Analysis
- max time kernel
67s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:31
Behavioral task
behavioral1
Sample
2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe
- Size 348KB
- Sample260718-d3ay3aez2j
- SHA256 3298ec89370fb5d006bc724378dc4ee115729c834b2ab799cd01420d9949a6a2
- MD5 68756f6469b0c98824aa972378ae4c6a
- SHA1 38feffca2728f2b8612dffa44a56b5d81ed5e7d2
- SHA512 dbb3908d87ec7082121e116797291df9c5108e391e5fa78c63646de1ebdac4747830f5fd317e839561e139754614a939cad03b14cf60d1d03f06a2c3437f80af
- SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0Sf:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0T
- TLSH T1D574DF01BEE640F9EAF8003C20FB2776963B6898FB085FD36319EA751837555E632256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 47 IoCs
resource yara_rule behavioral2/memory/4440-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c487-20.dat family_gh0strat behavioral2/memory/4440-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c48e-43.dat family_gh0strat behavioral2/memory/5524-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c48d-33.dat family_gh0strat behavioral2/files/0x000d00000001c493-67.dat family_gh0strat behavioral2/memory/5696-72-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c498-89.dat family_gh0strat behavioral2/files/0x000d00000001c49d-112.dat family_gh0strat behavioral2/memory/5692-117-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a7-134.dat family_gh0strat behavioral2/files/0x000d00000001c4ab-157.dat family_gh0strat behavioral2/files/0x000d00000001c4b0-178.dat family_gh0strat behavioral2/files/0x000d00000001c4b4-200.dat family_gh0strat behavioral2/files/0x000d00000001c4b8-222.dat family_gh0strat behavioral2/files/0x000d00000001c4bc-245.dat family_gh0strat behavioral2/files/0x000d00000001c4c9-310.dat family_gh0strat behavioral2/memory/3088-359-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/436-395-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5948-414-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5020-432-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1276-450-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4148-468-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5284-486-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2040-504-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/120-594-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3700-576-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2372-558-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2188-540-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4348-522-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5556-377-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d1-355.dat family_gh0strat behavioral2/memory/5900-337-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4cd-333.dat family_gh0strat behavioral2/memory/1248-315-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/708-293-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c5-289.dat family_gh0strat behavioral2/memory/2768-271-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c1-267.dat family_gh0strat behavioral2/memory/1168-249-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/944-227-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2848-205-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1344-183-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4248-161-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3340-139-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3384-94-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0147356-11A0-4e22-8315-17358633EADC} inxnqhgoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7C8B9D7-D74F-4533-956C-A85B05FB61E5} inutvwllh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63FE9B67-1F91-4acb-8006-E6FBA241542C} indlyubtu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6257B66B-B6E0-4bfa-A935-B8BE9719B464} inkveoutv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41CCDA0C-E5EC-4bad-AFC7-725F0224786F}\stubpath = "C:\\Windows\\system32\\inwfngdng.exe" inefvmlzb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A172138E-733A-4ed3-9183-AA9E45355BD6} insbznvcp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37996DE0-7DFD-48b2-9C4E-ADF669E1A70D} inazpsjiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68D5E46E-3E12-4902-B168-EA613610149E}\stubpath = "C:\\Windows\\system32\\inkhtihxi.exe" inigkkvii.