Analysis
- max time kernel
99s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 09:57
Behavioral task
behavioral1
Sample
2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe
- Size 2.2MB
- Sample261102-ly332svs5q
- SHA256 837e4150137be7ae5901c90956c184314b4c941c9196cd487afad33f6a826fc8
- MD5 bf3b517d378ba44ecdc0aae519e7bb31
- SHA1 f7e7c6deb744703473c745b12859e3db30e2b3af
- SHA512 001882eb8045f5135ca0009a20ff88a4a847a405e49ee868765daf1d0713ed5be931c2a56dcc189dc96ab4d06d879b5d3695d16bab1a1dfaef5c99a55c509166
- SSDEEP 24576:ouLwoR5RNPjKoOIuLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR54:RPjOxPjOrPjOQPjOWPjOJPjOfPG
- TLSH T163B5DF01BEE740F9EAE8003C20FB2776963B6898FB085FD36319EE755837555E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/3648-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x0005000000016b3c-13.dat family_gh0strat behavioral2/files/0x000500000001b7fb-24.dat family_gh0strat behavioral2/memory/3648-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c48f-37.dat family_gh0strat behavioral2/memory/3376-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c495-64.dat family_gh0strat behavioral2/memory/1832-67-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c498-89.dat family_gh0strat behavioral2/files/0x000d00000001c4a7-132.dat family_gh0strat behavioral2/files/0x000d00000001c4ab-153.dat family_gh0strat behavioral2/files/0x000d00000001c4bd-242.dat family_gh0strat behavioral2/files/0x000d00000001c4cb-308.dat family_gh0strat behavioral2/memory/1012-334-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4824-446-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1476-572-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5480-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3672-590-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5912-554-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4528-536-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1128-518-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5964-500-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5172-481-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3372-464-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4920-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5720-410-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2468-392-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2304-374-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4204-356-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d5-352.dat family_gh0strat behavioral2/files/0x000d00000001c4d0-330.dat family_gh0strat behavioral2/memory/2708-312-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2144-290-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c7-286.dat family_gh0strat behavioral2/memory/5540-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c1-264.dat family_gh0strat behavioral2/memory/4372-246-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3772-224-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b7-220.dat family_gh0strat behavioral2/memory/6104-202-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b3-198.dat family_gh0strat behavioral2/memory/572-180-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4af-176.dat family_gh0strat behavioral2/memory/1400-158-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5520-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2772-114-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c49d-110.dat family_gh0strat behavioral2/memory/4532-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{411818C0-D8CF-44b0-8E02-B5E6FC66FB01}\stubpath = "C:\\Windows\\system32\\inhlzrduq.exe" inpjeydbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5F53FD-CB8E-4228-ADDE-9F8419E2D63C}\stubpath = "C:\\Windows\\system32\\insanriau.exe" inckagkpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AEA16EF-7E1E-4a56-8F3A-AAFD4820C387}\stubpath = "C:\\Windows\\system32\\inuprpjqa.exe" inwbpkebv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{691D6124-136B-45f0-AA37-6B9A8B938700} inkjzlnrk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FEDF0023-F80B-4d4f-B20F-68D25EDEEE30} inykgfwoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C7B3923-3B2E-4977-8163-990F2B62DC88}\stubpath = "C:\\Windows\\system32\\invnbgkek.exe" inzajppij.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B255666-7629-4b3d-A678-279BC2A4C736} ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1EEE7BC-2870-4cf5-B34A-32435D7238EF} indskelwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F797B773-99CD-4818-BD95-5942FDDED4BB} indeulkya.