Analysis
- max time kernel
142s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/10/2026, 03:40
Behavioral task
behavioral1
Sample
2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe
- Size 348KB
- Sample261005-d8cd3sef82
- SHA256 da6e8994469e7e24bdb75b6008b0423945f7ee63525e859bf4d45bacdad16c35
- MD5 c25f37010284c496b353e482aeb01d8f
- SHA1 483109c1f962557593d69695bd4ad554a4e7a295
- SHA512 6c6a29d6c37e173afc9cf07ab5122d6dbb81a0925d5a49c58d032b6ddc93788ab9e148640a676c796d264c326d66a8e39b54aa4229076e091d28c306877e8012
- SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0S5:ouLwoZQGpnedeP/deUe1ppGjTGHZRT01
- TLSH T1B874DF01BEE740F9EAF8003C20FB2776963B6898FB085FD36319EA751837555E632256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral1/memory/5040-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000500000001686d-10.dat family_gh0strat behavioral1/files/0x00090000000241e0-21.dat family_gh0strat behavioral1/memory/4328-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2668-633-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/768-615-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3340-596-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4768-575-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5004-556-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5116-537-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1396-518-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1332-499-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4396-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2348-461-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3216-442-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4888-423-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2172-404-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1284-386-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002439d-372.dat family_gh0strat behavioral1/memory/2008-365-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024399-349.dat family_gh0strat behavioral1/memory/1264-341-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024395-326.dat family_gh0strat behavioral1/memory/5080-318-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024391-303.dat family_gh0strat behavioral1/memory/1712-296-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002438d-280.dat family_gh0strat behavioral1/memory/1948-273-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024389-257.dat family_gh0strat behavioral1/memory/1456-249-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024385-234.dat family_gh0strat behavioral1/memory/1536-226-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024381-211.dat family_gh0strat behavioral1/memory/2240-203-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002437d-188.dat family_gh0strat behavioral1/memory/2816-180-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024379-165.dat family_gh0strat behavioral1/memory/2232-157-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024375-142.dat family_gh0strat behavioral1/files/0x00110000000242d6-119.dat family_gh0strat behavioral1/memory/1696-110-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0009000000024227-95.dat family_gh0strat behavioral1/memory/4872-86-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0008000000024213-71.dat family_gh0strat behavioral1/memory/4872-49-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000800000002420d-47.dat family_gh0strat behavioral1/memory/4148-41-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5040-25-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{561A6491-06E0-488c-8D27-F92D215652CE} invmsakfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AC5FDB2-98A7-4f4f-A45F-42551ABBB791} inonckooo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C4BA8CE-0301-4cc7-B0A1-27D041DE5D01}\stubpath = "C:\\Windows\\system32\\inecvhest.exe" insanriau.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34F4FF0C-C5B9-41eb-8D30-9E67058B4F1D}\stubpath = "C:\\Windows\\system32\\injtrsrce.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8156A2A-1851-4014-AE8A-12FCA1589D66} inomlwaho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BD8583B-D965-4b67-AF7B-60F9B2E41E84}\stubpath = "C:\\Windows\\system32\\inwacmaou.