Analysis
- max time kernel
58s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 15:02
Behavioral task
behavioral1
Sample
2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe
- Size 348KB
- Sample261014-sel4rawzbs
- SHA256 8ec35d3ec0ae7040e8c2ac3683b1f65ada5d7ca5bf5bccd917e3a5ba948eb04c
- MD5 a80971fc35ed36769bf0c1126a129b82
- SHA1 47f2d617391c83456035c4fa1e8aff7b4a4e66f8
- SHA512 5c1bb09988f4fdff95bc5a4a7675ed59bbda523e5f6124091cf7d52ef40186b1183d43297e789e05399876c55d51ad578d767a9cd474f0eab1b3f0626b26fde1
- SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0Sb:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0/
- TLSH T1CA74DF01BEE640F9EAF8003C30FB2776963B6898FB085FD36319EA751837555E632256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 47 IoCs
resource yara_rule behavioral2/memory/5832-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x001200000001c311-12.dat family_gh0strat behavioral2/files/0x000d00000001c459-20.dat family_gh0strat behavioral2/memory/5832-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c45f-38.dat family_gh0strat behavioral2/memory/4808-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2784-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c463-70.dat family_gh0strat behavioral2/files/0x000d00000001c467-90.dat family_gh0strat behavioral2/files/0x000d00000001c46b-112.dat family_gh0strat behavioral2/files/0x000d00000001c46f-137.dat family_gh0strat behavioral2/files/0x000d00000001c477-178.dat family_gh0strat behavioral2/memory/4384-293-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/464-359-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/980-593-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5552-575-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1636-557-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3336-539-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2520-521-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5340-503-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5116-485-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1968-467-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4348-449-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2324-431-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3216-413-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2132-395-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4520-377-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ac-355.dat family_gh0strat behavioral2/memory/4120-337-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a8-333.dat family_gh0strat behavioral2/memory/3488-315-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a4-311.dat family_gh0strat behavioral2/files/0x000d00000001c49f-289.dat family_gh0strat behavioral2/memory/2472-271-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c49b-267.dat family_gh0strat behavioral2/memory/3116-248-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c497-244.dat family_gh0strat behavioral2/memory/5516-226-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c47f-222.dat family_gh0strat behavioral2/memory/3624-204-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c47b-200.dat family_gh0strat behavioral2/memory/244-182-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4932-159-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c473-156.dat family_gh0strat behavioral2/memory/4688-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/708-116-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4444-93-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5958E86-CFC3-46d6-8EA3-B208004715AA}\stubpath = "C:\\Windows\\system32\\infhthtec.exe" inruwvobn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B06DCF11-D5DA-4189-A288-9F5A817815AC}\stubpath = "C:\\Windows\\system32\\inbmkzbqa.exe" inzkcszdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{272CAB7B-9B08-43cc-8387-35BC388E0DBF} insulctjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23AA9066-18AA-425f-88AA-5EA9EC77B92C} inilftocs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7D773E8-09F7-453e-A103-211F8E81A380}\stubpath = "C:\\Windows\\system32\\inwuyycww.exe" insnyjjgx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{071505A1-E00E-48ac-95B6-C80CB4A89623}\stubpath = "C:\\Windows\\system32\\inrcscxou.exe" inymcufhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F835DDC-AC37-4069-9623-99664521B4D3}\stubpath = "C:\\Windows\\system32\\inigtklnv.exe" inxhvtpha.