5-6491231B05C6}\stubpath = "C:\\Windows\\system32\\inkxmjgli.exe" inhoiekzn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29E10CA2-E657-45f4-A0B8-5FD8A8815678} infzicqlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B877451-7F5D-45dc-8A0F-93D5488A6030} insulctjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E0DF49C-C0CC-4f46-A85E-F4C4EEBCEFAB}\stubpath = "C:\\Windows\\system32\\inxjymong.exe" inuhqyjhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C234C9A5-29A0-4c8e-BBCF-17DAD3F4266C} inkhtihxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92304959-C6E3-45c7-9B12-3CDA28545CA7}\stubpath = "C:\\Windows\\system32\\inlfbhwkc.exe" inzolinkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DEAFFF0-31C0-490d-BC55-A45723B466B4} inokbwlsa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58006971-51A3-490f-B7D8-5020E13CD439}\stubpath = "C:\\Windows\\system32\\inqfmalkm.exe" innboczda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C8429C3-E93A-4d93-8821-44878A95DE05}\stubpath = "C:\\Windows\\system32\\inrcscxou.exe" invawifmu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C02B96C-16F6-4cbd-A002-06FBA52BBEDC}\stubpath = "C:\\Windows\\system32\\indscwrxb.exe" inbsfowhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA197A7E-23F7-4e58-A291-8D273DC56410} indscwrxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B08AEB1B-FD16-4037-B411-E57C319303D2} inutvwllh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C70952B-B17C-4629-B91B-D93921D87DB2} innjrlbrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1599619C-12EE-4d1d-9EA6-B8A3B61FF4E4} inmjhdsul.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8982D192-4CC3-43bd-AE4C-6523F4F3BF5D}\stubpath = "C:\\Windows\\system32\\inoyokzfp.exe" inhoksmcs.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000b00000001b2c5-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1860 innfvgrkz.exe 2336 inbuxzyre.exe 4848 inlsmacbt.exe 5472 inaphxbit.exe 2468 infumgnyd.exe 6080 inyjbrycn.exe 1240 insohtodl.exe 5088 inatwyxqd.exe 3140 inwixlnmf.exe 976 inmtnbdcu.exe 4204 insvxwpco.exe 1300 ingvnhoze.exe 3084 injmdckxk.exe 1896 inqcxrfhg.exe 4704 invhwkmle.exe 1604 inmprqjiy.exe 1348 inyorihpp.exe 2456 inxtemyti.exe 3704 incgzwjvl.exe 4964 injwnoaqy.exe 5376 inpfzcyeq.exe 3924 inbfyviuk.exe 3008 innqsrkjz.exe 4892 inrdysgih.exe 2652 inhfsfaqh.exe 4180 inldtepix.exe 612 intpaiupe.exe 1448 inqgdzfrf.exe 3248 inykznpoh.exe 4136 innuocedv.exe 2888 incrjzdkv.exe 3708 inwhpwale.exe 2884 inpleqlxa.exe 2800 inruwvobn.exe 4720 inhwoipfi.exe 3928 inknedlyl.exe 1332 inazpsjiq.exe 672 inwgusogd.exe 2764 inefvmlzb.exe 2624 inmeufqjy.exe 3748 insezthji.exe 852 ingvetxyk.exe 4624 inogwahsa.exe 6072 inetlfmxc.exe 5816 iniqzgcyz.exe 2916 intsuvkkg.exe 5840 inqklaasr.exe 1612 inzvgovkd.exe 3888 indhxkwmb.exe 460 inpsutmlb.exe 4896 invrckwrg.exe 4968 inixpjqgj.exe 1776 invuwaxma.exe 5800 inadbobmd.exe 2868 indwztgsi.exe 1580 inkzrlbas.exe 1880 ingtvpopk.exe 5628 inhzrfkoi.exe 5468 insbquvhx.exe 2260 inzloqpih.exe 1320 inuqbjvqf.exe 5368 intfuikjc.exe 2032 inxiaqxbm.exe 2496 inqmfrmyb.exe - Loads dropped DLL 64 IoCs
pid Process 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 1860 innfvgrkz.exe 1860 innfvgrkz.exe 2336 inbuxzyre.exe 2336 inbuxzyre.exe 4848 inlsmacbt.exe 4848 inlsmacbt.exe 5472 inaphxbit.exe 5472 inaphxbit.exe 2468 infumgnyd.exe 2468 infumgnyd.exe 6080 inyjbrycn.exe 6080 inyjbrycn.exe 1240 insohtodl.exe 1240 insohtodl.exe 5088 inatwyxqd.exe 5088 inatwyxqd.exe 3140 inwixlnmf.exe 3140 inwixlnmf.exe 976 inmtnbdcu.exe 976 inmtnbdcu.exe 4204 insvxwpco.exe 4204 insvxwpco.exe 1300 ingvnhoze.exe 1300 ingvnhoze.exe 3084 injmdckxk.exe 3084 injmdckxk.exe 1896 inqcxrfhg.exe 1896 inqcxrfhg.exe 4704 invhwkmle.exe 4704 invhwkmle.exe 1604 inmprqjiy.exe 1604 inmprqjiy.exe 1348 inyorihpp.exe 1348 inyorihpp.exe 2456 inxtemyti.exe 2456 inxtemyti.exe 3704 incgzwjvl.exe 3704 incgzwjvl.exe 4964 injwnoaqy.exe 4964 injwnoaqy.exe 5376 inpfzcyeq.exe 5376 inpfzcyeq.exe 3924 inbfyviuk.exe 3924 inbfyviuk.exe 3008 innqsrkjz.exe 3008 innqsrkjz.exe 4892 inrdysgih.exe 4892 inrdysgih.exe 2652 inhfsfaqh.exe 2652 inhfsfaqh.exe 4180 inldtepix.exe 4180 inldtepix.exe 612 intpaiupe.exe 612 intpaiupe.exe 1448 inqgdzfrf.exe 1448 inqgdzfrf.exe 3248 inykznpoh.exe 3248 inykznpoh.exe 4136 innuocedv.exe 4136 innuocedv.exe 2888 incrjzdkv.exe 2888 incrjzdkv.