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33BC2F5A-DFD2-4310-81E6-71F33074E325}\stubpath = "C:\\Windows\\system32\\innktuggx.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B83AF248-3311-433b-A57F-4D3C4FE4289A} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39496106-A19D-4cde-8154-5BE2F43539C4} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56CC5A16-B546-432b-BFAC-58BBD5566B80} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E5AA5C1-3FFD-4084-A79C-C9FE2E41A361} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B7DE59A-67A2-4f69-AB3E-A790D2B4FF1D}\stubpath = "C:\\Windows\\system32\\ingoxeawx.exe" ingerepgv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{441881F6-A7AE-4602-A1FC-C956A55B598E}\stubpath = "C:\\Windows\\system32\\intpaiupe.exe" inqzfhsqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA1ED10F-6D10-42cd-8B49-9FACEF122F9D} inxavmale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CEB7605B-5C0A-4718-8AB7-2C898B773773}\stubpath = "C:\\Windows\\system32\\inckscbjk.exe" intbpxrhx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7F02278-CB35-469a-98C9-C66E21EF3687} invaiaqlz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16958CC0-8FC3-4607-9948-34475BADC8AA} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30322E1E-C5F7-400b-9721-AAB9E9C6322E}\stubpath = "C:\\Windows\\system32\\indlyubtu.exe" inscqyokc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9811BC2D-032B-4e4c-AFE8-F055515A618E}\stubpath = "C:\\Windows\\system32\\inupkqjvx.exe" inctpigdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA4AE020-790A-493e-B9DD-85287E694B6A} iniqjgqjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93842EA5-8DB8-4bcd-BB07-569CC52C57FF} inmxdfsdw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD1D1A1F-E441-4374-B973-E06708B8D548} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB4B00ED-26EB-4de7-9D4B-BD757DDFBBDA} inxhvtpha.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E500F0B8-5383-467f-A76A-BF4F9D15CF21} inuprejup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29B632E0-56DB-48d6-8EBF-4326DC6D8E45} intxmhybx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADDAD4AE-D11F-418c-A15E-D5C38BC5A3C0} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF0C8E32-EFB2-4f82-BE0C-E86AF16C15AC} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95BB8B99-71FE-4d2a-926F-AB375210A140} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{732303C6-80B5-4b5a-87A4-F37A1B90BCAA}\stubpath = "C:\\Windows\\system32\\inbxslgig.exe" infcwfnxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B831D8F-2B71-448d-8731-078C05A8BC7D}\stubpath = "C:\\Windows\\system32\\inqofiykl.exe" inztkqidm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE8F4D6B-5EC6-4811-945B-0CD459A1C99A}\stubpath = "C:\\Windows\\system32\\inocytmhj.exe" intchxupt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5319A206-FDC6-4fa0-85DF-24805886E8F8} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26B84531-32C1-46f4-BEBE-17C321CB826E}\stubpath = "C:\\Windows\\system32\\inbzddobb.exe" inykgfwoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D83F0B02-8A80-4ae7-9929-07B1F5A0E655}\stubpath = "C:\\Windows\\system32\\inzlydrpm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CD8E18B-1F35-4ab9-9DC0-83A59CC184A4}\stubpath = "C:\\Windows\\system32\\inxnqhgoo.exe" inknedlyl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAAB70EC-DE53-498e-9F82-E85D9D91D173}\stubpath = "C:\\Windows\\system32\\inyteppma.exe" inxtleici.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7235DABA-E68C-461f-A7FB-3EFF8D9C8798} inyjlwest.