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB3884EC-2758-4e37-9351-DEA34A60EF25} inqdhyock.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{177DF05D-118C-4ec1-8BFD-372F46344CE2}\stubpath = "C:\\Windows\\system32\\inoropope.exe" inuiybnpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACAEF359-FBBD-4969-B1A2-6D5332B268F8} ingtjmoji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B19839DB-AE6A-4633-806E-2FBDD2883961} indhodkji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2E16A12-05F0-4067-AA7D-A946D714F488} infvqbbup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EB675FD-22C6-406d-906E-773DC0A29677} inhqlgymf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CED204A8-26C4-4974-9BB0-6F36E80A1671} inpatbkcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A52F8B9-2B01-4a96-9848-D39E1682CA34} innqsrkjz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42FC914A-FDF9-41bd-B3C0-6C93E0F279F6} inbsbjtei.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A99119B-3115-4a5d-A279-E5B5E8AE2213}\stubpath = "C:\\Windows\\system32\\inudpxert.exe" injrhdzvq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2DB5902-8C4D-4d50-8ABC-542B57DE10E5} inuwjozuo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74513A7B-DBC8-4165-8B69-26436CE43D6A}\stubpath = "C:\\Windows\\system32\\injkrqgyq.exe" inaikwkwh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C506B50-B3AE-4cd9-A331-EB9562335290}\stubpath = "C:\\Windows\\system32\\indlyubtu.exe" incpcgxnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB9D8449-9125-4a19-8382-1EEC5B6E62B2}\stubpath = "C:\\Windows\\system32\\inqxvmprs.exe" inisglpjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E1D09D6-0623-4c72-8F19-C5CABA32F4E9}\stubpath = "C:\\Windows\\system32\\inxndtjlz.exe" inxujybfr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23078558-4D5C-42cb-B0A1-3598CD64E89A} inetlfmxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B3E0A64-B940-40b7-8183-E51E7CCC6120} inacgtgkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F56ED97-A509-438e-92A1-0BD663EB8ECD} infgwnmcy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{647A79CB-1349-4628-A2F5-8C8AC0D363CD}\stubpath = "C:\\Windows\\system32\\inruwvobn.exe" inpleqlxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B284F31C-5B45-47c6-828B-66968D40C4CD}\stubpath = "C:\\Windows\\system32\\ingerepgv.exe" inbmkzbqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12D67345-D5AB-4403-9E9B-0D88F36B02C8}\stubpath = "C:\\Windows\\system32\\intglbjrf.exe" inigkkvii.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D08B8C2-3F68-4ff8-B165-2A5960982399} inytozkkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F02AFC3E-94F3-4f7c-899B-1DE8304CE064}\stubpath = "C:\\Windows\\system32\\inaaajueu.exe" inqfeufhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{751A7D85-344F-45bf-A994-044442F659B7} inncprues.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AFC4839-8D91-4a7d-B76F-487E83BFC1F8} ingcowdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F0AB264-F612-4e02-AFEE-8D442D3415CD}\stubpath = "C:\\Windows\\system32\\inarenvge.exe" intndtuwg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CBA1929-8F97-4a8c-B20C-5062067332FC} inldtepix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADA17BF4-8833-4b7c-862F-12FB6E3DC797} inclwgwbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8A34BF7-4FED-41a8-B0C8-02C28E770363}\stubpath = "C:\\Windows\\system32\\inebmvqfa.exe" invshckbs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E43F2C6F-708D-443b-9849-18AB3900454A} incixldvq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E5CE1AE-56D0-42ee-B72D-B910CD8A4C5F} invuwaxma.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F54DA31-E3C8-455f-87E3-CAFA9AFE7B27} innbxlquo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3C0717D-5024-42a2-9DA2-0283723267E5}\stubpath = "C:\\Windows\\system32\\inrdysgih.exe" inmtnbdcu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C397869F-4E28-4451-90C3-E0BCC347AC4E} infdqdofu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE3DF77F-DE3E-4d70-8BBD-44A57B31691C}\stubpath = "C:\\Windows\\system32\\inrkqhiua.exe" incjmswjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{665BA8E0-6DC1-47fe-B535-E8357F38299A}\stubpath = "C:\\Windows\\system32\\indjvakex.exe" inlhagxpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{599C5915-5D0C-48ab-AE3A-3BB7F6B2169D}\stubpath = "C:\\Windows\\system32\\inwtdautu.exe" inuprejup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E69E245F-C779-4754-8FAA-55C5BC5F5D02}\stubpath = "C:\\Windows\\system32\\infumgnyd.exe" inaphxbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B691514-4506-43e1-AD72-2BC8F06277DC} inxitdtqe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C6AB5D1-0EED-4da7-8C1F-DEA655EEB700} inazojdaz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBF7E2D4-8819-4217-9495-0645F2D018C8} inkxmjgli.