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inmibthrw.exe File opened for modification C:\Windows\SysWOW64\inipelkjl.exe_lang.ini incjmswjo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incgowgcf.exe File created C:\Windows\SysWOW64\inwhjedoj.exe infauwnfj.exe File created C:\Windows\SysWOW64\invbdruwx.exe invgvfzue.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaexuhtj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indtkzjxv.exe File created C:\Windows\SysWOW64\inktbmkag.exe inbjwysrs.exe File created C:\Windows\SysWOW64\inxhvtpha.exe injdwyyif.exe File opened for modification C:\Windows\SysWOW64\indskelwb.exe_lang.ini inbobfwma.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indwbuqoc.exe File opened for modification C:\Windows\SysWOW64\inetlfmxc.exe_lang.ini inogwahsa.exe File created C:\Windows\SysWOW64\inyufnzuj.exe inzhuwqpq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injqftzfq.exe File opened for modification C:\Windows\SysWOW64\innswqwhw.exe_lang.ini inhrmfavc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inligcrtk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxgusiod.exe File created C:\Windows\SysWOW64\inmawkptn.exe inngmlnpt.exe File created C:\Windows\SysWOW64\inyepukgs.exe inligcrtk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inebdvara.exe File created C:\Windows\SysWOW64\inlcfvhzy.exe inrjcgagg.exe File opened for modification C:\Windows\SysWOW64\indzyzoqh.exe_lang.ini intikurgv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infudswxj.exe File opened for modification C:\Windows\SysWOW64\inhfbqsjb.exe_lang.ini innezovdr.exe File opened for modification C:\Windows\SysWOW64\inqswbpnw.exe_lang.ini inhomdgwi.exe File created C:\Windows\SysWOW64\innxkgbub.exe inrumczhz.exe File opened for modification C:\Windows\SysWOW64\inrjcgagg.exe_lang.ini inaouaylq.exe File opened for modification C:\Windows\SysWOW64\inlhnqivx.exe_lang.ini inqrggyxc.exe File created C:\Windows\SysWOW64\invfrxfpk.exe inrbrocsh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inquussur.exe File opened for modification C:\Windows\SysWOW64\inhoksmcs.exe_lang.ini inrhmypep.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invpovkyk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqdmufdj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inthjosvx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inikbvtjp.exe File created C:\Windows\SysWOW64\inqzfhsqg.exe infudswxj.exe File created C:\Windows\SysWOW64\inxtemyti.exe inyorihpp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbmkzbqa.exe File opened for modification C:\Windows\SysWOW64\injsnioht.exe_lang.ini intcrvwiy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inowqgwxz.exe File opened for modification C:\Windows\SysWOW64\incgowgcf.exe_lang.ini inofbieyd.exe File created C:\Windows\SysWOW64\inetlfmxc.exe inogwahsa.exe File opened for modification C:\Windows\SysWOW64\indtosnaj.exe_lang.ini indtkzjxv.exe File created C:\Windows\SysWOW64\inkuaczqt.exe incbrdfjw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkuaczqt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injwylczx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innjrlbrs.exe File created C:\Windows\SysWOW64\inqfmalkm.exe innboczda.exe File opened for modification C:\Windows\SysWOW64\inwauuwtq.exe_lang.ini inqswbpnw.exe File created C:\Windows\SysWOW64\inejnhnnw.exe insulctjf.exe File created C:\Windows\SysWOW64\inyaereiz.exe inmqlrpew.exe File opened for modification C:\Windows\SysWOW64\innezovdr.exe_lang.ini invbdruwx.exe File opened for modification C:\Windows\SysWOW64\inbwxiybi.exe_lang.ini insahbdsg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmwmixdn.exe File opened for modification C:\Windows\SysWOW64\inhpkypiu.exe_lang.ini invtfsnjp.exe File opened for modification C:\Windows\SysWOW64\infvqbbup.exe_lang.ini inxtleici.exe File opened for modification C:\Windows\SysWOW64\inmxiifwj.exe_lang.ini inpbwqegf.exe File opened for modification C:\Windows\SysWOW64\inblsqhkm.exe_lang.ini inixomukg.exe File created C:\Windows\SysWOW64\inacrecbg.exe inucxmxol.