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{314D9269-C090-4314-BA94-C8B2CBC3AEA0} inmwcesvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE4FD08D-3172-4c49-A235-0AAA0A561582} inuytzxmg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{156595D4-57EB-46b8-9878-098208C3526B}\stubpath = "C:\\Windows\\system32\\iniqgcwmo.exe" inlisltat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD20B942-6199-42de-A764-2B297AF70F70}\stubpath = "C:\\Windows\\system32\\innezahdx.exe" inxgaoyjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BAB6ECBE-D681-426d-AC16-78487AB2FE9A}\stubpath = "C:\\Windows\\system32\\inmflkmos.exe" ingugrwmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5442BD52-F690-4e63-86A9-3BFEC23F636E}\stubpath = "C:\\Windows\\system32\\inofbieyd.exe" inochlfll.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F11BF19A-DBC1-4f82-A197-0DE1D06EF546} inodazcuq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8899EE09-933D-4819-AAF1-FA425D378DF5} inahuhbcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C65BC96D-9927-45e5-8AEA-C6FBB85549B3}\stubpath = "C:\\Windows\\system32\\indkgfezw.exe" inzfhvydh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA0A255C-F563-4b7e-A26F-B8CB8ECC06A0} incsdfhkz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCF3AB3D-EC3D-465a-9891-6A7D9C1AA484} invwyxcqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{930C3939-4CEC-4e72-9344-4A218C998ED3} infjxbrqx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3581A55-3B37-438f-9AA9-EBBDAC9909D8} inpzchsnz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F60C60C3-2DB2-447b-BB2B-43FD7199BE3B}\stubpath = "C:\\Windows\\system32\\inbjwysrs.exe" injhulmow.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16976B92-366A-4f03-A413-641E56B9B7C9}\stubpath = "C:\\Windows\\system32\\infgwnmcy.exe" ingtgabri.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{563E8F7C-0635-468b-AB64-F65039907360} infrfqjpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32071362-C622-4890-A909-4A8E788F2087}\stubpath = "C:\\Windows\\system32\\inrkqhiua.exe" inpkvggzd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{314D9269-C090-4314-BA94-C8B2CBC3AEA0}\stubpath = "C:\\Windows\\system32\\inrfvkmdx.exe" inmwcesvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09011607-9CBD-4141-A1F6-2796742A9AC1}\stubpath = "C:\\Windows\\system32\\inxqcxpkg.exe" inbaqbdfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23CD820F-0428-4f0e-8BB6-6C8E250B3BAF} invspsmvj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C50FBAD0-D6A4-48a7-B720-C200CD75682B}\stubpath = "C:\\Windows\\system32\\inluxxpmh.exe" injbpivej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D84B68A-B6B2-4c58-8519-8B3FDEA30F47}\stubpath = "C:\\Windows\\system32\\infhthtec.exe" invrckwrg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2380E1D7-3593-491e-ACCB-167082BE4808} inymcufhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E74DB530-5044-4cb1-8E7E-4FF1CCEA426B} inbobfwma.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69F246DA-A162-408f-9D88-1A71390992E0} inxbftvlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE821187-C4F8-419c-A2C0-A8EF0F607792} inloiwrfv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49A0D2D2-5F0F-40d4-95CD-4AE7C6096EA0}\stubpath = "C:\\Windows\\system32\\inrwawibx.exe" inovtknpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3310AD30-265F-46eb-A880-9B87B2DAD937}\stubpath = "C:\\Windows\\system32\\inbsbjtei.exe" inqbjpnmx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C0A4446-A9EA-4cfb-9CD2-D9A7B85B9F95} inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C0A4446-A9EA-4cfb-9CD2-D9A7B85B9F95}\stubpath = "C:\\Windows\\system32\\innlypqcs.exe" inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17DD014F-7F60-496c-B598-8E224DAAEC1B}\stubpath = "C:\\Windows\\system32\\inogxmhdp.exe" invshckbs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1728E35C-33C3-4c24-BE7F-D0B189EBDFB3} inogxmhdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3261EDA0-8C7F-48db-81D5-5B53B7EAC5C9}\stubpath = "C:\\Windows\\system32\\inruwvobn.exe" invhwkmle.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1CF60B0-D793-4809-AFFB-DE1E5A4B81B3} inxiaqxbm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB35ABA9-16BC-4eb2-BB1A-0329B8954448} indvjzcoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCFC3C91-A22D-403d-B7AB-0B3F193737F2} inwikohfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E6FE4EA-D81C-4c17-87D1-244C3F3D64BD} inuinrlrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6EBB062-A7F0-4735-B327-129767B7DEB7}\stubpath = "C:\\Windows\\system32\\ineupaato.exe" intuwvzao.