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2A443A9-66CD-4121-9459-295C3BB47E07}\stubpath = "C:\\Windows\\system32\\inapytoun.exe" infzzbyva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{704D80A2-2A1C-40ed-90A1-21CDCF51CD52}\stubpath = "C:\\Windows\\system32\\indvjzcoq.exe" inooxsntm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EA114C7-7F9A-4bc5-82C0-531ADA8B3381} inejnhnnw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1D69E09-04FD-45a1-8C77-3461D5482AB8}\stubpath = "C:\\Windows\\system32\\inmktaxgs.exe" inaljyapn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F13B4300-4257-4e63-BE07-69D19051CC49} infzicqlp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62429C06-40B2-485c-9F22-1B8076152C38} innwfcplb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{701AF777-1DEE-42d9-A757-953E46B839EE} intxcqoxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E26E816-E835-4983-8520-9F1A9F0E0892}\stubpath = "C:\\Windows\\system32\\injtvdfif.exe" infhrodsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD59E738-61C0-4715-ACE6-D7A7BECEB4D2}\stubpath = "C:\\Windows\\system32\\incehxwfd.exe" inpprolqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B17DBBF-2B97-4795-A012-9717DC2A82B2} inaivxrqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{733E79FF-7EF2-4d4f-BE9A-C040052903CC} indzyzoqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A970665A-9DA0-46dc-A4FD-F719416908FA} inqdmufdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EC9E983-0180-43bc-9889-B9DD9D75861F} infrgacrf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1C13994-7FC1-41af-8BB1-4E9EF6517D3E}\stubpath = "C:\\Windows\\system32\\intuwvzao.exe" inczogbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7BA708F-AB7E-4993-813F-7EFBA52EB2EB}\stubpath = "C:\\Windows\\system32\\intsuvkkg.exe" inyjbrycn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF10E23B-3246-48f0-9B1C-0B292EB43EFD}\stubpath = "C:\\Windows\\system32\\ingvnhoze.exe" inbpxnjbw.exe - ACProtect 1.3x - 1.4x DLL software 16 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a00000001b82c-4.dat acprotect behavioral2/files/0x000d00000001c45c-28.dat acprotect behavioral2/files/0x000d00000001c461-51.dat acprotect behavioral2/files/0x000d00000001c475-163.dat acprotect behavioral2/files/0x000d00000001c4a6-318.dat acprotect behavioral2/files/0x000d00000001c4aa-340.dat acprotect behavioral2/files/0x000d00000001c4a1-296.dat acprotect behavioral2/files/0x000d00000001c49d-274.dat acprotect behavioral2/files/0x000d00000001c499-251.dat acprotect behavioral2/files/0x000d00000001c481-229.dat acprotect behavioral2/files/0x000d00000001c47d-207.dat acprotect behavioral2/files/0x000d00000001c479-185.dat acprotect behavioral2/files/0x000d00000001c471-141.dat acprotect behavioral2/files/0x000d00000001c46d-119.dat acprotect behavioral2/files/0x000d00000001c469-97.dat acprotect behavioral2/files/0x000d00000001c465-74.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4808 inmprqjiy.exe 2784 injyqkarh.exe 4444 inoavpdfe.exe 708 intfuikjc.exe 4688 inldtepix.exe 4932 inbqiycju.exe 244 inyufnzuj.exe 3624 incgzwjvl.exe 5516 inaphxbit.exe 3116 infumgnyd.exe 2472 inkzrlbas.exe 4384 inogwahsa.exe 3488 inetlfmxc.exe 4120 inkbaivic.exe 464 inwmpgfnn.exe 4520 inbrulkss.exe 2132 inxiaqxbm.exe 3216 innfvgrkz.exe 2324 indskelwb.exe 4348 inixpjqgj.exe 1968 inmeufqjy.exe 5116 invrckwrg.exe 5340 indwztgsi.exe 2520 inpleqlxa.exe 3336 inruwvobn.exe 1636 infhthtec.exe 5552 inzloqpih.exe 980 inqtvunam.exe 3964 inmnccutj.exe 4704 inykznpoh.exe 4856 inhiypoew.exe 4700 inecpcnet.exe 4948 inahuhbcs.exe 2716 inhwnltjf.exe 1496 incrjzdkv.exe 4872 inhwoipfi.exe 3044 inxsdoolp.exe 4232 indxawycz.exe 3036 inugvjlkd.exe 1132 inxrqyyst.exe 2924 inochlfll.exe 3408 incvyzsfr.exe 1484 ingwzqpxx.exe 2348 inupkqjvx.exe 456 inthmqkqb.exe 5424 injyiwuqi.exe 2500 innuocedv.exe 2484 inadbobmd.exe 588 ingtgabri.exe 4804 inmtnbdcu.exe 2512 inrdysgih.exe 4744 inwixlnmf.exe 6028 inljyapnv.exe 916 incraptug.exe 1864 insrzztuj.exe 5872 inomzqrdt.exe 4772 inpiofygs.exe 2516 inilcbjwj.exe 4544 inlhzufqa.exe 2892 inatwyxqd.exe 5624 inxhvtpha.exe 6084 inigtklnv.exe 1140 inuqbjvqf.exe 2312 inhegsgsd.exe - Loads dropped DLL 64 IoCs