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F57BA2F9-9181-47c3-B6D5-08648326A3BC} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B48C3CA-7F72-4016-9779-F36178A6E7A5}\stubpath = "C:\\Windows\\system32\\intoipjfl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E1FAB8-AD68-4897-9035-4311F65F0483}\stubpath = "C:\\Windows\\system32\\inmyifozp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BAE0DAE-7CF4-4ef1-BD59-FF3596C74A4B}\stubpath = "C:\\Windows\\system32\\inqtvunam.exe" innqsrkjz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C107B153-EF9D-4d2f-B803-CD68B3AC83A5} inktojpiu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FAEB8D99-D4AF-4d31-857A-209AC4D32689}\stubpath = "C:\\Windows\\system32\\injfiqaer.exe" inlentqqz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{028EB177-7C53-474e-BB9E-E047F26DB1BC} injmgupdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89D64ADD-AE61-47b3-9290-ACB5BDCC51C0}\stubpath = "C:\\Windows\\system32\\inciyatsg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D026A9E-E10E-4dfe-8153-EA78093034BB}\stubpath = "C:\\Windows\\system32\\inaxfqmud.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C649364C-B0B0-4d68-A3B8-F56A93F186A8} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9174D3CF-83B1-4604-9ACD-BCBC4AE83229}\stubpath = "C:\\Windows\\system32\\inucqrdpv.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4C80EEF-FD9C-44f9-96D4-79EEAB891A6B}\stubpath = "C:\\Windows\\system32\\inmrhdpxe.exe" indkntxkp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F851F3F-C1A2-4d11-8CE3-A0C4732BB34E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DEBEE031-9F95-4c91-A174-ABC31E4FA2CE} incvyzsfr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2B905B6-3BAE-40ae-9F8A-891EA5F25BBF}\stubpath = "C:\\Windows\\system32\\inbmyhvlc.exe" innsieqyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3837B23-E0AF-4d75-9FC8-58C95B3C3256} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2AD9D3C-CEFF-42db-A8B8-7B816A7E17AD} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EAEB38B-45ED-4cd8-B7F2-BA8DB3FC953F} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A480D080-E383-4b54-884B-B42D862CFFD4}\stubpath = "C:\\Windows\\system32\\inomlwaho.exe" inoyokzfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A4D69CD-0C89-4149-8F39-3A1E15A4620B}\stubpath = "C:\\Windows\\system32\\inuvrtzkh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2CB6E9-C838-410a-B0B5-7A100E51F003}\stubpath = "C:\\Windows\\system32\\inzgfmdgp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF9571B6-0119-4115-9135-BD02DB54D2DA}\stubpath = "C:\\Windows\\system32\\inrurbsrs.exe" invgvfzue.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19D50078-9826-4f6f-96B5-A019FDE8CA7A} inbkobdgw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B220BB7-7C8B-4067-9C24-DE08415CD9AA}\stubpath = "C:\\Windows\\system32\\intkkwbze.exe" inisltdlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{317714B2-193E-4a2e-900F-41EB876D4437} inpulnhtq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B91D96C2-C2CB-481b-A9B7-A1C15B79B5AB} insaljfpw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D081AE8-ADFE-4124-9B22-ECB06F9C553A}\stubpath = "C:\\Windows\\system32\\inqlzpgys.exe" Process not Found - ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000004e8-4.dat acprotect behavioral1/files/0x0008000000024215-75.dat acprotect behavioral1/files/0x000700000002438f-284.dat acprotect behavioral1/files/0x000700000002439b-353.dat acprotect behavioral1/files/0x0007000000024397-330.dat acprotect behavioral1/files/0x0007000000024393-307.dat acprotect behavioral1/files/0x000700000002438b-261.dat acprotect behavioral1/files/0x0007000000024387-238.dat acprotect behavioral1/files/0x0007000000024383-215.dat acprotect behavioral1/files/0x000700000002437f-192.dat acprotect behavioral1/files/0x000700000002437b-169.dat acprotect behavioral1/files/0x0007000000024377-146.dat acprotect behavioral1/files/0x000b0000000242e0-123.dat acprotect behavioral1/files/0x000800000002422a-99.dat acprotect behavioral1/files/0x0008000000024211-52.dat acprotect behavioral1/files/0x00090000000241e9-28.