Analysis
- max time kernel
58s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 16:20
Behavioral task
behavioral1
Sample
2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe
- Size 348KB
- Sample260925-ttd75a1blc
- SHA256 4ec3652126c4573373573d5192d8abaa50155ea90e4a2c4d828e603be15656f9
- MD5 09d897e075e18d3142af31af110f9587
- SHA1 db7db15efb592943bc94a1188c0fe16791822124
- SHA512 7176a5eba44e338e1b5c22f4cde9db8416ac52e33f7efc0ac2edb9882b63165e3057c9b025d774ade21cc045e5cdc132bcc7c037d7637d888e38c1fb3a91dc22
- SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0Sz:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0n
- TLSH T15174DF01BEE640F9EAF8003C30FB2776963B6898FB085FD36319EA751837555E632256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 47 IoCs
resource yara_rule behavioral2/memory/2072-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e7-19.dat family_gh0strat behavioral2/memory/2072-21-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4eb-33.dat family_gh0strat behavioral2/files/0x000d00000001c4ec-44.dat family_gh0strat behavioral2/files/0x000d00000001c4f2-67.dat family_gh0strat behavioral2/files/0x000d00000001c4f7-89.dat family_gh0strat behavioral2/files/0x000d00000001c4fd-113.dat family_gh0strat behavioral2/memory/6096-117-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c501-135.dat family_gh0strat behavioral2/memory/4424-139-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c506-156.dat family_gh0strat behavioral2/memory/364-161-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50a-179.dat family_gh0strat behavioral2/files/0x000d00000001c519-222.dat family_gh0strat behavioral2/files/0x000d00000001c51e-244.dat family_gh0strat behavioral2/files/0x000d00000001c522-266.dat family_gh0strat behavioral2/files/0x000d00000001c52a-310.dat family_gh0strat behavioral2/memory/5656-395-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1120-593-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2972-575-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4576-557-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2708-539-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3460-521-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3036-503-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2352-485-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2372-467-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4868-449-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5428-431-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4288-413-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4828-377-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2956-359-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c533-355.dat family_gh0strat behavioral2/memory/988-337-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c52e-333.dat family_gh0strat behavioral2/memory/2092-315-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1076-293-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c526-289.dat family_gh0strat behavioral2/memory/2980-270-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5164-247-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1460-227-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4400-205-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c514-201.dat family_gh0strat behavioral2/memory/1240-183-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5116-93-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4580-70-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5256-60-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{339E8DD2-5EE5-42b1-8553-5A023DEEC7AF} inaaajueu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6EB58A1-9C48-4bac-BA35-F2E4B8FC2101} inzbahzkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F956B54F-41F3-48ae-BC68-8AC0AE65EA75} inyvsxuru.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB51C6E5-D17A-4166-BB3F-A506A32AC7B5} inbjudnts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AFCFFE0-DA9C-47b1-A079-76BA5E6468E3}\stubpath = "C:\\Windows\\system32\\inwyzbftn.exe" indqsmlmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E5F4B74-EF01-4ca0-91ED-F3EF8471993F}\stubpath = "C:\\Windows\\system32\\inykmqjhq.exe" inkuaczqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE1A4820-14F0-4e68-AD50-B5F55D037AC7} ingkycsra.