pid Process 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe 4808 inmprqjiy.exe 4808 inmprqjiy.exe 2784 injyqkarh.exe 2784 injyqkarh.exe 4444 inoavpdfe.exe 4444 inoavpdfe.exe 708 intfuikjc.exe 708 intfuikjc.exe 4688 inldtepix.exe 4688 inldtepix.exe 4932 inbqiycju.exe 4932 inbqiycju.exe 244 inyufnzuj.exe 244 inyufnzuj.exe 3624 incgzwjvl.exe 3624 incgzwjvl.exe 5516 inaphxbit.exe 5516 inaphxbit.exe 3116 infumgnyd.exe 3116 infumgnyd.exe 2472 inkzrlbas.exe 2472 inkzrlbas.exe 4384 inogwahsa.exe 4384 inogwahsa.exe 3488 inetlfmxc.exe 3488 inetlfmxc.exe 4120 inkbaivic.exe 4120 inkbaivic.exe 464 inwmpgfnn.exe 464 inwmpgfnn.exe 4520 inbrulkss.exe 4520 inbrulkss.exe 2132 inxiaqxbm.exe 2132 inxiaqxbm.exe 3216 innfvgrkz.exe 3216 innfvgrkz.exe 2324 indskelwb.exe 2324 indskelwb.exe 4348 inixpjqgj.exe 4348 inixpjqgj.exe 1968 inmeufqjy.exe 1968 inmeufqjy.exe 5116 invrckwrg.exe 5116 invrckwrg.exe 5340 indwztgsi.exe 5340 indwztgsi.exe 2520 inpleqlxa.exe 2520 inpleqlxa.exe 3336 inruwvobn.exe 3336 inruwvobn.exe 1636 infhthtec.exe 1636 infhthtec.exe 5552 inzloqpih.exe 5552 inzloqpih.exe 980 inqtvunam.exe 980 inqtvunam.exe 3964 inmnccutj.exe 3964 inmnccutj.exe 4704 inykznpoh.exe 4704 inykznpoh.exe 4856 inhiypoew.exe 4856 inhiypoew.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat intfuikjc.exe File created C:\Windows\SysWOW64\inetlfmxc.exe inogwahsa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpleqlxa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaljyapn.exe File opened for modification C:\Windows\SysWOW64\infzzbyva.exe_lang.ini iniowtbls.exe File created C:\Windows\SysWOW64\inzloqpih.exe infhthtec.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini inxsdoolp.exe File opened for modification C:\Windows\SysWOW64\inrdysgih.exe_lang.ini inmtnbdcu.exe File created C:\Windows\SysWOW64\insnyjjgx.exe indzyzoqh.exe File opened for modification C:\Windows\SysWOW64\inupalliz.exe_lang.ini inkvbdqbu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indjvakex.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuytzxmg.exe File opened for modification C:\Windows\SysWOW64\inuzplcxm.exe_lang.ini inhfnbzwf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqcxrfhg.exe File created C:\Windows\SysWOW64\infdqdofu.exe inpbwqegf.exe File opened for modification C:\Windows\SysWOW64\intsuvkkg.exe_lang.ini inyjbrycn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrlmbbts.exe File opened for modification C:\Windows\SysWOW64\ineugyxhj.exe_lang.ini invudbffq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyixbhg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuvxhdct.exe File created C:\Windows\SysWOW64\intfwsljg.exe inkxncqsn.exe File created C:\Windows\SysWOW64\indxawycz.exe inxsdoolp.exe File opened for modification C:\Windows\SysWOW64\ingwzqpxx.exe_lang.ini incvyzsfr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineqbmfxl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injsnioht.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inujlcwuk.exe File opened for modification C:\Windows\SysWOW64\inlgphgbd.exe_lang.ini innbxlquo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpatbkcw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvgovkd.exe File created C:\Windows\SysWOW64\indtwnmuu.exe injkrqgyq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpdimgmm.exe File created C:\Windows\SysWOW64\inqdhyock.exe inlcfvhzy.exe File opened for modification C:\Windows\SysWOW64\inhjvjvge.exe_lang.ini inbqostfv.exe File opened for modification C:\Windows\SysWOW64\infrgacrf.exe_lang.ini invzzdxxz.exe File opened for modification C:\Windows\SysWOW64\inlbjrbai.exe_lang.ini inucuflpc.exe File created C:\Windows\SysWOW64\inxrqyyst.exe inugvjlkd.exe File created C:\Windows\SysWOW64\ingrakqpr.exe inocokdvj.exe File created C:\Windows\SysWOW64\inqgdzfrf.exe inpsutmlb.exe File created C:\Windows\SysWOW64\inqxbfmkb.exe inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\inxtemyti.exe_lang.ini inejnhnnw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmktaxgs.exe File opened for modification C:\Windows\SysWOW64\inqxvmprs.exe_lang.ini inisglpjp.exe File created C:\Windows\SysWOW64\inmjhdsul.exe inwldhtuf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkbaivic.exe File created C:\Windows\SysWOW64\inknedlyl.exe ineeenyiy.exe File opened for modification C:\Windows\SysWOW64\inpqffxwb.exe_lang.ini incanalcr.exe File created C:\Windows\SysWOW64\inatybwnb.exe invbdruwx.exe File created C:\Windows\SysWOW64\inniombtb.exe inaouaylq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inclzteci.