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B139398-04B5-421c-8E86-D41156AB8F39} inlgwrccv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA8D9DAB-CF2A-4103-8D56-7C8B88510CF2} ingiuiufd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DFADB96-6BA9-41b9-81C3-ED5BE74F3AA2} iniizepdz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15890D7C-CE49-4669-9130-EBB22E28C0A8} invkhejgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C959A02-5FBE-4146-96C5-2DA4B4E96FD6} innjrlbrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FAE46D83-D235-42be-8712-2946E043F3A0} inmzesqny.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9A7D84D-B806-4142-9903-C5D9FDAEC7D5} inuvkxzmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAA5DAC6-78A4-450b-A4B2-966492593A36}\stubpath = "C:\\Windows\\system32\\intojzuff.exe" injfevnir.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFC26619-A519-4e51-BE52-B521E8D1521A}\stubpath = "C:\\Windows\\system32\\inykxcqol.exe" injprzfoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D0ED879-F73E-4e77-9E1B-A5F094E65A6E} ingyagyjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D24D905-EC97-4045-AA2A-2C18B0D9EA6C} inkmhgrmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D349CE01-D0C5-4f37-9FE9-360104105617} ingwzqpxx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C552DD8B-0544-4725-8528-4A94CB7A4200} ingvzmksi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AD390AA-CD86-4165-95D8-5CE4137E26DD}\stubpath = "C:\\Windows\\system32\\inmtiwity.exe" ingvfeugi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF6BCF43-8EE2-4032-9A52-1D3BCB79613F}\stubpath = "C:\\Windows\\system32\\inmvbdomc.exe" inaqceivb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD540911-1B94-4fb8-B8C1-FFDD2130AF55}\stubpath = "C:\\Windows\\system32\\inrbrocsh.exe" inkihxsdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E84DDB27-AB0F-45e1-AA0C-BA52D46765EB} inpsutmlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CFD6926-8E84-45ca-8F23-4071CFF8150E} inyodrton.exe - ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000001b853-2.dat acprotect behavioral2/files/0x000d00000001c48b-28.dat acprotect behavioral2/files/0x000d00000001c490-51.dat acprotect behavioral2/files/0x000d00000001c496-75.dat acprotect behavioral2/files/0x000d00000001c49a-97.dat acprotect behavioral2/files/0x000d00000001c4ae-164.dat acprotect behavioral2/files/0x000d00000001c4b2-184.dat acprotect behavioral2/files/0x000d00000001c4c3-274.dat acprotect behavioral2/files/0x000d00000001c4cf-340.dat acprotect behavioral2/files/0x000d00000001c4cb-318.dat acprotect behavioral2/files/0x000d00000001c4c7-296.dat acprotect behavioral2/files/0x000d00000001c4be-252.dat acprotect behavioral2/files/0x000d00000001c4ba-230.dat acprotect behavioral2/files/0x000d00000001c4b6-208.dat acprotect behavioral2/files/0x000d00000001c4a9-142.dat acprotect behavioral2/files/0x000d00000001c49f-120.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5524 innfvgrkz.exe 5696 invhwkmle.exe 3384 inruwvobn.exe 5692 infumgnyd.exe 3340 inkzrlbas.exe 4248 inpbwqegf.exe 1344 inxtemyti.exe 2848 inyjbrycn.exe 944 inogwahsa.exe 1168 inetlfmxc.exe 2768 inxiaqxbm.exe 708 inoavpdfe.exe 1248 indskelwb.exe 5900 inixpjqgj.exe 3088 inmeufqjy.exe 5556 insezthji.exe 436 inhwoipfi.exe 5948 inhwnltjf.exe 5020 inuqbjvqf.exe 1276 indwztgsi.exe 4148 injyqkarh.exe 5284 inljyapnv.exe 2040 inwsdlxsh.exe 4348 infudswxj.exe 2188 inqmfrmyb.exe 2372 insvxwpco.exe 3700 indtwnmuu.exe 120 inzkcszdo.exe 4844 inaphxbit.exe 3980 inbuxzyre.exe 1960 inxjymong.exe 4216 inmtnbdcu.exe 1624 incrjzdkv.exe 1636 inzvgovkd.exe 1808 inzloqpih.exe 5748 inzhpyfbx.exe 2416 ingvnhoze.exe 1644 inhwfuyzl.exe 2028 innuocedv.exe 4544 invrckwrg.exe 5752 infhthtec.exe 2420 inilcbjwj.exe 2660 inortslka.exe 6120 innlypqcs.exe 1800 inugvjlkd.exe 4496 ingvetxyk.exe 2520 inlhzufqa.exe 2760 infdqdofu.exe 4368 inkbaivic.exe 1476 inixomukg.exe 4748 ineybxzdp.exe 2628 inyufnzuj.exe 4808 inykznpoh.exe 5968 inxsdoolp.exe 1880 inomzqrdt.exe 1832 inopeewva.exe 3300 incgzwjvl.exe 256 inxnqhgoo.exe 4588 inesqmezb.exe 2432 iniqzgcyz.exe 4652 inknedlyl.exe 4904 inbqiycju.exe 4332 insbquvhx.exe 3928 indhxkwmb.exe - Loads dropped DLL 64 IoCs