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbpftoif.exe File opened for modification C:\Windows\SysWOW64\inbuzcxoc.exe_lang.ini indtosnaj.exe File created C:\Windows\SysWOW64\inyegrpfl.exe inimthpzj.exe File opened for modification C:\Windows\SysWOW64\inffruvhe.exe_lang.ini invowdwcs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkhtihxi.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomvcziu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inochlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwfuyzl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbihgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzzjgeaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvetxyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlvgkyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intglbjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpdlicvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuxzyre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infauwnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjdjvkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfvwyie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpxucmtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incwvxbyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhhsffsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrfqjpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingyagyjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invgvfzue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzuolauz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indhodkji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlvjosms.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkzjyci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbmyhvlc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmwmixdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhgwhjlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inigkkvii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inboqtqar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbwxiybi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invtfsnjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infdqdofu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwftrhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrurbsrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innikicxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intfuikjc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innnpmjol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzesqzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inenraymu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvpwggs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingwzqpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmosntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwemzvcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogxmhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqgdzfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykmqjhq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniaooxbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injavkrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incpcgxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inftrnfcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzprbebn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfnbzwf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktbmkag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtiwity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkietvme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incjmswjo.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 1860 innfvgrkz.exe 1860 innfvgrkz.exe 2336 inbuxzyre.exe 2336 inbuxzyre.exe 4848 inlsmacbt.exe 4848 inlsmacbt.exe 5472 inaphxbit.exe 5472 inaphxbit.exe 2468 infumgnyd.exe 2468 infumgnyd.exe 6080 inyjbrycn.exe 6080 inyjbrycn.exe 1240 insohtodl.exe 1240 insohtodl.exe 5088 inatwyxqd.exe 5088 inatwyxqd.exe 3140 inwixlnmf.exe 3140 inwixlnmf.exe 976 inmtnbdcu.exe 976 inmtnbdcu.exe 4204 insvxwpco.exe 4204 insvxwpco.exe 1300 ingvnhoze.exe 1300 ingvnhoze.exe 3084 injmdckxk.exe 3084 injmdckxk.exe 1896 inqcxrfhg.exe 1896 inqcxrfhg.exe 4704 invhwkmle.exe 4704 invhwkmle.exe 1604 inmprqjiy.exe 1604 inmprqjiy.exe 1348 inyorihpp.exe 1348 inyorihpp.exe 2456 inxtemyti.exe 2456 inxtemyti.exe 3704 incgzwjvl.exe 3704 incgzwjvl.exe 4964 injwnoaqy.exe 4964 injwnoaqy.exe 5376 inpfzcyeq.exe 5376 inpfzcyeq.exe 3924 inbfyviuk.exe 3924 inbfyviuk.exe 3008 innqsrkjz.exe 3008 innqsrkjz.exe 4892 inrdysgih.exe 4892 inrdysgih.exe 2652 inhfsfaqh.exe 2652 inhfsfaqh.exe 4180 inldtepix.exe 4180 inldtepix.exe 612 intpaiupe.exe 612 intpaiupe.exe 1448 inqgdzfrf.exe 1448 inqgdzfrf.exe 3248 inykznpoh.exe 3248 inykznpoh.exe 4136 innuocedv.exe 4136 innuocedv.exe 2888 incrjzdkv.exe 2888 incrjzdkv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe Token: SeDebugPrivilege 1860 innfvgrkz.exe Token: SeDebugPrivilege 2336 inbuxzyre.exe Token: SeDebugPrivilege 4848 inlsmacbt.exe Token: SeDebugPrivilege 5472 inaphxbit.exe Token: SeDebugPrivilege 2468 infumgnyd.exe Token: SeDebugPrivilege 6080 inyjbrycn.exe Token: SeDebugPrivilege 1240 insohtodl.exe Token: SeDebugPrivilege 5088 inatwyxqd.exe Token: SeDebugPrivilege 3140 inwixlnmf.exe Token: SeDebugPrivilege 976 inmtnbdcu.exe Token: SeDebugPrivilege 4204 insvxwpco.exe Token: SeDebugPrivilege 1300 ingvnhoze.exe Token: SeDebugPrivilege 3084 injmdckxk.exe Token: SeDebugPrivilege 1896 inqcxrfhg.exe Token: SeDebugPrivilege 4704 invhwkmle.exe Token: SeDebugPrivilege 1604 inmprqjiy.exe Token: SeDebugPrivilege 1348 inyorihpp.exe Token: SeDebugPrivilege 2456 inxtemyti.exe Token: SeDebugPrivilege 3704 incgzwjvl.exe Token: SeDebugPrivilege 4964 injwnoaqy.exe Token: SeDebugPrivilege 5376 inpfzcyeq.exe Token: SeDebugPrivilege 3924 inbfyviuk.exe Token: SeDebugPrivilege 3008 innqsrkjz.exe Token: SeDebugPrivilege 4892 inrdysgih.exe Token: SeDebugPrivilege 2652 inhfsfaqh.exe Token: SeDebugPrivilege 4180 inldtepix.exe Token: SeDebugPrivilege 612 intpaiupe.exe Token: SeDebugPrivilege 1448 inqgdzfrf.exe Token: SeDebugPrivilege 3248 inykznpoh.exe Token: SeDebugPrivilege 4136 innuocedv.exe Token: SeDebugPrivilege 2888 incrjzdkv.exe Token: SeDebugPrivilege 3708 inwhpwale.exe Token: SeDebugPrivilege 2884 inpleqlxa.exe Token: SeDebugPrivilege 2800 inruwvobn.exe Token: SeDebugPrivilege 4720 inhwoipfi.exe Token: SeDebugPrivilege 3928 inknedlyl.exe Token: SeDebugPrivilege 1332 inazpsjiq.exe Token: SeDebugPrivilege 672 inwgusogd.exe Token: SeDebugPrivilege 2764 inefvmlzb.exe Token: SeDebugPrivilege 2624 inmeufqjy.exe Token: SeDebugPrivilege 3748 insezthji.exe Token: SeDebugPrivilege 852 ingvetxyk.exe Token: SeDebugPrivilege 4624 inogwahsa.exe Token: SeDebugPrivilege 6072 inetlfmxc.exe Token: SeDebugPrivilege 5816 iniqzgcyz.exe Token: SeDebugPrivilege 2916 intsuvkkg.exe Token: SeDebugPrivilege 5840 inqklaasr.exe Token: SeDebugPrivilege 1612 inzvgovkd.exe Token: SeDebugPrivilege 3888 indhxkwmb.exe Token: SeDebugPrivilege 460 inpsutmlb.exe Token: SeDebugPrivilege 4896 invrckwrg.exe Token: SeDebugPrivilege 4968 inixpjqgj.exe Token: SeDebugPrivilege 1776 invuwaxma.exe Token: SeDebugPrivilege 5800 inadbobmd.exe Token: SeDebugPrivilege 2868 indwztgsi.exe Token: SeDebugPrivilege 1580 inkzrlbas.exe Token: SeDebugPrivilege 1880 ingtvpopk.exe Token: SeDebugPrivilege 5628 inhzrfkoi.exe Token: SeDebugPrivilege 5468 insbquvhx.exe Token: SeDebugPrivilege 2260 inzloqpih.exe Token: SeDebugPrivilege 1320 inuqbjvqf.exe Token: SeDebugPrivilege 5368 intfuikjc.exe Token: SeDebugPrivilege 2032 inxiaqxbm.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 1860 innfvgrkz.exe 2336 inbuxzyre.exe 4848 inlsmacbt.exe 5472 inaphxbit.exe 2468 infumgnyd.exe 6080 inyjbrycn.exe 1240 insohtodl.exe 5088 inatwyxqd.exe 3140 inwixlnmf.exe 976 inmtnbdcu.exe 4204 insvxwpco.exe 1300 ingvnhoze.exe 3084 injmdckxk.exe 1896 inqcxrfhg.exe 4704 invhwkmle.exe 1604 inmprqjiy.exe 1348 inyorihpp.exe 2456 inxtemyti.exe 3704 incgzwjvl.exe 4964 injwnoaqy.exe 5376 inpfzcyeq.exe 3924 inbfyviuk.exe 3008 innqsrkjz.exe 4892 inrdysgih.exe 2652 inhfsfaqh.exe 4180 inldtepix.exe 612 intpaiupe.