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CFB45E3-5B02-4535-B9AC-2A2CE926578E} inghrhxds.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{954F5FEA-7876-494a-9EE8-35F171CF0CA0} inxiaqxbm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{957C13F6-64F9-4ddc-879D-26FCE7E06B4C} invbdruwx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17218A3B-F267-4c4e-A174-FB99E0A1DC64}\stubpath = "C:\\Windows\\system32\\incsnrmiw.exe" indvjzcoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{952803EA-B5F8-4c62-8B8F-0E7C19A82445} inspmpjxs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BC56786-DB88-4887-8118-D6FE82B6629B} inauxfdek.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16CA8A4F-4EFB-4450-9587-AB3B01C8C877} inebgydau.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53DDEF70-A290-44be-A67D-0F1690A4A549} invhwkmle.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD6A8AFF-7FF3-443c-A8D9-352E89BE0E99} ineeenyiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71C9A5F0-B4BE-4b0f-8BF1-2D3C007028DD}\stubpath = "C:\\Windows\\system32\\innptoush.exe" inyteppma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D3BA623-ADAB-4135-A1FC-417977284A7E}\stubpath = "C:\\Windows\\system32\\injyiwuqi.exe" intbosajb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CE1B54E-B480-4ced-96CA-E409D283A138} inctpigdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26CAE4F4-C3DE-48de-B71F-424DA20FFEB5} 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BE9898C-A626-40d3-886F-AC3FF9BCAF17}\stubpath = "C:\\Windows\\system32\\inqgdzfrf.exe" insohtodl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFF045A8-D0C9-4830-A5F6-D5C1B205AA71} inwyzbftn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{937F3197-622B-4962-8F9C-57D34C717774}\stubpath = "C:\\Windows\\system32\\inttrrtqn.exe" inckekwln.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FAAB6DB-BE34-43c7-9BFF-DE4243CDB988} inqzfhsqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A9AED0A-3B94-4c18-B6E2-A45DF7A2A817}\stubpath = "C:\\Windows\\system32\\inbfffozj.exe" intqwjtdz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CD14A2E-CF02-48db-A524-480EB7381ED3}\stubpath = "C:\\Windows\\system32\\invbdruwx.exe" inrshhzyd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D007DAB0-7196-4e3b-B143-C4FD9D2052FD}\stubpath = "C:\\Windows\\system32\\indlyubtu.exe" inuwegjgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{294A50F5-F4FA-4cf3-A16C-81F06FED2DE6}\stubpath = "C:\\Windows\\system32\\inhwfuyzl.exe" incgncjih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A9F2F11-996B-4090-82AA-B3CCA63790BB} invspsmvj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98374184-CF35-4d62-B3BA-770AF0C6DDF5}\stubpath = "C:\\Windows\\system32\\inogwahsa.exe" inaikwkwh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{035186A0-4BF1-4c04-AB74-E335D88B274C} inzhpyfbx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7EBAE7D-9374-411d-A580-C8C62CDF449B} innhouwkt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8B23DE1-394C-429d-8EA5-1B46D406D118} indqezurm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{983EA2CC-825C-40d2-B03F-7074076860D5} inwskdhbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{958FE1AF-19D5-4398-AD36-CBAADCEC60DF}\stubpath = "C:\\Windows\\system32\\inmwcesvx.exe" inwauuwtq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7BA0B9F3-F659-4127-9243-498C10299BB2} inhwzdpqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9420F7E9-0559-4df7-BE07-D101C8605594} insywlfel.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11AC2BBF-662E-4490-BBB3-E978DFC14463} ininzqfqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99919EA7-199B-403a-8E54-BA1E4D4C914A} inmvbdomc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCD57930-4DDA-4316-84AD-16D6A9B0656C} infacmfam.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBDCB993-DBBB-42c7-9F7F-38424CA35870} inkmpnlpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CDA0480-CA41-4502-913F-ADEBBDD826FB} inwtdautu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E670AB8-07F6-4f65-A394-980800F77E9A} insrzztuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AD96FA9-7BD6-4544-A630-38A8FC881E56}\stubpath = "C:\\Windows\\system32\\inniyteex.exe" indtosnaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB62A1B-0C9A-46e6-8276-2C49D8B256A3} inktbmkag.