pid Process 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe 5524 innfvgrkz.exe 5524 innfvgrkz.exe 5696 invhwkmle.exe 5696 invhwkmle.exe 3384 inruwvobn.exe 3384 inruwvobn.exe 5692 infumgnyd.exe 5692 infumgnyd.exe 3340 inkzrlbas.exe 3340 inkzrlbas.exe 4248 inpbwqegf.exe 4248 inpbwqegf.exe 1344 inxtemyti.exe 1344 inxtemyti.exe 2848 inyjbrycn.exe 2848 inyjbrycn.exe 944 inogwahsa.exe 944 inogwahsa.exe 1168 inetlfmxc.exe 1168 inetlfmxc.exe 2768 inxiaqxbm.exe 2768 inxiaqxbm.exe 708 inoavpdfe.exe 708 inoavpdfe.exe 1248 indskelwb.exe 1248 indskelwb.exe 5900 inixpjqgj.exe 5900 inixpjqgj.exe 3088 inmeufqjy.exe 3088 inmeufqjy.exe 5556 insezthji.exe 5556 insezthji.exe 436 inhwoipfi.exe 436 inhwoipfi.exe 5948 inhwnltjf.exe 5948 inhwnltjf.exe 5020 inuqbjvqf.exe 5020 inuqbjvqf.exe 1276 indwztgsi.exe 1276 indwztgsi.exe 4148 injyqkarh.exe 4148 injyqkarh.exe 5284 inljyapnv.exe 5284 inljyapnv.exe 2040 inwsdlxsh.exe 2040 inwsdlxsh.exe 4348 infudswxj.exe 4348 infudswxj.exe 2188 inqmfrmyb.exe 2188 inqmfrmyb.exe 2372 insvxwpco.exe 2372 insvxwpco.exe 3700 indtwnmuu.exe 3700 indtwnmuu.exe 120 inzkcszdo.exe 120 inzkcszdo.exe 4844 inaphxbit.exe 4844 inaphxbit.exe 3980 inbuxzyre.exe 3980 inbuxzyre.exe 1960 inxjymong.exe 1960 inxjymong.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inbohznex.exe_lang.ini inaivxrqr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyoqadam.exe File created C:\Windows\SysWOW64\innuocedv.exe inhwfuyzl.exe File opened for modification C:\Windows\SysWOW64\inykmqjhq.exe_lang.ini inuwftrhn.exe File created C:\Windows\SysWOW64\inhqlgymf.exe infmbihgy.exe File created C:\Windows\SysWOW64\inmrhdpxe.exe invlbrhjx.exe File created C:\Windows\SysWOW64\inuiybnpg.exe inmktaxgs.exe File created C:\Windows\SysWOW64\inbkyszdb.exe inqpqfsux.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inldtepix.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrlmbbts.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpiofygs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkzrlbas.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infhthtec.exe File opened for modification C:\Windows\SysWOW64\inxjymong.exe_lang.ini inbuxzyre.exe File opened for modification C:\Windows\SysWOW64\inomzqrdt.exe_lang.ini inxsdoolp.exe File created C:\Windows\SysWOW64\inaexuhtj.exe inecpcnet.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incanalcr.exe File opened for modification C:\Windows\SysWOW64\inmwcesvx.exe_lang.ini invgvfzue.exe File opened for modification C:\Windows\SysWOW64\insezthji.exe_lang.ini inmeufqjy.exe File created C:\Windows\SysWOW64\inwgusogd.exe inkmpnlpp.exe File opened for modification C:\Windows\SysWOW64\ingyagyjp.exe_lang.ini inrvkfwvq.exe File opened for modification C:\Windows\SysWOW64\inlgwrccv.exe_lang.ini inhoiekzn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inocokdvj.exe File created C:\Windows\SysWOW64\inmtiwity.exe ingvfeugi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inykxcqol.exe File created C:\Windows\SysWOW64\inbmkzbqa.exe inbmmjnwc.exe File opened for modification C:\Windows\SysWOW64\inhegsgsd.exe_lang.ini inqtvunam.exe File created C:\Windows\SysWOW64\infsuonoj.exe iniszaxor.exe File created C:\Windows\SysWOW64\inspmpjxs.exe infrgispe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhvtxxbv.exe File created C:\Windows\SysWOW64\inbohznex.exe inaivxrqr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmkxopbr.exe File created C:\Windows\SysWOW64\insrzztuj.exe intxcqoxe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqcxrfhg.exe File opened for modification C:\Windows\SysWOW64\inqzaupvo.exe_lang.ini invpovkyk.exe File created C:\Windows\SysWOW64\inytozkkh.exe indjvakex.exe File opened for modification C:\Windows\SysWOW64\inqxvmprs.exe_lang.ini innptoush.exe File opened for modification C:\Windows\SysWOW64\syslog.dat iniwaqpwa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inatybwnb.exe File created C:\Windows\SysWOW64\inrkqhiua.exe inpkvggzd.exe File opened for modification C:\Windows\SysWOW64\inmeufqjy.exe_lang.ini inixpjqgj.exe File created C:\Windows\SysWOW64\invuwaxma.exe ingwzqpxx.exe File opened for modification C:\Windows\SysWOW64\inztjzmib.exe_lang.ini inoyokzfp.exe File opened for modification C:\Windows\SysWOW64\inxtleici.exe_lang.ini inttrrtqn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inefvqvoa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmeufqjy.exe File opened for modification C:\Windows\SysWOW64\incvyzsfr.exe_lang.ini