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineamubie.exe File created C:\Windows\SysWOW64\innptoush.exe inudpxert.exe File created C:\Windows\SysWOW64\innlypqcs.exe ingvzmksi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaivxrqr.exe File created C:\Windows\SysWOW64\inmkimmxk.exe intekobge.exe File opened for modification C:\Windows\SysWOW64\infvqbbup.exe_lang.ini insulctjf.exe File created C:\Windows\SysWOW64\inlgwrccv.exe invlhtipl.exe File created C:\Windows\SysWOW64\inmgmynpz.exe incawvwly.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhgfxhuk.exe File created C:\Windows\SysWOW64\infzicqlp.exe injfdlthy.exe File created C:\Windows\SysWOW64\inatwyxqd.exe inlhzufqa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingfvhjng.exe File opened for modification C:\Windows\SysWOW64\ingvetxyk.exe_lang.ini inaqceivb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inddqfcew.exe File opened for modification C:\Windows\SysWOW64\inkvbdqbu.exe_lang.ini inbsfowhf.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpleqlxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inymcufhc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingcowdkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innljnnyl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmgmynpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inudpxert.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvetxyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkvggzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwbpnkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmosntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmsevrki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inamdunku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innrmsqfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfyviuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkuaczqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgacrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyufnzuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuqbjvqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incanalcr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbpxnjbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvnhoze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrfpuysy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyjbrycn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtwnmuu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inufueytz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniowtbls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innusjmop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmjhdsul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqostfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inboqtdrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbwxiybi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupkqjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbmkzbqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inocokdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invbdruwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlvgkyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invkhejgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpatbkcw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insylvfcw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infudswxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniombtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlofemzm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlaxcmgz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innbxlquo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intikurgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inldtepix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvjzcoq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inboqtqar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrkqhiua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inulkzdji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrggyxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvcvbrm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzuolauz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbkvfva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incfdqdof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpprolqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indrmgdxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsbjtei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrurbsrs.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe 4808 inmprqjiy.exe 4808 inmprqjiy.exe 2784 injyqkarh.exe 2784 injyqkarh.exe 4444 inoavpdfe.exe 4444 inoavpdfe.exe 708 intfuikjc.exe 708 intfuikjc.exe 4688 inldtepix.exe 4688 inldtepix.exe 4932 inbqiycju.exe 4932 inbqiycju.exe 244 inyufnzuj.exe 244 inyufnzuj.exe 3624 incgzwjvl.exe 3624 incgzwjvl.exe 5516 inaphxbit.exe 5516 inaphxbit.exe 3116 infumgnyd.exe 3116 infumgnyd.exe 2472 inkzrlbas.exe 2472 inkzrlbas.exe 4384 inogwahsa.exe 4384 inogwahsa.exe 3488 inetlfmxc.exe 3488 inetlfmxc.exe 4120 inkbaivic.exe 4120 inkbaivic.exe 464 inwmpgfnn.exe 464 inwmpgfnn.exe 4520 inbrulkss.exe 4520 inbrulkss.exe 2132 inxiaqxbm.exe 2132 inxiaqxbm.exe 3216 innfvgrkz.exe 3216 innfvgrkz.exe 2324 indskelwb.exe 2324 indskelwb.exe 4348 inixpjqgj.exe 4348 inixpjqgj.exe 1968 inmeufqjy.exe 1968 inmeufqjy.exe 5116 invrckwrg.exe 5116 invrckwrg.exe 5340 indwztgsi.exe 5340 indwztgsi.exe 2520 inpleqlxa.exe 2520 inpleqlxa.exe 3336 inruwvobn.exe 3336 inruwvobn.exe 1636 infhthtec.exe 1636 infhthtec.exe 5552 inzloqpih.exe 5552 inzloqpih.exe 980 inqtvunam.exe 980 inqtvunam.exe 3964 inmnccutj.exe 3964 inmnccutj.exe 4704 inykznpoh.exe 4704 inykznpoh.exe 4856 inhiypoew.exe 4856 inhiypoew.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe Token: SeDebugPrivilege 4808 inmprqjiy.exe Token: SeDebugPrivilege 2784 injyqkarh.exe Token: SeDebugPrivilege 4444 inoavpdfe.exe Token: SeDebugPrivilege 708 intfuikjc.exe Token: SeDebugPrivilege 4688 inldtepix.exe Token: SeDebugPrivilege 4932 inbqiycju.exe Token: SeDebugPrivilege 244 inyufnzuj.exe Token: SeDebugPrivilege 3624 incgzwjvl.exe Token: SeDebugPrivilege 5516 inaphxbit.exe Token: SeDebugPrivilege 3116 infumgnyd.exe Token: SeDebugPrivilege 2472 inkzrlbas.exe Token: SeDebugPrivilege 4384 inogwahsa.exe Token: SeDebugPrivilege 3488 inetlfmxc.exe Token: SeDebugPrivilege 4120 inkbaivic.exe Token: SeDebugPrivilege 464 inwmpgfnn.exe Token: SeDebugPrivilege 4520 inbrulkss.exe Token: SeDebugPrivilege 2132 inxiaqxbm.exe Token: SeDebugPrivilege 3216 innfvgrkz.exe Token: SeDebugPrivilege 2324 indskelwb.exe Token: SeDebugPrivilege 4348 inixpjqgj.exe Token: SeDebugPrivilege 1968 inmeufqjy.exe Token: SeDebugPrivilege 5116 invrckwrg.exe Token: SeDebugPrivilege 5340 indwztgsi.exe Token: SeDebugPrivilege 2520 inpleqlxa.exe Token: SeDebugPrivilege 3336 inruwvobn.exe Token: SeDebugPrivilege 1636 infhthtec.exe Token: SeDebugPrivilege 5552 inzloqpih.exe Token: SeDebugPrivilege 980 inqtvunam.exe Token: SeDebugPrivilege 3964 inmnccutj.exe Token: SeDebugPrivilege 4704 inykznpoh.exe Token: SeDebugPrivilege 4856 inhiypoew.exe Token: SeDebugPrivilege 4700 inecpcnet.exe Token: SeDebugPrivilege 4948 inahuhbcs.exe Token: SeDebugPrivilege 2716 inhwnltjf.exe Token: SeDebugPrivilege 1496 incrjzdkv.exe Token: SeDebugPrivilege 4872 inhwoipfi.exe Token: SeDebugPrivilege 3044 inxsdoolp.exe Token: SeDebugPrivilege 4232 indxawycz.exe Token: SeDebugPrivilege 3036 inugvjlkd.exe Token: SeDebugPrivilege 1132 inxrqyyst.exe Token: SeDebugPrivilege 2924 inochlfll.exe Token: SeDebugPrivilege 3408 incvyzsfr.exe Token: SeDebugPrivilege 1484 ingwzqpxx.exe Token: SeDebugPrivilege 2348 inupkqjvx.exe Token: SeDebugPrivilege 456 inthmqkqb.exe Token: SeDebugPrivilege 5424 injyiwuqi.exe Token: SeDebugPrivilege 2500 innuocedv.exe Token: SeDebugPrivilege 2484 inadbobmd.exe Token: SeDebugPrivilege 588 ingtgabri.exe Token: SeDebugPrivilege 4804 inmtnbdcu.exe Token: SeDebugPrivilege 2512 inrdysgih.exe Token: SeDebugPrivilege 4744 inwixlnmf.exe Token: SeDebugPrivilege 6028 inljyapnv.exe Token: SeDebugPrivilege 916 incraptug.exe Token: SeDebugPrivilege 1864 insrzztuj.exe Token: SeDebugPrivilege 5872 inomzqrdt.exe Token: SeDebugPrivilege 4772 inpiofygs.exe Token: SeDebugPrivilege 2516 inilcbjwj.exe Token: SeDebugPrivilege 4544 inlhzufqa.exe Token: SeDebugPrivilege 2892 inatwyxqd.exe Token: SeDebugPrivilege 5624 inxhvtpha.exe Token: SeDebugPrivilege 6084 inigtklnv.exe Token: SeDebugPrivilege 1140 inuqbjvqf.