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F170C18E-9788-42a9-ADDD-332C414B9C45} infslrijv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CB4C219-A1A9-4b71-A3D0-1FFA18B25C5A} inetlfmxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4662BE4B-5518-45e5-99F7-0595EA8BA850} inmibthrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17BE05CA-8179-463b-BBE8-A80DCCD6FCF5} injfqeotx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F89DE95-A794-48b3-9090-9ECE5774B923} inhgwhjlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A588D2BB-6835-4acc-B628-CF6D942376CC}\stubpath = "C:\\Windows\\system32\\inhpdyhbh.exe" injqkgmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B35A336-4103-4781-AA04-6975DB61B7F2}\stubpath = "C:\\Windows\\system32\\inekspwho.exe" inuizasnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AABD06B-A041-4ab3-A3CF-2E5D00E27CFC} invqlwhhe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDCBBF3D-7DEC-4a13-A39A-DC5128E4E2DE}\stubpath = "C:\\Windows\\system32\\inykznpoh.exe" inqswbpnw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE79A50F-01DD-4f20-AB81-5791C9BD55CC}\stubpath = "C:\\Windows\\system32\\ineamubie.exe" inclzteci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DF1D16E-0698-4d21-8EDB-011FC7FB53E2}\stubpath = "C:\\Windows\\system32\\inewhnrej.exe" indeulkya.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E869DC7C-13FE-4e54-897B-B5B74DDD6144} inazpsjiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB3A9E0A-A6E7-4b65-A13F-984E492AE4E3}\stubpath = "C:\\Windows\\system32\\inhsblrqs.exe" indskelwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB95DC4B-FC1A-4e94-9318-4D60F2FE4A6A} inhnmoqun.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8367DC22-AFCA-42da-9BCD-93575F09F127} innajnacf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F9949AD-5AF4-4fe2-8E00-9EF089C064F8} indtfhlye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12F28BD0-7A0D-40fb-A71C-338848683918}\stubpath = "C:\\Windows\\system32\\inczogbkc.exe" inqpnhcwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B585B6AB-7D97-4804-AF7F-469F889C82FC}\stubpath = "C:\\Windows\\system32\\inzvgovkd.exe" inrdysgih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0328A21-EE66-4aae-ABC9-A803D348419F} inudpxert.exe - ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000001b890-4.dat acprotect behavioral2/files/0x000d00000001c4ea-27.dat acprotect behavioral2/files/0x000d00000001c4ee-48.dat acprotect behavioral2/files/0x000d00000001c50d-186.dat acprotect behavioral2/files/0x000d00000001c520-252.dat acprotect behavioral2/files/0x000d00000001c531-340.dat acprotect behavioral2/files/0x000d00000001c52c-318.dat acprotect behavioral2/files/0x000d00000001c528-296.dat acprotect behavioral2/files/0x000d00000001c524-274.dat acprotect behavioral2/files/0x000d00000001c51b-230.dat acprotect behavioral2/files/0x000d00000001c517-208.dat acprotect behavioral2/files/0x000d00000001c508-164.dat acprotect behavioral2/files/0x000d00000001c503-142.dat acprotect behavioral2/files/0x000d00000001c4ff-120.dat acprotect behavioral2/files/0x000d00000001c4f9-97.dat acprotect behavioral2/files/0x000d00000001c4f5-74.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5256 inaexuhtj.exe 4580 insvxwpco.exe 5116 ingiuiufd.exe 6096 innuocedv.exe 4424 inbuxzyre.exe 364 incgzwjvl.exe 1240 inpbwqegf.exe 4400 inugvjlkd.exe 1460 inldtepix.exe 5164 inbqiycju.exe 2980 ingvnhoze.exe 1076 innqsrkjz.exe 2092 ineybxzdp.exe 988 inqjpgzht.exe 2956 inqmfrmyb.exe 4828 insezthji.exe 5656 inaikwkwh.exe 4288 inogwahsa.exe 5428 inxtemyti.exe 4868 injyqkarh.exe 2372 inoavpdfe.exe 2352 incvyzsfr.exe 3036 indhxkwmb.exe 3460 incanalcr.exe 2708 inhfsfaqh.exe 4576 inlsmacbt.exe 2972 inqcxrfhg.exe 1120 indwztgsi.exe 248 inpleqlxa.exe 1204 inrdysgih.exe 2880 inzvgovkd.exe 4896 inmtnbdcu.exe 4264 inazpsjiq.exe 5900 intpaiupe.exe 5332 inpsutmlb.exe 6112 invhwkmle.exe 3108 inmprqjiy.exe 356 inxnqhgoo.exe 2560 incsvmltt.exe 2148 inigtklnv.exe 6040 inuqbjvqf.exe 1180 inhegsgsd.exe 3352 inxiaqxbm.exe 2240 intsuvkkg.exe 1388 inyorihpp.exe 2664 inyufnzuj.exe 1980 injmdckxk.exe 6016 injkrqgyq.exe 1200 infumgnyd.exe 940 inkzrlbas.exe 5660 innlypqcs.exe 5560 infhthtec.exe 3172 inkbaivic.exe 4224 inljyapnv.exe 4960 inwsdlxsh.exe 2792 inwixlnmf.exe 3452 inefvmlzb.exe 4432 inmkxopbr.exe 4768 indskelwb.exe 4524 inhsblrqs.exe 2648 inxtleici.exe 1416 insohtodl.exe 5048 inqgdzfrf.exe 596 inxjymong.exe - Loads dropped DLL 64 IoCs