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4148 injyqkarh.exe 4872 inuqbjvqf.exe 1696 insvxwpco.exe 4328 intfuikjc.exe 2232 inwixlnmf.exe 2816 inkbaivic.exe 2240 inlsmacbt.exe 1536 innfvgrkz.exe 1456 inbqiycju.exe 1948 invrckwrg.exe 1712 inbuxzyre.exe 5080 inwhpwale.exe 1264 incgzwjvl.exe 2008 inmeufqjy.exe 1284 inaphxbit.exe 2172 inomzqrdt.exe 4888 inxtemyti.exe 3216 intcrvwiy.exe 2348 inaikwkwh.exe 4396 inpleqlxa.exe 1332 inortslka.exe 1396 inpbwqegf.exe 5116 inrdysgih.exe 5004 inugvjlkd.exe 4768 inhwoipfi.exe 3340 indtkzjxv.exe 768 inmtnbdcu.exe 2668 inogwahsa.exe 1200 inazpsjiq.exe 4208 inetlfmxc.exe 540 ingvnhoze.exe 3008 inrjcgagg.exe 1416 injmdckxk.exe 2976 inixomukg.exe 4336 incanalcr.exe 952 inbjwysrs.exe 1528 inyufnzuj.exe 404 inaexuhtj.exe 628 infslrijv.exe 3540 inmprqjiy.exe 1984 inpsutmlb.exe 5152 inqcxrfhg.exe 5244 incrjzdkv.exe 5336 infumgnyd.exe 5428 ingtgabri.exe 5520 inyjbrycn.exe 5612 inhwnltjf.exe 5704 insohtodl.exe 5796 innlypqcs.exe 5888 inatwyxqd.exe 5980 indwztgsi.exe 6072 ineuxonvv.exe 1504 inzloqpih.exe 4112 innqsrkjz.exe 5008 inqtvunam.exe 4668 inqklaasr.exe 3800 infdqdofu.exe 5624 inhfsfaqh.exe 3716 inxiaqxbm.exe 1172 inldtepix.exe 2044 inqmfrmyb.exe 3396 invuwaxma.exe 6076 ineybxzdp.exe 4412 inbrulkss.exe - Loads dropped DLL 64 IoCs
pid Process 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe 4148 injyqkarh.exe 4148 injyqkarh.exe 4872 inuqbjvqf.exe 4872 inuqbjvqf.exe 1696 insvxwpco.exe 1696 insvxwpco.exe 4328 intfuikjc.exe 4328 intfuikjc.exe 2232 inwixlnmf.exe 2232 inwixlnmf.exe 2816 inkbaivic.exe 2816 inkbaivic.exe 2240 inlsmacbt.exe 2240 inlsmacbt.exe 1536 innfvgrkz.exe 1536 innfvgrkz.exe 1456 inbqiycju.exe 1456 inbqiycju.exe 1948 invrckwrg.exe 1948 invrckwrg.exe 1712 inbuxzyre.exe 1712 inbuxzyre.exe 5080 inwhpwale.exe 5080 inwhpwale.exe 1264 incgzwjvl.exe 1264 incgzwjvl.exe 2008 inmeufqjy.exe 2008 inmeufqjy.exe 1284 inaphxbit.exe 1284 inaphxbit.exe 2172 inomzqrdt.exe 2172 inomzqrdt.exe 4888 inxtemyti.exe 4888 inxtemyti.exe 3216 intcrvwiy.exe 3216 intcrvwiy.exe 2348 inaikwkwh.exe 2348 inaikwkwh.exe 4396 inpleqlxa.exe 4396 inpleqlxa.exe 1332 inortslka.exe 1332 inortslka.exe 1396 inpbwqegf.exe 1396 inpbwqegf.exe 5116 inrdysgih.exe 5116 inrdysgih.exe 5004 inugvjlkd.exe 5004 inugvjlkd.exe 4768 inhwoipfi.exe 4768 inhwoipfi.exe 3340 indtkzjxv.exe 3340 indtkzjxv.exe 768 inmtnbdcu.exe 768 inmtnbdcu.exe 2668 inogwahsa.exe 2668 inogwahsa.exe 1200 inazpsjiq.exe 1200 inazpsjiq.exe 4208 inetlfmxc.exe 4208 inetlfmxc.exe 540 ingvnhoze.exe 540 ingvnhoze.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inadbobmd.exe_lang.ini inxnqhgoo.exe File opened for modification C:\Windows\SysWOW64\inocymrvp.exe_lang.ini inimthpzj.exe File opened for modification C:\Windows\SysWOW64\inlgwrccv.exe_lang.ini inmsevrki.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inupeyqpk.exe File opened for modification C:\Windows\SysWOW64\injkufcol.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inozdcpqh.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inmobevcz.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inuiybnpg.exe_lang.ini inthmqkqb.exe File created C:\Windows\SysWOW64\insahbdsg.exe intikurgv.exe File created C:\Windows\SysWOW64\infzzbyva.exe inboqtqar.exe File created C:\Windows\SysWOW64\inzotztfu.exe innqsqpku.exe File opened for modification C:\Windows\SysWOW64\inmbpckft.exe_lang.ini ineyyaxuz.exe File created C:\Windows\SysWOW64\inpmytiuc.exe inzrzcjpi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingatvyvf.exe File created C:\Windows\SysWOW64\indlflxmo.exe inxgoheoh.exe File created C:\Windows\SysWOW64\incwvxbyn.exe inrngsnzc.exe File created C:\Windows\SysWOW64\inaeepccp.exe inapnrseu.exe File opened for modification C:\Windows\SysWOW64\inzkzjyci.exe_lang.ini inwskdhbh.exe File opened for modification C:\Windows\SysWOW64\infcnwrgb.exe_lang.ini inrhmypep.exe File opened for modification C:\Windows\SysWOW64\invgtjtrb.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhegsgsd.exe inwsdlxsh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmvblntu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invakwebu.exe File created C:\Windows\SysWOW64\inmhgesgy.exe inhgblcvj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyljidn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inljyapnv.exe File created C:\Windows\SysWOW64\injgmuryj.exe inragwryq.exe File created C:\Windows\SysWOW64\inetgedis.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\intkqnccl.