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1922053-8B5A-4f8c-A1CF-B30AA44FFC68} inxbftvlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF1FA4EC-62AB-4b7f-BD67-F6402828DDE6} inciujlvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11365A40-0D53-4fcb-A4DD-56BC48E49E4E} inktbmkag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{135F0207-B547-4572-AE44-756CF655AF43}\stubpath = "C:\\Windows\\system32\\insbquvhx.exe" inruwvobn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D6BA43A-41F2-4d87-95A8-4F10E1F272CB} inejnhnnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D6222A6-D150-4fd9-870B-54862B243123} injausioy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5E5AB32-0CCC-4dc6-8E6D-8EEC2C552392}\stubpath = "C:\\Windows\\system32\\inzfhvydh.exe" inkveoutv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16C1A9BE-03DA-4b24-8E98-29C230D01A8B} inwhjedoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0178201-E475-4754-A810-21F0640ACC36}\stubpath = "C:\\Windows\\system32\\inoyokzfp.exe" intchxupt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC965E94-C06D-46cd-B88F-950CFB1B05C1}\stubpath = "C:\\Windows\\system32\\inixpjqgj.exe" inbrulkss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A086502F-020C-44fc-A344-587BFF9A248F} inxiaqxbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B0EC78E-805D-4cdd-A81E-5A2C1A1697FB}\stubpath = "C:\\Windows\\system32\\inpiofygs.exe" inpdimgmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8710B031-758A-418c-98AA-EDC217281CDE}\stubpath = "C:\\Windows\\system32\\inbbkvfva.exe" inknedlyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DC24F74-C16C-4a69-9C76-084B35084078} inbalzxgu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3246E0E-5EB1-48f9-B784-BF560E45B050}\stubpath = "C:\\Windows\\system32\\indrzpldy.exe" inixomukg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF97630A-A3D8-4126-B5DE-25F81FC5C868}\stubpath = "C:\\Windows\\system32\\inbhrywnq.exe" incmhaqvq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E5B9B26-6AEE-4a30-AE1B-5724E1DA9FAD} inzydrlkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{738ED471-39AA-4f17-B38C-745045127C07} inbpjipes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0191718-7410-4863-89DB-2ED4AA2AB948}\stubpath = "C:\\Windows\\system32\\inoxlbteg.exe" inhfbqsjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD2CFB88-3E1F-4ce9-B62B-B971EBED824E}\stubpath = "C:\\Windows\\system32\\intuwvzao.exe" inmgmynpz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A7849B0-C7BD-4df7-9202-B7C50C8C8413}\stubpath = "C:\\Windows\\system32\\inkivmnpx.exe" inihodrxd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07D6D13E-59C3-404b-A773-182F78D6F695} inyluacnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24D5DED0-17F0-444b-844E-A1B589262F65} inlisltat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBE0B473-9EE1-4509-B560-6CF9BD162BCD} injhpghxs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E721FAC-63DE-4623-9829-E2AABA863057}\stubpath = "C:\\Windows\\system32\\inkhtihxi.exe" invkhejgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7235A96-F0F7-4d3e-958B-A4859E6DE443}\stubpath = "C:\\Windows\\system32\\ingwzqpxx.exe" inmkoozmm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C5881CC-53F2-4904-BE92-7F0A18BF6E9E}\stubpath = "C:\\Windows\\system32\\inbnjcuis.exe" injqftzfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E3FCF4E-245D-4e99-B010-51B30F86D207}\stubpath = "C:\\Windows\\system32\\iniqgcwmo.exe" intbosajb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4AB3DFE-1679-4c21-AAF2-23BC0AAB9637}\stubpath = "C:\\Windows\\system32\\inxnewqnc.exe" invowdwcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F920B82C-3E4D-4790-9DA5-43317723513D}\stubpath = "C:\\Windows\\system32\\intfwsljg.exe" inufueytz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93859E0A-F810-48fc-A837-061D13F122D4} inuvxhdct.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E906DCD-162B-4007-9EDD-DEA777D2E258} inzrcejxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BAF16705-0DF4-491a-8CD2-257DB08F3816} indqezurm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{135F0207-B547-4572-AE44-756CF655AF43} inruwvobn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C65F3DD-0A3F-4d22-8C6F-9564570992B1} inhuwzjax.