incanalcr.exe File created C:\Windows\SysWOW64\inhiypoew.exe incsnrmiw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innpkjuac.exe File opened for modification C:\Windows\SysWOW64\inpkvggzd.exe_lang.ini inokbwlsa.exe File opened for modification C:\Windows\SysWOW64\innvcvbrm.exe_lang.ini inqbcmcsv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwmpgfnn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insnyjjgx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inshvhsxn.exe File created C:\Windows\SysWOW64\incxuerhz.exe inonisjqf.exe File created C:\Windows\SysWOW64\injrhdzvq.exe inaexuhtj.exe File created C:\Windows\SysWOW64\inauxfdek.exe inrmslxzd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inktojpiu.exe File created C:\Windows\SysWOW64\intnwkasd.exe inqqspmro.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqhodfle.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoavpdfe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqgdzfrf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqnbrgit.exe File opened for modification C:\Windows\SysWOW64\inbbkvfva.exe_lang.ini inrhnxdft.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insohtodl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injdwyyif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innikicxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlyubtu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkveoutv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmosntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoyokzfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invlhtipl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inonisjqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsvmltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuvxhdct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdhyock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtemyti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innpclapa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxndtjlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewhnrej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhsblrqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invpovkyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclzteci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intojzuff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intlkfhrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqbcmcsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkihxsdk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indhxkwmb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykmqjhq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inudpxert.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisglpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqcxrfhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innezahdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indumhqih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incybtpgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invuwaxma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjudnts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intsuvkkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbmmbxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inctckufj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbrocsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsdlxsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwylczx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intetdxsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowqgwxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inergdafx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inndiulal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzfhvydh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkvggzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgaoyjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhvtxxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhrycguw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indscwrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuydrpyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnxzhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowmiavg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invawifmu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inazpsjiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzzbyva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlolxmlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuinrlrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzjwmbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbkvfva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqjpgzht.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe 5524 innfvgrkz.exe 5524 innfvgrkz.exe 5696 invhwkmle.exe 5696 invhwkmle.exe 3384 inruwvobn.exe 3384 inruwvobn.exe 5692 infumgnyd.exe 5692 infumgnyd.exe 3340 inkzrlbas.exe 3340 inkzrlbas.exe 4248 inpbwqegf.exe 4248 inpbwqegf.exe 1344 inxtemyti.exe 1344 inxtemyti.exe 2848 inyjbrycn.exe 2848 inyjbrycn.exe 944 inogwahsa.exe 944 inogwahsa.exe 1168 inetlfmxc.exe 1168 inetlfmxc.exe 2768 inxiaqxbm.exe 2768 inxiaqxbm.exe 708 inoavpdfe.exe 708 inoavpdfe.exe 1248 indskelwb.exe 1248 indskelwb.exe 5900 inixpjqgj.exe 5900 inixpjqgj.exe 3088 inmeufqjy.exe 3088 inmeufqjy.exe 5556 insezthji.exe 5556 insezthji.exe 436 inhwoipfi.exe 436 inhwoipfi.exe 5948 inhwnltjf.exe 5948 inhwnltjf.exe 5020 inuqbjvqf.exe 5020 inuqbjvqf.exe 1276 indwztgsi.exe 1276 indwztgsi.exe 4148 injyqkarh.exe 4148 injyqkarh.exe 5284 inljyapnv.exe 5284 inljyapnv.exe 2040 inwsdlxsh.exe 2040 inwsdlxsh.exe 4348 infudswxj.exe 4348 infudswxj.exe 2188 inqmfrmyb.exe 2188 inqmfrmyb.exe 2372 insvxwpco.exe 2372 insvxwpco.exe 3700 indtwnmuu.exe 3700 indtwnmuu.exe 120 inzkcszdo.exe 120 inzkcszdo.exe 4844 inaphxbit.exe 4844 inaphxbit.exe 3980 inbuxzyre.exe 3980 inbuxzyre.exe 1960 inxjymong.exe 1960 inxjymong.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe Token: SeDebugPrivilege 5524 innfvgrkz.exe Token: SeDebugPrivilege 5696 invhwkmle.exe Token: SeDebugPrivilege 3384 inruwvobn.exe Token: SeDebugPrivilege 5692 infumgnyd.exe Token: SeDebugPrivilege 3340 inkzrlbas.exe Token: SeDebugPrivilege 4248 inpbwqegf.exe Token: SeDebugPrivilege 1344 inxtemyti.exe Token: SeDebugPrivilege 2848 inyjbrycn.exe Token: SeDebugPrivilege 944 inogwahsa.exe Token: SeDebugPrivilege 1168 inetlfmxc.exe Token: SeDebugPrivilege 2768 inxiaqxbm.exe Token: SeDebugPrivilege 708 inoavpdfe.exe Token: SeDebugPrivilege 1248 indskelwb.exe Token: SeDebugPrivilege 5900 inixpjqgj.exe Token: SeDebugPrivilege 3088 inmeufqjy.exe Token: SeDebugPrivilege 5556 insezthji.exe Token: SeDebugPrivilege 436 inhwoipfi.exe Token: SeDebugPrivilege 5948 inhwnltjf.exe Token: SeDebugPrivilege 5020 inuqbjvqf.exe Token: SeDebugPrivilege 1276 indwztgsi.exe Token: SeDebugPrivilege 4148 injyqkarh.exe Token: SeDebugPrivilege 5284 inljyapnv.exe Token: SeDebugPrivilege 2040 inwsdlxsh.exe Token: SeDebugPrivilege 4348 infudswxj.exe Token: SeDebugPrivilege 2188 inqmfrmyb.exe Token: SeDebugPrivilege 2372 insvxwpco.exe Token: SeDebugPrivilege 3700 indtwnmuu.exe Token: SeDebugPrivilege 120 inzkcszdo.exe Token: SeDebugPrivilege 4844 inaphxbit.exe Token: SeDebugPrivilege 3980 inbuxzyre.exe Token: SeDebugPrivilege 1960 inxjymong.exe Token: SeDebugPrivilege 4216 inmtnbdcu.exe Token: SeDebugPrivilege 1624 incrjzdkv.exe Token: SeDebugPrivilege 1636 inzvgovkd.exe Token: SeDebugPrivilege 1808 inzloqpih.exe Token: SeDebugPrivilege 5748 inzhpyfbx.exe Token: SeDebugPrivilege 2416 ingvnhoze.exe Token: SeDebugPrivilege 1644 inhwfuyzl.exe Token: SeDebugPrivilege 2028 innuocedv.exe Token: SeDebugPrivilege 4544 invrckwrg.exe Token: SeDebugPrivilege 5752 infhthtec.exe Token: SeDebugPrivilege 2420 inilcbjwj.exe Token: SeDebugPrivilege 2660 inortslka.exe Token: SeDebugPrivilege 6120 innlypqcs.exe Token: SeDebugPrivilege 1800 inugvjlkd.exe Token: SeDebugPrivilege 4496 ingvetxyk.exe Token: SeDebugPrivilege 2520 inlhzufqa.exe Token: SeDebugPrivilege 2760 infdqdofu.exe Token: SeDebugPrivilege 4368 inkbaivic.exe Token: SeDebugPrivilege 1476 inixomukg.exe Token: SeDebugPrivilege 4748 ineybxzdp.exe Token: SeDebugPrivilege 2628 inyufnzuj.exe Token: SeDebugPrivilege 4808 inykznpoh.exe Token: SeDebugPrivilege 5968 inxsdoolp.exe Token: SeDebugPrivilege 1880 inomzqrdt.exe Token: SeDebugPrivilege 1832 inopeewva.exe Token: SeDebugPrivilege 3300 incgzwjvl.exe Token: SeDebugPrivilege 256 inxnqhgoo.exe Token: SeDebugPrivilege 4588 inesqmezb.exe Token: SeDebugPrivilege 2432 iniqzgcyz.exe Token: SeDebugPrivilege 4652 inknedlyl.exe Token: SeDebugPrivilege 4904 inbqiycju.exe Token: SeDebugPrivilege 4332 insbquvhx.