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat incgzwjvl.exe File opened for modification C:\Windows\SysWOW64\inrhnxdft.exe_lang.ini injqftzfq.exe File opened for modification C:\Windows\SysWOW64\infrgacrf.exe_lang.ini inmkimmxk.exe File created C:\Windows\SysWOW64\iniujiyjl.exe inmjqbyiq.exe File created C:\Windows\SysWOW64\inxfqxuqh.exe Process not Found File opened for modification C:\Windows\SysWOW64\insgwlney.exe_lang.ini inooxsntm.exe File opened for modification C:\Windows\SysWOW64\inzrzcjpi.exe_lang.ini inirwtfkt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inomlwaho.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inekkdesc.exe File created C:\Windows\SysWOW64\inuwautoy.exe Process not Found File created C:\Windows\SysWOW64\inyegtexf.exe inlaxcmgz.exe File created C:\Windows\SysWOW64\inisucehe.exe inwikohfo.exe File opened for modification C:\Windows\SysWOW64\invtcqgup.exe_lang.ini inxbftvlo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\incollpyc.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\indrseqwi.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inixavlyd.exe Process not Found File opened for modification C:\Windows\SysWOW64\invqlrkwy.exe_lang.ini infgwnmcy.exe File created C:\Windows\SysWOW64\insgwlney.exe inooxsntm.exe File created C:\Windows\SysWOW64\inyzokcmk.exe inrzweovz.exe File opened for modification C:\Windows\SysWOW64\inzkvkvkj.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inbmmjnwc.exe inbfffozj.exe File opened for modification C:\Windows\SysWOW64\injvkjzkm.exe_lang.ini intlkfhrk.exe File created C:\Windows\SysWOW64\injidfpid.exe inggtifch.exe File created C:\Windows\SysWOW64\inkwkupid.exe inwikshbc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhpxhdgo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insjzlfro.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxqcxpkg.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhnqivx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniwuqibf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxdmghfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infagddmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbkvfva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmnccutj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaivxrqr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmflkmos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injflluak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqlvmtik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisltdlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmprqjiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infgwnmcy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclwgwbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaiqezai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpscqoss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvpwggs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkwblfyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrtkbsie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineqfbqev.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inikbvtjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfnbzwf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injqkgmph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmroafou.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inooxsntm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsvnris.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inziwmdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineeenyiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniszdhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inigtklnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inipelkjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invecggre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzzbyva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbpvbz.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe 4148 injyqkarh.exe 4148 injyqkarh.exe 4872 inuqbjvqf.exe 4872 inuqbjvqf.exe 1696 insvxwpco.exe 1696 insvxwpco.exe 4328 intfuikjc.exe 4328 intfuikjc.exe 2232 inwixlnmf.exe 2232 inwixlnmf.exe 2816 inkbaivic.exe 2816 inkbaivic.exe 2240 inlsmacbt.exe 2240 inlsmacbt.exe 1536 innfvgrkz.exe 1536 innfvgrkz.exe 1456 inbqiycju.exe 1456 inbqiycju.exe 1948 invrckwrg.exe 1948 invrckwrg.exe 1712 inbuxzyre.exe 1712 inbuxzyre.exe 5080 inwhpwale.exe 5080 inwhpwale.exe 1264 incgzwjvl.exe 1264 incgzwjvl.exe 2008 inmeufqjy.exe 2008 inmeufqjy.exe 1284 inaphxbit.exe 1284 inaphxbit.exe 2172 inomzqrdt.exe 2172 inomzqrdt.exe 4888 inxtemyti.exe 4888 inxtemyti.exe 3216 intcrvwiy.exe 3216 intcrvwiy.exe 2348 inaikwkwh.exe 2348 inaikwkwh.exe 4396 inpleqlxa.exe 4396 inpleqlxa.exe 1332 inortslka.exe 1332 inortslka.exe 1396 inpbwqegf.exe 1396 inpbwqegf.exe 5116 inrdysgih.exe 5116 inrdysgih.exe 5004 inugvjlkd.exe 5004 inugvjlkd.exe 4768 inhwoipfi.exe 4768 inhwoipfi.exe 3340 indtkzjxv.exe 3340 indtkzjxv.exe 768 inmtnbdcu.exe 768 inmtnbdcu.exe 2668 inogwahsa.exe 2668 inogwahsa.exe 1200 inazpsjiq.exe 1200 inazpsjiq.exe 4208 inetlfmxc.exe 4208 inetlfmxc.exe 540 ingvnhoze.exe 540 ingvnhoze.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe Token: SeDebugPrivilege 4148 injyqkarh.exe Token: SeDebugPrivilege 4872 inuqbjvqf.exe Token: SeDebugPrivilege 1696 insvxwpco.exe Token: SeDebugPrivilege 4328 intfuikjc.exe Token: SeDebugPrivilege 2232 inwixlnmf.exe Token: SeDebugPrivilege 2816 inkbaivic.exe Token: SeDebugPrivilege 2240 inlsmacbt.exe Token: SeDebugPrivilege 1536 innfvgrkz.exe Token: SeDebugPrivilege 1456 inbqiycju.exe Token: SeDebugPrivilege 1948 invrckwrg.exe Token: SeDebugPrivilege 1712 inbuxzyre.exe Token: SeDebugPrivilege 5080 inwhpwale.exe Token: SeDebugPrivilege 1264 incgzwjvl.exe Token: SeDebugPrivilege 2008 inmeufqjy.exe Token: SeDebugPrivilege 1284 inaphxbit.exe Token: SeDebugPrivilege 2172 inomzqrdt.exe Token: SeDebugPrivilege 4888 inxtemyti.exe Token: SeDebugPrivilege 3216 intcrvwiy.exe Token: SeDebugPrivilege 2348 inaikwkwh.exe Token: SeDebugPrivilege 4396 inpleqlxa.exe Token: SeDebugPrivilege 1332 inortslka.exe Token: SeDebugPrivilege 1396 inpbwqegf.exe Token: SeDebugPrivilege 5116 inrdysgih.exe Token: SeDebugPrivilege 5004 inugvjlkd.exe Token: SeDebugPrivilege 4768 inhwoipfi.exe Token: SeDebugPrivilege 3340 indtkzjxv.exe Token: SeDebugPrivilege 768 inmtnbdcu.exe Token: SeDebugPrivilege 2668 inogwahsa.exe Token: SeDebugPrivilege 1200 inazpsjiq.exe Token: SeDebugPrivilege 4208 inetlfmxc.exe Token: SeDebugPrivilege 540 ingvnhoze.exe Token: SeDebugPrivilege 3008 inrjcgagg.exe Token: SeDebugPrivilege 1416 injmdckxk.exe Token: SeDebugPrivilege 2976 inixomukg.exe Token: SeDebugPrivilege 4336 incanalcr.exe Token: SeDebugPrivilege 952 inbjwysrs.exe Token: SeDebugPrivilege 1528 inyufnzuj.exe Token: SeDebugPrivilege 404 inaexuhtj.exe Token: SeDebugPrivilege 628 infslrijv.exe Token: SeDebugPrivilege 3540 inmprqjiy.exe Token: SeDebugPrivilege 1984 inpsutmlb.exe Token: SeDebugPrivilege 5152 inqcxrfhg.exe Token: SeDebugPrivilege 5244 incrjzdkv.exe Token: SeDebugPrivilege 5336 infumgnyd.exe Token: SeDebugPrivilege 5428 ingtgabri.exe Token: SeDebugPrivilege 5520 inyjbrycn.exe Token: SeDebugPrivilege 5612 inhwnltjf.exe Token: SeDebugPrivilege 5704 insohtodl.exe Token: SeDebugPrivilege 5796 innlypqcs.exe Token: SeDebugPrivilege 5888 inatwyxqd.exe Token: SeDebugPrivilege 5980 indwztgsi.exe Token: SeDebugPrivilege 6072 ineuxonvv.exe Token: SeDebugPrivilege 1504 inzloqpih.exe Token: SeDebugPrivilege 4112 innqsrkjz.exe Token: SeDebugPrivilege 5008 inqtvunam.exe Token: SeDebugPrivilege 4668 inqklaasr.exe Token: SeDebugPrivilege 3800 infdqdofu.exe Token: SeDebugPrivilege 5624 inhfsfaqh.exe Token: SeDebugPrivilege 3716 inxiaqxbm.exe Token: SeDebugPrivilege 1172 inldtepix.exe Token: SeDebugPrivilege 2044 inqmfrmyb.exe Token: SeDebugPrivilege 3396 invuwaxma.exe Token: SeDebugPrivilege 6076 ineybxzdp.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe 4148 injyqkarh.exe 4872 inuqbjvqf.exe 1696 insvxwpco.exe 4328 intfuikjc.exe 2232 inwixlnmf.exe 2816 inkbaivic.exe 2240 inlsmacbt.exe 1536 innfvgrkz.exe 1456 inbqiycju.exe 1948 invrckwrg.exe 1712 inbuxzyre.exe 5080 inwhpwale.exe 1264 incgzwjvl.exe 2008 inmeufqjy.exe 1284 inaphxbit.exe 2172 inomzqrdt.exe 4888 inxtemyti.exe 3216 intcrvwiy.exe 2348 inaikwkwh.exe 4396 inpleqlxa.exe 1332 inortslka.exe 1396 inpbwqegf.exe 5116 inrdysgih.exe 5004 inugvjlkd.exe 4768 inhwoipfi.exe 3340 indtkzjxv.exe 768 inmtnbdcu.