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5960 wrote to memory of 1860 5960 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 89 PID 1860 wrote to memory of 2336 1860 innfvgrkz.exe 90 PID 2336 wrote to memory of 4848 2336 inbuxzyre.exe 91 PID 4848 wrote to memory of 5472 4848 inlsmacbt.exe 92 PID 5472 wrote to memory of 2468 5472 inaphxbit.exe 93 PID 2468 wrote to memory of 6080 2468 infumgnyd.exe 94 PID 6080 wrote to memory of 1240 6080 inyjbrycn.exe 95 PID 1240 wrote to memory of 5088 1240 insohtodl.exe 96 PID 5088 wrote to memory of 3140 5088 inatwyxqd.exe 97 PID 3140 wrote to memory of 976 3140 inwixlnmf.exe 98 PID 976 wrote to memory of 4204 976 inmtnbdcu.exe 99 PID 4204 wrote to memory of 1300 4204 insvxwpco.exe 100 PID 1300 wrote to memory of 3084 1300 ingvnhoze.exe 101 PID 3084 wrote to memory of 1896 3084 injmdckxk.exe 102 PID 1896 wrote to memory of 4704 1896 inqcxrfhg.exe 103 PID 4704 wrote to memory of 1604 4704 invhwkmle.exe 104 PID 1604 wrote to memory of 1348 1604 inmprqjiy.exe 105 PID 1348 wrote to memory of 2456 1348 inyorihpp.exe 106 PID 2456 wrote to memory of 3704 2456 inxtemyti.exe 107 PID 3704 wrote to memory of 4964 3704 incgzwjvl.exe 108 PID 4964 wrote to memory of 5376 4964 injwnoaqy.exe 109 PID 5376 wrote to memory of 3924 5376 inpfzcyeq.exe 110 PID 3924 wrote to memory of 3008 3924 inbfyviuk.exe 111 PID 3008 wrote to memory of 4892 3008 innqsrkjz.exe 112 PID 4892 wrote to memory of 2652 4892 inrdysgih.exe 113 PID 2652 wrote to memory of 4180 2652 inhfsfaqh.exe 114 PID 4180 wrote to memory of 612 4180 inldtepix.exe 115 PID 612 wrote to memory of 1448 612 intpaiupe.exe 116 PID 1448 wrote to memory of 3248 1448 inqgdzfrf.exe 117 PID 3248 wrote to memory of 4136 3248 inykznpoh.exe 118 PID 4136 wrote to memory of 2888 4136 innuocedv.exe 119 PID 2888 wrote to memory of 3708 2888 incrjzdkv.exe 120 PID 3708 wrote to memory of 2884 3708 inwhpwale.exe 121 PID 2884 wrote to memory of 2800 2884 inpleqlxa.exe 122 PID 2800 wrote to memory of 4720 2800 inruwvobn.exe 123 PID 4720 wrote to memory of 3928 4720 inhwoipfi.exe 124 PID 3928 wrote to memory of 1332 3928 inknedlyl.exe 125 PID 1332 wrote to memory of 672 1332 inazpsjiq.exe 126 PID 672 wrote to memory of 2764 672 inwgusogd.exe 127 PID 2764 wrote to memory of 2624 2764 inefvmlzb.exe 128 PID 2624 wrote to memory of 3748 2624 inmeufqjy.exe 129 PID 3748 wrote to memory of 852 3748 insezthji.exe 130 PID 852 wrote to memory of 4624 852 ingvetxyk.exe 131 PID 4624 wrote to memory of 6072 4624 inogwahsa.exe 132 PID 6072 wrote to memory of 5816 6072 inetlfmxc.exe 133 PID 5816 wrote to memory of 2916 5816 iniqzgcyz.exe 134 PID 2916 wrote to memory of 5840 2916 intsuvkkg.exe 135 PID 5840 wrote to memory of 1612 5840 inqklaasr.exe 136 PID 1612 wrote to memory of 3888 1612 inzvgovkd.exe 137 PID 3888 wrote to memory of 460 3888 indhxkwmb.exe 138 PID 460 wrote to memory of 4896 460 inpsutmlb.exe 139 PID 4896 wrote to memory of 4968 4896 invrckwrg.exe 140 PID 4968 wrote to memory of 1776 4968 inixpjqgj.exe 141 PID 1776 wrote to memory of 5800 1776 invuwaxma.exe 142 PID 5800 wrote to memory of 2868 5800 inadbobmd.exe 143 PID 2868 wrote to memory of 1580 2868 indwztgsi.exe 144 PID 1580 wrote to memory of 1880 1580 inkzrlbas.exe 145 PID 1880 wrote to memory of 5628 1880 ingtvpopk.exe 146 PID 5628 wrote to memory of 5468 5628 inhzrfkoi.exe 147 PID 5468 wrote to memory of 2260 5468 insbquvhx.exe 148 PID 2260 wrote to memory of 1320 2260 inzloqpih.exe 149 PID 1320 wrote to memory of 5368 1320 inuqbjvqf.exe 150 PID 5368 wrote to memory of 2032 5368 intfuikjc.exe 151 PID 2032 wrote to memory of 2496 2032 inxiaqxbm.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe13⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe15⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe26⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe27⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe48⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe63⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe65⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe66⤵PID:1592
-
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe67⤵