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe 5524 innfvgrkz.exe 5696 invhwkmle.exe 3384 inruwvobn.exe 5692 infumgnyd.exe 3340 inkzrlbas.exe 4248 inpbwqegf.exe 1344 inxtemyti.exe 2848 inyjbrycn.exe 944 inogwahsa.exe 1168 inetlfmxc.exe 2768 inxiaqxbm.exe 708 inoavpdfe.exe 1248 indskelwb.exe 5900 inixpjqgj.exe 3088 inmeufqjy.exe 5556 insezthji.exe 436 inhwoipfi.exe 5948 inhwnltjf.exe 5020 inuqbjvqf.exe 1276 indwztgsi.exe 4148 injyqkarh.exe 5284 inljyapnv.exe 2040 inwsdlxsh.exe 4348 infudswxj.exe 2188 inqmfrmyb.exe 2372 insvxwpco.exe 3700 indtwnmuu.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 5524 4440 2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe 89 PID 5524 wrote to memory of 5696 5524 innfvgrkz.exe 90 PID 5696 wrote to memory of 3384 5696 invhwkmle.exe 91 PID 3384 wrote to memory of 5692 3384 inruwvobn.exe 92 PID 5692 wrote to memory of 3340 5692 infumgnyd.exe 93 PID 3340 wrote to memory of 4248 3340 inkzrlbas.exe 94 PID 4248 wrote to memory of 1344 4248 inpbwqegf.exe 95 PID 1344 wrote to memory of 2848 1344 inxtemyti.exe 96 PID 2848 wrote to memory of 944 2848 inyjbrycn.exe 97 PID 944 wrote to memory of 1168 944 inogwahsa.exe 98 PID 1168 wrote to memory of 2768 1168 inetlfmxc.exe 99 PID 2768 wrote to memory of 708 2768 inxiaqxbm.exe 100 PID 708 wrote to memory of 1248 708 inoavpdfe.exe 101 PID 1248 wrote to memory of 5900 1248 indskelwb.exe 102 PID 5900 wrote to memory of 3088 5900 inixpjqgj.exe 103 PID 3088 wrote to memory of 5556 3088 inmeufqjy.exe 104 PID 5556 wrote to memory of 436 5556 insezthji.exe 105 PID 436 wrote to memory of 5948 436 inhwoipfi.exe 106 PID 5948 wrote to memory of 5020 5948 inhwnltjf.exe 107 PID 5020 wrote to memory of 1276 5020 inuqbjvqf.exe 108 PID 1276 wrote to memory of 4148 1276 indwztgsi.exe 109 PID 4148 wrote to memory of 5284 4148 injyqkarh.exe 110 PID 5284 wrote to memory of 2040 5284 inljyapnv.exe 111 PID 2040 wrote to memory of 4348 2040 inwsdlxsh.exe 112 PID 4348 wrote to memory of 2188 4348 infudswxj.exe 113 PID 2188 wrote to memory of 2372 2188 inqmfrmyb.exe 114 PID 2372 wrote to memory of 3700 2372 insvxwpco.exe 115 PID 3700 wrote to memory of 120 3700 indtwnmuu.exe 116 PID 120 wrote to memory of 4844 120 inzkcszdo.exe 117 PID 4844 wrote to memory of 3980 4844 inaphxbit.exe 118 PID 3980 wrote to memory of 1960 3980 inbuxzyre.exe 119 PID 1960 wrote to memory of 4216 1960 inxjymong.exe 120 PID 4216 wrote to memory of 1624 4216 inmtnbdcu.exe 121 PID 1624 wrote to memory of 1636 1624 incrjzdkv.exe 122 PID 1636 wrote to memory of 1808 1636 inzvgovkd.exe 123 PID 1808 wrote to memory of 5748 1808 inzloqpih.exe 124 PID 5748 wrote to memory of 2416 5748 inzhpyfbx.exe 125 PID 2416 wrote to memory of 1644 2416 ingvnhoze.exe 126 PID 1644 wrote to memory of 2028 1644 inhwfuyzl.exe 127 PID 2028 wrote to memory of 4544 2028 innuocedv.exe 128 PID 4544 wrote to memory of 5752 4544 invrckwrg.exe 129 PID 5752 wrote to memory of 2420 5752 infhthtec.exe 130 PID 2420 wrote to memory of 2660 2420 inilcbjwj.exe 131 PID 2660 wrote to memory of 6120 2660 inortslka.exe 132 PID 6120 wrote to memory of 1800 6120 innlypqcs.exe 133 PID 1800 wrote to memory of 4496 1800 inugvjlkd.exe 134 PID 4496 wrote to memory of 2520 4496 ingvetxyk.exe 135 PID 2520 wrote to memory of 2760 2520 inlhzufqa.exe 136 PID 2760 wrote to memory of 4368 2760 infdqdofu.exe 137 PID 4368 wrote to memory of 1476 4368 inkbaivic.exe 138 PID 1476 wrote to memory of 4748 1476 inixomukg.exe 139 PID 4748 wrote to memory of 2628 4748 ineybxzdp.exe 140 PID 2628 wrote to memory of 4808 2628 inyufnzuj.exe 141 PID 4808 wrote to memory of 5968 4808 inykznpoh.exe 142 PID 5968 wrote to memory of 1880 5968 inxsdoolp.exe 143 PID 1880 wrote to memory of 1832 1880 inomzqrdt.exe 144 PID 1832 wrote to memory of 3300 1832 inopeewva.exe 145 PID 3300 wrote to memory of 256 3300 incgzwjvl.exe 146 PID 256 wrote to memory of 4588 256 inxnqhgoo.exe 147 PID 4588 wrote to memory of 2432 4588 inesqmezb.exe 148 PID 2432 wrote to memory of 4652 2432 iniqzgcyz.exe 149 PID 4652 wrote to memory of 4904 4652 inknedlyl.exe 150 PID 4904 wrote to memory of 4332 4904 inbqiycju.exe 151 PID 4332 wrote to memory of 3928 4332 insbquvhx.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_68756f6469b0c98824aa972378ae4c6a_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\inzhpyfbx.exeC:\Windows\system32\inzhpyfbx.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe41⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe59⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe66⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3984 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe67⤵