pid Process 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe 5256 inaexuhtj.exe 5256 inaexuhtj.exe 4580 insvxwpco.exe 4580 insvxwpco.exe 5116 ingiuiufd.exe 5116 ingiuiufd.exe 6096 innuocedv.exe 6096 innuocedv.exe 4424 inbuxzyre.exe 4424 inbuxzyre.exe 364 incgzwjvl.exe 364 incgzwjvl.exe 1240 inpbwqegf.exe 1240 inpbwqegf.exe 4400 inugvjlkd.exe 4400 inugvjlkd.exe 1460 inldtepix.exe 1460 inldtepix.exe 5164 inbqiycju.exe 5164 inbqiycju.exe 2980 ingvnhoze.exe 2980 ingvnhoze.exe 1076 innqsrkjz.exe 1076 innqsrkjz.exe 2092 ineybxzdp.exe 2092 ineybxzdp.exe 988 inqjpgzht.exe 988 inqjpgzht.exe 2956 inqmfrmyb.exe 2956 inqmfrmyb.exe 4828 insezthji.exe 4828 insezthji.exe 5656 inaikwkwh.exe 5656 inaikwkwh.exe 4288 inogwahsa.exe 4288 inogwahsa.exe 5428 inxtemyti.exe 5428 inxtemyti.exe 4868 injyqkarh.exe 4868 injyqkarh.exe 2372 inoavpdfe.exe 2372 inoavpdfe.exe 2352 incvyzsfr.exe 2352 incvyzsfr.exe 3036 indhxkwmb.exe 3036 indhxkwmb.exe 3460 incanalcr.exe 3460 incanalcr.exe 2708 inhfsfaqh.exe 2708 inhfsfaqh.exe 4576 inlsmacbt.exe 4576 inlsmacbt.exe 2972 inqcxrfhg.exe 2972 inqcxrfhg.exe 1120 indwztgsi.exe 1120 indwztgsi.exe 248 inpleqlxa.exe 248 inpleqlxa.exe 1204 inrdysgih.exe 1204 inrdysgih.exe 2880 inzvgovkd.exe 2880 inzvgovkd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inmprqjiy.exe_lang.ini invhwkmle.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intfuikjc.exe File created C:\Windows\SysWOW64\indtwnmuu.exe indpalewk.exe File opened for modification C:\Windows\SysWOW64\ineamubie.exe_lang.ini inclzteci.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyqkarh.exe File opened for modification C:\Windows\SysWOW64\inuqbjvqf.exe_lang.ini inigtklnv.exe File opened for modification C:\Windows\SysWOW64\insnyjjgx.exe_lang.ini inmnccutj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inykmqjhq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invqlrkwy.exe File opened for modification C:\Windows\SysWOW64\insbznvcp.exe_lang.ini inquussur.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inboqtdrp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhscspdt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuydrpyf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoavpdfe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhegsgsd.exe File created C:\Windows\SysWOW64\invqlrkwy.exe inboqtqar.exe File opened for modification C:\Windows\SysWOW64\invmdukgq.exe_lang.ini inuytzxmg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat iniszaxor.exe File opened for modification C:\Windows\SysWOW64\inqcxrfhg.exe_lang.ini inlsmacbt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaivxrqr.exe File created C:\Windows\SysWOW64\inniyteex.exe indtosnaj.exe File created C:\Windows\SysWOW64\inuwegjgs.exe inenraymu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaphxbit.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incpcgxnb.exe File created C:\Windows\SysWOW64\inyvsxuru.exe inxndtjlz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuizasnp.exe File created C:\Windows\SysWOW64\inwixlnmf.exe inwsdlxsh.exe File opened for modification C:\Windows\SysWOW64\infrfqjpo.exe_lang.ini inlhzufqa.exe File opened for modification C:\Windows\SysWOW64\inbrulkss.exe_lang.ini inbnjcuis.exe File created C:\Windows\SysWOW64\inyjbrycn.exe inwmcsiky.exe File created C:\Windows\SysWOW64\inaphxbit.exe inhwfuyzl.exe File created C:\Windows\SysWOW64\intmsjkwc.exe inncprues.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaouaylq.exe File opened for modification C:\Windows\SysWOW64\inmzfdmqx.exe_lang.ini inaouaylq.exe File created C:\Windows\SysWOW64\inpqffxwb.exe inetlfmxc.exe File created C:\Windows\SysWOW64\insrzztuj.exe intcrvwiy.exe File opened for modification C:\Windows\SysWOW64\ingtgabri.exe_lang.ini inyaereiz.exe File opened for modification C:\Windows\SysWOW64\inwmcsiky.exe_lang.ini inwyzbftn.exe File created C:\Windows\SysWOW64\inaqceivb.exe inngmlnpt.exe File opened for modification C:\Windows\SysWOW64\invtcqgup.exe_lang.ini intojzuff.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyvsxuru.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkxmjgli.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlsmacbt.exe File opened for modification C:\Windows\SysWOW64\inzvgovkd.exe_lang.ini inrdysgih.exe File opened for modification C:\Windows\SysWOW64\injkrqgyq.exe_lang.ini injmdckxk.exe File created C:\Windows\SysWOW64\inyczocok.exe inirmhzng.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqrggyxc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inblsqhkm.exe File created C:\Windows\SysWOW64\infhrodsv.exe invudbffq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inufqaqnb.exe File opened for modification C:\Windows\SysWOW64\infdqdofu.exe_lang.ini inqtvunam.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlaxcmgz.exe File created C:\Windows\SysWOW64\inipelkjl.exe inlvjosms.exe File created C:\Windows\SysWOW64\incybtpgq.exe inowqgwxz.exe File opened for modification C:\Windows\SysWOW64\injtvdfif.exe_lang.ini inyvsxuru.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invdmeyvk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuprejup.exe File created C:\Windows\SysWOW64\indlvgkyq.exe inzzjgeaz.exe File created C:\Windows\SysWOW64\inmeufqjy.exe inxjymong.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkivmnpx.exe File opened for modification C:\Windows\SysWOW64\incraptug.exe_lang.ini infxiosfk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzhpyfbx.exe File created C:\Windows\SysWOW64\innusjmop.exe inmflkmos.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmrhdpxe.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incgncjih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilcbjwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuinrlrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infyeupzm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inertnmni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzydrlkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inghxondz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhuwzjax.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inivlaoql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvzmksi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczeboin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdhyock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhiypoew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inidwdyvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtnbdcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjwysrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthxpach.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebgydau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwezqep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomvcziu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingkycsra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injsnioht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injrhdzvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvqbbup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhqyjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incraptug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkoozmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvqwujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmgmynpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsbjtei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuxzyre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injqkgmph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inarenvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqceivb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvjzcoq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuytzxmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqgiwze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsnrmiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniqzgcyz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbxslgig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invwyxcqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrtwgusw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insulctjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyccnaan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgusiod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inciujlvs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzyhfjju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inecpcnet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inknedlyl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrqyyst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzbahzkq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyixbhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrkqhiua.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe 5256 inaexuhtj.exe 5256 inaexuhtj.exe 4580 insvxwpco.exe 4580 insvxwpco.exe 5116 ingiuiufd.exe 5116 ingiuiufd.exe 6096 innuocedv.exe 6096 innuocedv.exe 4424 inbuxzyre.exe 4424 inbuxzyre.exe 364 incgzwjvl.exe 364 incgzwjvl.exe 1240 inpbwqegf.exe 1240 inpbwqegf.exe 4400 inugvjlkd.exe 4400 inugvjlkd.exe 1460 inldtepix.exe 1460 inldtepix.exe 5164 inbqiycju.exe 5164 inbqiycju.exe 2980 ingvnhoze.exe 2980 ingvnhoze.exe 1076 innqsrkjz.exe 1076 innqsrkjz.exe 2092 ineybxzdp.exe 2092 ineybxzdp.exe 988 inqjpgzht.exe 988 inqjpgzht.exe 2956 inqmfrmyb.exe 2956 inqmfrmyb.exe 4828 insezthji.exe 4828 insezthji.exe 5656 inaikwkwh.exe 5656 inaikwkwh.exe 4288 inogwahsa.exe 4288 inogwahsa.exe 5428 inxtemyti.exe 5428 inxtemyti.exe 4868 injyqkarh.exe 4868 injyqkarh.exe 2372 inoavpdfe.exe 2372 inoavpdfe.exe 2352 incvyzsfr.exe 2352 incvyzsfr.exe 3036 indhxkwmb.exe 3036 indhxkwmb.exe 3460 incanalcr.exe 3460 incanalcr.exe 2708 inhfsfaqh.exe 2708 inhfsfaqh.exe 4576 inlsmacbt.exe 4576 inlsmacbt.exe 2972 inqcxrfhg.exe 2972 inqcxrfhg.exe 1120 indwztgsi.exe 1120 indwztgsi.exe 248 inpleqlxa.exe 248 inpleqlxa.exe 1204 inrdysgih.exe 1204 inrdysgih.exe 2880 inzvgovkd.exe 2880 inzvgovkd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe Token: SeDebugPrivilege 5256 inaexuhtj.exe Token: SeDebugPrivilege 4580 insvxwpco.exe Token: SeDebugPrivilege 5116 ingiuiufd.exe Token: SeDebugPrivilege 6096 innuocedv.exe Token: SeDebugPrivilege 4424 inbuxzyre.exe Token: SeDebugPrivilege 364 incgzwjvl.exe Token: SeDebugPrivilege 1240 inpbwqegf.exe Token: SeDebugPrivilege 4400 inugvjlkd.exe Token: SeDebugPrivilege 1460 inldtepix.exe Token: SeDebugPrivilege 5164 inbqiycju.exe Token: SeDebugPrivilege 2980 ingvnhoze.exe Token: SeDebugPrivilege 1076 innqsrkjz.exe Token: SeDebugPrivilege 2092 ineybxzdp.exe Token: SeDebugPrivilege 988 inqjpgzht.exe Token: SeDebugPrivilege 2956 inqmfrmyb.exe Token: SeDebugPrivilege 4828 insezthji.exe Token: SeDebugPrivilege 5656 inaikwkwh.exe Token: SeDebugPrivilege 4288 inogwahsa.exe Token: SeDebugPrivilege 5428 inxtemyti.exe Token: SeDebugPrivilege 4868 injyqkarh.exe Token: SeDebugPrivilege 2372 inoavpdfe.exe Token: SeDebugPrivilege 2352 incvyzsfr.exe Token: SeDebugPrivilege 3036 indhxkwmb.exe Token: SeDebugPrivilege 3460 incanalcr.exe Token: SeDebugPrivilege 2708 inhfsfaqh.exe Token: SeDebugPrivilege 4576 inlsmacbt.exe Token: SeDebugPrivilege 2972 inqcxrfhg.exe Token: SeDebugPrivilege 1120 indwztgsi.exe Token: SeDebugPrivilege 248 inpleqlxa.exe Token: SeDebugPrivilege 1204 inrdysgih.exe Token: SeDebugPrivilege 2880 inzvgovkd.exe Token: SeDebugPrivilege 4896 inmtnbdcu.exe Token: SeDebugPrivilege 4264 inazpsjiq.exe Token: SeDebugPrivilege 5900 intpaiupe.exe Token: SeDebugPrivilege 5332 inpsutmlb.exe Token: SeDebugPrivilege 6112 invhwkmle.exe Token: SeDebugPrivilege 3108 inmprqjiy.exe Token: SeDebugPrivilege 356 inxnqhgoo.exe Token: SeDebugPrivilege 2560 incsvmltt.exe Token: SeDebugPrivilege 2148 inigtklnv.exe Token: SeDebugPrivilege 6040 inuqbjvqf.exe Token: SeDebugPrivilege 1180 inhegsgsd.exe Token: SeDebugPrivilege 3352 inxiaqxbm.exe Token: SeDebugPrivilege 2240 intsuvkkg.exe Token: SeDebugPrivilege 1388 inyorihpp.exe Token: SeDebugPrivilege 2664 inyufnzuj.exe Token: SeDebugPrivilege 1980 injmdckxk.exe Token: SeDebugPrivilege 6016 injkrqgyq.exe Token: SeDebugPrivilege 1200 infumgnyd.exe Token: SeDebugPrivilege 940 inkzrlbas.exe Token: SeDebugPrivilege 5660 innlypqcs.exe Token: SeDebugPrivilege 5560 infhthtec.exe Token: SeDebugPrivilege 3172 inkbaivic.exe Token: SeDebugPrivilege 4224 inljyapnv.exe Token: SeDebugPrivilege 4960 inwsdlxsh.exe Token: SeDebugPrivilege 2792 inwixlnmf.exe Token: SeDebugPrivilege 3452 inefvmlzb.exe Token: SeDebugPrivilege 4432 inmkxopbr.exe Token: SeDebugPrivilege 4768 indskelwb.exe Token: SeDebugPrivilege 4524 inhsblrqs.exe Token: SeDebugPrivilege 2648 inxtleici.exe Token: SeDebugPrivilege 1416 insohtodl.exe Token: SeDebugPrivilege 5048 inqgdzfrf.