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe 4808 inmprqjiy.exe 2784 injyqkarh.exe 4444 inoavpdfe.exe 708 intfuikjc.exe 4688 inldtepix.exe 4932 inbqiycju.exe 244 inyufnzuj.exe 3624 incgzwjvl.exe 5516 inaphxbit.exe 3116 infumgnyd.exe 2472 inkzrlbas.exe 4384 inogwahsa.exe 3488 inetlfmxc.exe 4120 inkbaivic.exe 464 inwmpgfnn.exe 4520 inbrulkss.exe 2132 inxiaqxbm.exe 3216 innfvgrkz.exe 2324 indskelwb.exe 4348 inixpjqgj.exe 1968 inmeufqjy.exe 5116 invrckwrg.exe 5340 indwztgsi.exe 2520 inpleqlxa.exe 3336 inruwvobn.exe 1636 infhthtec.exe 5552 inzloqpih.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5832 wrote to memory of 4808 5832 2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe 89 PID 4808 wrote to memory of 2784 4808 inmprqjiy.exe 90 PID 2784 wrote to memory of 4444 2784 injyqkarh.exe 91 PID 4444 wrote to memory of 708 4444 inoavpdfe.exe 92 PID 708 wrote to memory of 4688 708 intfuikjc.exe 93 PID 4688 wrote to memory of 4932 4688 inldtepix.exe 94 PID 4932 wrote to memory of 244 4932 inbqiycju.exe 95 PID 244 wrote to memory of 3624 244 inyufnzuj.exe 96 PID 3624 wrote to memory of 5516 3624 incgzwjvl.exe 97 PID 5516 wrote to memory of 3116 5516 inaphxbit.exe 98 PID 3116 wrote to memory of 2472 3116 infumgnyd.exe 99 PID 2472 wrote to memory of 4384 2472 inkzrlbas.exe 100 PID 4384 wrote to memory of 3488 4384 inogwahsa.exe 101 PID 3488 wrote to memory of 4120 3488 inetlfmxc.exe 102 PID 4120 wrote to memory of 464 4120 inkbaivic.exe 103 PID 464 wrote to memory of 4520 464 inwmpgfnn.exe 104 PID 4520 wrote to memory of 2132 4520 inbrulkss.exe 105 PID 2132 wrote to memory of 3216 2132 inxiaqxbm.exe 106 PID 3216 wrote to memory of 2324 3216 innfvgrkz.exe 107 PID 2324 wrote to memory of 4348 2324 indskelwb.exe 108 PID 4348 wrote to memory of 1968 4348 inixpjqgj.exe 109 PID 1968 wrote to memory of 5116 1968 inmeufqjy.exe 110 PID 5116 wrote to memory of 5340 5116 invrckwrg.exe 111 PID 5340 wrote to memory of 2520 5340 indwztgsi.exe 112 PID 2520 wrote to memory of 3336 2520 inpleqlxa.exe 113 PID 3336 wrote to memory of 1636 3336 inruwvobn.exe 114 PID 1636 wrote to memory of 5552 1636 infhthtec.exe 115 PID 5552 wrote to memory of 980 5552 inzloqpih.exe 116 PID 980 wrote to memory of 3964 980 inqtvunam.exe 117 PID 3964 wrote to memory of 4704 3964 inmnccutj.exe 118 PID 4704 wrote to memory of 4856 4704 inykznpoh.exe 119 PID 4856 wrote to memory of 4700 4856 inhiypoew.exe 120 PID 4700 wrote to memory of 4948 4700 inecpcnet.exe 121 PID 4948 wrote to memory of 2716 4948 inahuhbcs.exe 122 PID 2716 wrote to memory of 1496 2716 inhwnltjf.exe 123 PID 1496 wrote to memory of 4872 1496 incrjzdkv.exe 124 PID 4872 wrote to memory of 3044 4872 inhwoipfi.exe 125 PID 3044 wrote to memory of 4232 3044 inxsdoolp.exe 126 PID 4232 wrote to memory of 3036 4232 indxawycz.exe 127 PID 3036 wrote to memory of 1132 3036 inugvjlkd.exe 128 PID 1132 wrote to memory of 2924 1132 inxrqyyst.exe 129 PID 2924 wrote to memory of 3408 2924 inochlfll.exe 130 PID 3408 wrote to memory of 1484 3408 incvyzsfr.exe 131 PID 1484 wrote to memory of 2348 1484 ingwzqpxx.exe 132 PID 2348 wrote to memory of 456 2348 inupkqjvx.exe 133 PID 456 wrote to memory of 5424 456 inthmqkqb.exe 134 PID 5424 wrote to memory of 2500 5424 injyiwuqi.exe 135 PID 2500 wrote to memory of 2484 2500 innuocedv.exe 136 PID 2484 wrote to memory of 588 2484 inadbobmd.exe 137 PID 588 wrote to memory of 4804 588 ingtgabri.exe 138 PID 4804 wrote to memory of 2512 4804 inmtnbdcu.exe 139 PID 2512 wrote to memory of 4744 2512 inrdysgih.exe 140 PID 4744 wrote to memory of 6028 4744 inwixlnmf.exe 141 PID 6028 wrote to memory of 916 6028 inljyapnv.exe 142 PID 916 wrote to memory of 1864 916 incraptug.exe 143 PID 1864 wrote to memory of 5872 1864 insrzztuj.exe 144 PID 5872 wrote to memory of 4772 5872 inomzqrdt.exe 145 PID 4772 wrote to memory of 2516 4772 inpiofygs.exe 146 PID 2516 wrote to memory of 4544 2516 inilcbjwj.exe 147 PID 4544 wrote to memory of 2892 4544 inlhzufqa.exe 148 PID 2892 wrote to memory of 5624 2892 inatwyxqd.exe 149 PID 5624 wrote to memory of 6084 5624 inxhvtpha.exe 150 PID 6084 wrote to memory of 1140 6084 inigtklnv.exe 151 PID 1140 wrote to memory of 2312 1140 inuqbjvqf.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_a80971fc35ed36769bf0c1126a129b82_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe25⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe26⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\inupkqjvx.exeC:\Windows\system32\inupkqjvx.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\injyiwuqi.exeC:\Windows\system32\injyiwuqi.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe62⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe65⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe66⤵PID:4940