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 4148 5040 2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe 87 PID 4148 wrote to memory of 4872 4148 injyqkarh.exe 88 PID 4872 wrote to memory of 1696 4872 inuqbjvqf.exe 89 PID 1696 wrote to memory of 4328 1696 insvxwpco.exe 90 PID 4328 wrote to memory of 2232 4328 intfuikjc.exe 91 PID 2232 wrote to memory of 2816 2232 inwixlnmf.exe 92 PID 2816 wrote to memory of 2240 2816 inkbaivic.exe 93 PID 2240 wrote to memory of 1536 2240 inlsmacbt.exe 94 PID 1536 wrote to memory of 1456 1536 innfvgrkz.exe 95 PID 1456 wrote to memory of 1948 1456 inbqiycju.exe 96 PID 1948 wrote to memory of 1712 1948 invrckwrg.exe 97 PID 1712 wrote to memory of 5080 1712 inbuxzyre.exe 98 PID 5080 wrote to memory of 1264 5080 inwhpwale.exe 99 PID 1264 wrote to memory of 2008 1264 incgzwjvl.exe 100 PID 2008 wrote to memory of 1284 2008 inmeufqjy.exe 101 PID 1284 wrote to memory of 2172 1284 inaphxbit.exe 102 PID 2172 wrote to memory of 4888 2172 inomzqrdt.exe 103 PID 4888 wrote to memory of 3216 4888 inxtemyti.exe 104 PID 3216 wrote to memory of 2348 3216 intcrvwiy.exe 105 PID 2348 wrote to memory of 4396 2348 inaikwkwh.exe 106 PID 4396 wrote to memory of 1332 4396 inpleqlxa.exe 107 PID 1332 wrote to memory of 1396 1332 inortslka.exe 108 PID 1396 wrote to memory of 5116 1396 inpbwqegf.exe 109 PID 5116 wrote to memory of 5004 5116 inrdysgih.exe 110 PID 5004 wrote to memory of 4768 5004 inugvjlkd.exe 111 PID 4768 wrote to memory of 3340 4768 inhwoipfi.exe 112 PID 3340 wrote to memory of 768 3340 indtkzjxv.exe 113 PID 768 wrote to memory of 2668 768 inmtnbdcu.exe 114 PID 2668 wrote to memory of 1200 2668 inogwahsa.exe 115 PID 1200 wrote to memory of 4208 1200 inazpsjiq.exe 116 PID 4208 wrote to memory of 540 4208 inetlfmxc.exe 117 PID 540 wrote to memory of 3008 540 ingvnhoze.exe 118 PID 3008 wrote to memory of 1416 3008 inrjcgagg.exe 119 PID 1416 wrote to memory of 2976 1416 injmdckxk.exe 120 PID 2976 wrote to memory of 4336 2976 inixomukg.exe 121 PID 4336 wrote to memory of 952 4336 incanalcr.exe 122 PID 952 wrote to memory of 1528 952 inbjwysrs.exe 123 PID 1528 wrote to memory of 404 1528 inyufnzuj.exe 124 PID 404 wrote to memory of 628 404 inaexuhtj.exe 125 PID 628 wrote to memory of 3540 628 infslrijv.exe 126 PID 3540 wrote to memory of 1984 3540 inmprqjiy.exe 127 PID 1984 wrote to memory of 5152 1984 inpsutmlb.exe 128 PID 5152 wrote to memory of 5244 5152 inqcxrfhg.exe 129 PID 5244 wrote to memory of 5336 5244 incrjzdkv.exe 130 PID 5336 wrote to memory of 5428 5336 infumgnyd.exe 131 PID 5428 wrote to memory of 5520 5428 ingtgabri.exe 132 PID 5520 wrote to memory of 5612 5520 inyjbrycn.exe 133 PID 5612 wrote to memory of 5704 5612 inhwnltjf.exe 134 PID 5704 wrote to memory of 5796 5704 insohtodl.exe 135 PID 5796 wrote to memory of 5888 5796 innlypqcs.exe 136 PID 5888 wrote to memory of 5980 5888 inatwyxqd.exe 137 PID 5980 wrote to memory of 6072 5980 indwztgsi.exe 138 PID 6072 wrote to memory of 1504 6072 ineuxonvv.exe 139 PID 1504 wrote to memory of 4112 1504 inzloqpih.exe 140 PID 4112 wrote to memory of 5008 4112 innqsrkjz.exe 141 PID 5008 wrote to memory of 4668 5008 inqtvunam.exe 142 PID 4668 wrote to memory of 3800 4668 inqklaasr.exe 143 PID 3800 wrote to memory of 5624 3800 infdqdofu.exe 144 PID 5624 wrote to memory of 3716 5624 inhfsfaqh.exe 145 PID 3716 wrote to memory of 1172 3716 inxiaqxbm.exe 146 PID 1172 wrote to memory of 2044 1172 inldtepix.exe 147 PID 2044 wrote to memory of 3396 2044 inqmfrmyb.exe 148 PID 3396 wrote to memory of 6076 3396 invuwaxma.exe 149 PID 6076 wrote to memory of 4412 6076 ineybxzdp.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-04_c25f37010284c496b353e482aeb01d8f_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe55⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe65⤵
- Executes dropped EXE
PID:4412 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe66⤵PID:2964