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe 5256 inaexuhtj.exe 4580 insvxwpco.exe 5116 ingiuiufd.exe 6096 innuocedv.exe 4424 inbuxzyre.exe 364 incgzwjvl.exe 1240 inpbwqegf.exe 4400 inugvjlkd.exe 1460 inldtepix.exe 5164 inbqiycju.exe 2980 ingvnhoze.exe 1076 innqsrkjz.exe 2092 ineybxzdp.exe 988 inqjpgzht.exe 2956 inqmfrmyb.exe 4828 insezthji.exe 5656 inaikwkwh.exe 4288 inogwahsa.exe 5428 inxtemyti.exe 4868 injyqkarh.exe 2372 inoavpdfe.exe 2352 incvyzsfr.exe 3036 indhxkwmb.exe 3460 incanalcr.exe 2708 inhfsfaqh.exe 4576 inlsmacbt.exe 2972 inqcxrfhg.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 5256 2072 2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe 90 PID 5256 wrote to memory of 4580 5256 inaexuhtj.exe 91 PID 4580 wrote to memory of 5116 4580 insvxwpco.exe 92 PID 5116 wrote to memory of 6096 5116 ingiuiufd.exe 93 PID 6096 wrote to memory of 4424 6096 innuocedv.exe 94 PID 4424 wrote to memory of 364 4424 inbuxzyre.exe 95 PID 364 wrote to memory of 1240 364 incgzwjvl.exe 96 PID 1240 wrote to memory of 4400 1240 inpbwqegf.exe 97 PID 4400 wrote to memory of 1460 4400 inugvjlkd.exe 98 PID 1460 wrote to memory of 5164 1460 inldtepix.exe 99 PID 5164 wrote to memory of 2980 5164 inbqiycju.exe 100 PID 2980 wrote to memory of 1076 2980 ingvnhoze.exe 101 PID 1076 wrote to memory of 2092 1076 innqsrkjz.exe 102 PID 2092 wrote to memory of 988 2092 ineybxzdp.exe 103 PID 988 wrote to memory of 2956 988 inqjpgzht.exe 104 PID 2956 wrote to memory of 4828 2956 inqmfrmyb.exe 105 PID 4828 wrote to memory of 5656 4828 insezthji.exe 106 PID 5656 wrote to memory of 4288 5656 inaikwkwh.exe 107 PID 4288 wrote to memory of 5428 4288 inogwahsa.exe 108 PID 5428 wrote to memory of 4868 5428 inxtemyti.exe 109 PID 4868 wrote to memory of 2372 4868 injyqkarh.exe 110 PID 2372 wrote to memory of 2352 2372 inoavpdfe.exe 111 PID 2352 wrote to memory of 3036 2352 incvyzsfr.exe 112 PID 3036 wrote to memory of 3460 3036 indhxkwmb.exe 113 PID 3460 wrote to memory of 2708 3460 incanalcr.exe 114 PID 2708 wrote to memory of 4576 2708 inhfsfaqh.exe 115 PID 4576 wrote to memory of 2972 4576 inlsmacbt.exe 116 PID 2972 wrote to memory of 1120 2972 inqcxrfhg.exe 117 PID 1120 wrote to memory of 248 1120 indwztgsi.exe 118 PID 248 wrote to memory of 1204 248 inpleqlxa.exe 119 PID 1204 wrote to memory of 2880 1204 inrdysgih.exe 120 PID 2880 wrote to memory of 4896 2880 inzvgovkd.exe 121 PID 4896 wrote to memory of 4264 4896 inmtnbdcu.exe 122 PID 4264 wrote to memory of 5900 4264 inazpsjiq.exe 123 PID 5900 wrote to memory of 5332 5900 intpaiupe.exe 124 PID 5332 wrote to memory of 6112 5332 inpsutmlb.exe 125 PID 6112 wrote to memory of 3108 6112 invhwkmle.exe 126 PID 3108 wrote to memory of 356 3108 inmprqjiy.exe 127 PID 356 wrote to memory of 2560 356 inxnqhgoo.exe 128 PID 2560 wrote to memory of 2148 2560 incsvmltt.exe 129 PID 2148 wrote to memory of 6040 2148 inigtklnv.exe 130 PID 6040 wrote to memory of 1180 6040 inuqbjvqf.exe 131 PID 1180 wrote to memory of 3352 1180 inhegsgsd.exe 132 PID 3352 wrote to memory of 2240 3352 inxiaqxbm.exe 133 PID 2240 wrote to memory of 1388 2240 intsuvkkg.exe 134 PID 1388 wrote to memory of 2664 1388 inyorihpp.exe 135 PID 2664 wrote to memory of 1980 2664 inyufnzuj.exe 136 PID 1980 wrote to memory of 6016 1980 injmdckxk.exe 137 PID 6016 wrote to memory of 1200 6016 injkrqgyq.exe 138 PID 1200 wrote to memory of 940 1200 infumgnyd.exe 139 PID 940 wrote to memory of 5660 940 inkzrlbas.exe 140 PID 5660 wrote to memory of 5560 5660 innlypqcs.exe 141 PID 5560 wrote to memory of 3172 5560 infhthtec.exe 142 PID 3172 wrote to memory of 4224 3172 inkbaivic.exe 143 PID 4224 wrote to memory of 4960 4224 inljyapnv.exe 144 PID 4960 wrote to memory of 2792 4960 inwsdlxsh.exe 145 PID 2792 wrote to memory of 3452 2792 inwixlnmf.exe 146 PID 3452 wrote to memory of 4432 3452 inefvmlzb.exe 147 PID 4432 wrote to memory of 4768 4432 inmkxopbr.exe 148 PID 4768 wrote to memory of 4524 4768 indskelwb.exe 149 PID 4524 wrote to memory of 2648 4524 inhsblrqs.exe 150 PID 2648 wrote to memory of 1416 2648 inxtleici.exe 151 PID 1416 wrote to memory of 5048 1416 insohtodl.exe 152 PID 5048 wrote to memory of 596 5048 inqgdzfrf.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_09d897e075e18d3142af31af110f9587_elex_parite_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe31⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe34⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe37⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe60⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe63⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:596 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe66⤵PID:2556