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe67⤵PID:1068
-
C:\Windows\SysWOW64\inqzaupvo.exeC:\Windows\system32\inqzaupvo.exe68⤵PID:748
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe69⤵PID:5328
-
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe70⤵PID:2624
-
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe71⤵PID:3032
-
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe72⤵
- Drops file in System32 directory
PID:392 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe73⤵PID:5756
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe74⤵PID:2860
-
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe75⤵PID:992
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2804 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe77⤵PID:5980
-
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe78⤵
- Drops file in System32 directory
PID:5236 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe79⤵PID:3132
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe80⤵PID:2672
-
C:\Windows\SysWOW64\inacgtgkr.exeC:\Windows\system32\inacgtgkr.exe81⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2216 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe82⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe83⤵PID:4392
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe84⤵
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe85⤵PID:5888
-
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\system32\indeulkya.exe86⤵PID:5416
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe87⤵
- Drops file in System32 directory
PID:5080 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5256 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe89⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe90⤵PID:5032
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe91⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe92⤵PID:4720
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe93⤵PID:5468
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe94⤵PID:1188
-
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe95⤵PID:1388
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe96⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2696 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2660 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe98⤵PID:6044
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe99⤵PID:4124
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe100⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2776 -
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe101⤵PID:4364
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe102⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1404 -
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe103⤵PID:3564
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe104⤵PID:2364
-
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe105⤵PID:4296
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe106⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:5380 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe107⤵
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe108⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4140 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe109⤵
- Drops file in System32 directory
PID:3416 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe110⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe111⤵PID:5088
-
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe112⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4760 -
C:\Windows\SysWOW64\indvjzcoq.exeC:\Windows\system32\indvjzcoq.exe113⤵
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe114⤵
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe115⤵PID:4212
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe116⤵PID:1768
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe117⤵PID:5448
-
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe118⤵PID:824
-
C:\Windows\SysWOW64\inwemzvcu.exeC:\Windows\system32\inwemzvcu.exe119⤵PID:4892
-
C:\Windows\SysWOW64\inrxixhwa.exeC:\Windows\system32\inrxixhwa.exe120⤵PID:2852
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe121⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-