- Drops file in System32 directory
PID:4976 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe68⤵
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe69⤵PID:2064
-
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe70⤵
- System Location Discovery: System Language Discovery
PID:5528 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe71⤵
- Drops file in System32 directory
PID:3364 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe72⤵
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe73⤵PID:5268
-
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe74⤵PID:3912
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe75⤵PID:1140
-
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe76⤵PID:5604
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe77⤵PID:2020
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe78⤵
- Drops file in System32 directory
PID:988 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe79⤵PID:1456
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe80⤵PID:3184
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe81⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5624 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe82⤵PID:796
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe83⤵PID:3056
-
C:\Windows\SysWOW64\inbmmjnwc.exeC:\Windows\system32\inbmmjnwc.exe84⤵
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe85⤵PID:3396
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe86⤵PID:5108
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe87⤵PID:2688
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2140 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe89⤵PID:2724
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe90⤵
- Drops file in System32 directory
PID:1812 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe91⤵PID:5792
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe92⤵
- Drops file in System32 directory
PID:1852 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe93⤵PID:2592
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe94⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3936 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe95⤵
- Drops file in System32 directory
PID:240 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe96⤵
- Drops file in System32 directory
PID:600 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe97⤵PID:4864
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe98⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:1284 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe99⤵
- System Location Discovery: System Language Discovery
PID:5592 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe100⤵PID:5980
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe101⤵PID:3412
-
C:\Windows\SysWOW64\inrhnxdft.exeC:\Windows\system32\inrhnxdft.exe102⤵
- Drops file in System32 directory
PID:5768 -
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe103⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe104⤵PID:3292
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe105⤵
- Drops file in System32 directory
PID:4316 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe106⤵PID:5928
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe107⤵PID:4528
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe108⤵PID:2868
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe109⤵PID:2764
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe110⤵
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe111⤵PID:2920
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe112⤵PID:4952
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe113⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4828 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe114⤵PID:2620
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe115⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\iniizepdz.exeC:\Windows\system32\iniizepdz.exe116⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1224 -
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe117⤵
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe118⤵PID:2820
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe119⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4580 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe120⤵PID:1204
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe121⤵PID:1452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-