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe67⤵PID:1624
-
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe68⤵PID:2268
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe69⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe70⤵PID:3364
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe71⤵PID:1844
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe72⤵PID:5064
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe73⤵PID:4788
-
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe74⤵
- Drops file in System32 directory
PID:1436 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe75⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe76⤵PID:4268
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe77⤵PID:5280
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe78⤵PID:4508
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe79⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1752 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe80⤵PID:5992
-
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe81⤵PID:4848
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4800 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe83⤵PID:4416
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe84⤵PID:5356
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe85⤵
- Drops file in System32 directory
PID:5012 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe86⤵PID:3736
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe87⤵PID:2084
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5960 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe89⤵
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe90⤵
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe91⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2264 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe92⤵PID:4336
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe93⤵PID:1652
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe94⤵PID:5480
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe95⤵PID:2424
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe96⤵PID:4776
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe97⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe98⤵
- Drops file in System32 directory
PID:1796 -
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe99⤵PID:5856
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe100⤵PID:2576
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe101⤵PID:4916
-
C:\Windows\SysWOW64\inuydrpyf.exeC:\Windows\system32\inuydrpyf.exe102⤵
- Drops file in System32 directory
PID:4740 -
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe103⤵
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\inyczocok.exeC:\Windows\system32\inyczocok.exe104⤵PID:3652
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe105⤵PID:5584
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe106⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4644 -
C:\Windows\SysWOW64\inijzqpfx.exeC:\Windows\system32\inijzqpfx.exe107⤵PID:5936
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe108⤵PID:6048
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe109⤵PID:3596
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe110⤵
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\infrfqjpo.exeC:\Windows\system32\infrfqjpo.exe111⤵PID:1236
-
C:\Windows\SysWOW64\inpkfxleq.exeC:\Windows\system32\inpkfxleq.exe112⤵PID:2520
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe113⤵PID:4164
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe114⤵PID:2140
-
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe115⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4808 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe116⤵PID:5684
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe117⤵
- System Location Discovery: System Language Discovery
PID:6104 -
C:\Windows\SysWOW64\inuwftrhn.exeC:\Windows\system32\inuwftrhn.exe118⤵PID:1112
-
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe119⤵PID:6032
-
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe120⤵PID:4116
-
C:\Windows\SysWOW64\intetdxsy.exeC:\Windows\system32\intetdxsy.exe121⤵PID:5436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-