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe68⤵
- Drops file in System32 directory
PID:3852 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe69⤵PID:1196
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe70⤵PID:5560
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe71⤵PID:3880
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe72⤵PID:4236
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe73⤵PID:2732
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe74⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1244 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe75⤵PID:2028
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe76⤵PID:3552
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe77⤵PID:2296
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe78⤵PID:5756
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe79⤵PID:5488
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe80⤵PID:2636
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe81⤵PID:4156
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1540 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe83⤵
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe84⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5808 -
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe85⤵PID:3764
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe86⤵PID:6104
-
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\system32\ineqbmfxl.exe87⤵PID:704
-
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe88⤵PID:3276
-
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe89⤵PID:5216
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe90⤵
- Boot or Logon Autostart Execution: Active Setup
PID:720 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe91⤵PID:3324
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe92⤵PID:1560
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe93⤵PID:1284
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe94⤵PID:1704
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe95⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe96⤵PID:5952
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe97⤵PID:1976
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe98⤵
- Drops file in System32 directory
PID:5032 -
C:\Windows\SysWOW64\injsnioht.exeC:\Windows\system32\injsnioht.exe99⤵PID:2940
-
C:\Windows\SysWOW64\incvdypdo.exeC:\Windows\system32\incvdypdo.exe100⤵PID:1236
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe101⤵PID:2852
-
C:\Windows\SysWOW64\invmdukgq.exeC:\Windows\system32\invmdukgq.exe102⤵PID:3268
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe103⤵
- System Location Discovery: System Language Discovery
PID:2176 -
C:\Windows\SysWOW64\intmsjkwc.exeC:\Windows\system32\intmsjkwc.exe104⤵PID:5408
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe105⤵
- Drops file in System32 directory
PID:1344 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe106⤵PID:3356
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe107⤵PID:2168
-
C:\Windows\SysWOW64\insulctjf.exeC:\Windows\system32\insulctjf.exe108⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4700 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe109⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe110⤵PID:5176
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe111⤵PID:1380
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe112⤵
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe113⤵PID:4504
-
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe114⤵PID:5868
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe115⤵PID:6036
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe116⤵PID:4972
-
C:\Windows\SysWOW64\inkveoutv.exeC:\Windows\system32\inkveoutv.exe117⤵PID:4328
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe118⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3392 -
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe119⤵PID:3364
-
C:\Windows\SysWOW64\inzprbebn.exeC:\Windows\system32\inzprbebn.exe120⤵
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Windows\SysWOW64\inpnehxjk.exeC:\Windows\system32\inpnehxjk.exe121⤵PID:4164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-