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe67⤵PID:3804
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe68⤵PID:5184
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe69⤵PID:5276
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe70⤵PID:5368
-
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe71⤵PID:5464
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe72⤵PID:5552
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe73⤵PID:5636
-
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe74⤵PID:5732
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe75⤵PID:5836
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5916 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe77⤵
- Drops file in System32 directory
PID:4380 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe78⤵PID:5256
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe79⤵PID:1348
-
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe80⤵PID:4748
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe81⤵PID:2544
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe82⤵PID:5432
-
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe83⤵
- Drops file in System32 directory
PID:3484 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe84⤵PID:4772
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe85⤵PID:5736
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe86⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5800 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe87⤵PID:5908
-
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe88⤵PID:3228
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe89⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1152 -
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\system32\inyteppma.exe90⤵PID:1784
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe91⤵PID:4428
-
C:\Windows\SysWOW64\inbsfowhf.exeC:\Windows\system32\inbsfowhf.exe92⤵PID:4444
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe93⤵PID:2144
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe94⤵PID:5260
-
C:\Windows\SysWOW64\inuwftrhn.exeC:\Windows\system32\inuwftrhn.exe95⤵PID:2772
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe96⤵PID:5412
-
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe97⤵PID:5492
-
C:\Windows\SysWOW64\inowmiavg.exeC:\Windows\system32\inowmiavg.exe98⤵PID:5580
-
C:\Windows\SysWOW64\inblsqhkm.exeC:\Windows\system32\inblsqhkm.exe99⤵PID:5644
-
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe100⤵PID:5724
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe101⤵PID:5820
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe102⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1248 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe103⤵PID:5972
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe104⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe105⤵PID:6124
-
C:\Windows\SysWOW64\inijzqpfx.exeC:\Windows\system32\inijzqpfx.exe106⤵PID:1512
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe107⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5156 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe108⤵PID:2024
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe109⤵PID:1116
-
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe110⤵PID:5132
-
C:\Windows\SysWOW64\inpkfxleq.exeC:\Windows\system32\inpkfxleq.exe111⤵PID:3420
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe112⤵PID:1520
-
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe113⤵PID:5648
-
C:\Windows\SysWOW64\inbnjcuis.exeC:\Windows\system32\inbnjcuis.exe114⤵PID:4948
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe115⤵PID:4256
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe116⤵
- System Location Discovery: System Language Discovery
PID:3976 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe117⤵PID:4680
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe118⤵PID:3680
-
C:\Windows\SysWOW64\insjarhdx.exeC:\Windows\system32\insjarhdx.exe119⤵PID:4912
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe120⤵PID:2776
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe121⤵PID:3180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-