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB2CAF3D-E35C-489a-8C0D-6F426CD710C8} inwauuwtq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20A25D9D-4CB5-41ee-B6DE-9501744ADA5B}\stubpath = "C:\\Windows\\system32\\inbkobdgw.exe" indrmgdxz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D666093A-5162-4468-993F-D57A277550DD} invapablb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F50A99F-797E-4f0b-B865-BC2CF0D8C40B}\stubpath = "C:\\Windows\\system32\\inqxvmprs.exe" indnibrwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DD2226D-5AD0-46a4-BD9E-E50A6B73EB16}\stubpath = "C:\\Windows\\system32\\inbgwtosr.exe" inrumczhz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21439D27-8540-41bd-B287-887ACBEDBF8D} inbmkzbqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BE8F28E-D141-4c59-BF9E-486D5BEF8B13} inahuhbcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EEDB306C-02EB-4b55-A009-7E548FA0F922}\stubpath = "C:\\Windows\\system32\\invdmeyvk.exe" inbsfowhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF9202DE-A489-45f7-9132-A3C5FFBC12BB}\stubpath = "C:\\Windows\\system32\\incvdypdo.exe" inawcknai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FABA69CF-F7EC-4138-A534-6E94C6B8E8E0}\stubpath = "C:\\Windows\\system32\\inrurbsrs.exe" infbnevol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75BCE101-BE1B-46e5-8A68-7D90515BA8B0}\stubpath = "C:\\Windows\\system32\\inigkkvii.exe" inddqfcew.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2361C9B5-E93F-4215-9370-6BF9B040B845} injqkgmph.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60637332-93FA-4203-A824-3A288E653545} indzlgiqc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B35C4EFA-F490-4490-AC71-A565EDBD739E}\stubpath = "C:\\Windows\\system32\\inkuaczqt.exe" inuloqrtx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E6AB4DF8-7243-4aaf-9613-916513256152} inwtdautu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C47A3394-31D9-401f-B614-BF331E5C141F} inswrxvke.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D4D6EEF-1F13-4667-BF3F-06C06D583C15}\stubpath = "C:\\Windows\\system32\\intojzuff.exe" indvpwggs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93F7D36C-B96B-4998-8EDF-49ECF3F30A23}\stubpath = "C:\\Windows\\system32\\inprouzhr.exe" inymcufhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1F53394-DCA2-4658-9ED3-9893D7AE755E} insrzztuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{932DFF87-DC97-4793-AA84-3426335C0681} insgwlney.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000500000000053e-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3376 inaexuhtj.exe 1832 inqcxrfhg.exe 4532 inzvgovkd.exe 2772 inyorihpp.exe 5520 inyjbrycn.exe 1400 insohtodl.exe 572 indwztgsi.exe 6104 inzloqpih.exe 3772 inqtvunam.exe 4372 incvyzsfr.exe 5540 indhxkwmb.exe 2144 intpaiupe.exe 2708 inyufnzuj.exe 1012 inzkcszdo.exe 4204 injkrqgyq.exe 2304 infumgnyd.exe 2468 inkzrlbas.exe 5720 inruwvobn.exe 4920 insbquvhx.exe 4824 inmtnbdcu.exe 3372 insvxwpco.exe 5172 ingvnhoze.exe 5964 inlsmacbt.exe 1128 inbqiycju.exe 4528 inhfsfaqh.exe 5912 inhwfuyzl.exe 1476 injwnoaqy.exe 3672 inxtemyti.exe 5480 incgzwjvl.exe 5828 inortslka.exe 1488 inrdysgih.exe 1244 inhwoipfi.exe 4888 inldtepix.exe 4052 incanalcr.exe 4408 inwgusogd.exe 3412 injmdckxk.exe 1664 inejnhnnw.exe 2988 inddmxhxc.exe 4556 inefvmlzb.exe 2268 inrmslxzd.exe 1292 invhwkmle.exe 4592 inmprqjiy.exe 3300 inpbwqegf.exe 5848 inugvjlkd.exe 4456 injyqkarh.exe 2272 inoavpdfe.exe 4184 intfuikjc.exe 4536 inkbaivic.exe 4944 inwmpgfnn.exe 3356 inbrulkss.exe 4240 inixpjqgj.exe 2352 innuocedv.exe 2864 insezthji.exe 972 ingtgabri.exe 4736 inmeufqjy.exe 6032 incrjzdkv.exe 236 infnwdvwr.exe 2724 ingvzmksi.exe 5076 inbpxnjbw.exe 5436 inpsutmlb.exe 1624 inmnccutj.exe 5220 injrhdzvq.exe 1892 inaphxbit.exe 3816 indtwnmuu.exe - Loads dropped DLL 64 IoCs
pid Process 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe 3376 inaexuhtj.exe 3376 inaexuhtj.exe 1832 inqcxrfhg.exe 1832 inqcxrfhg.exe 4532 inzvgovkd.exe 4532 inzvgovkd.exe 2772 inyorihpp.exe 2772 inyorihpp.exe 5520 inyjbrycn.exe 5520 inyjbrycn.exe 1400 insohtodl.exe 1400 insohtodl.exe 572 indwztgsi.exe 572 indwztgsi.exe 6104 inzloqpih.exe 6104 inzloqpih.exe 3772 inqtvunam.exe 3772 inqtvunam.exe 4372 incvyzsfr.exe 4372 incvyzsfr.exe 5540 indhxkwmb.exe 5540 indhxkwmb.exe 2144 intpaiupe.exe 2144 intpaiupe.exe 2708 inyufnzuj.exe 2708 inyufnzuj.exe 1012 inzkcszdo.exe 1012 inzkcszdo.exe 4204 injkrqgyq.exe 4204 injkrqgyq.exe 2304 infumgnyd.exe 2304 infumgnyd.exe 2468 inkzrlbas.exe 2468 inkzrlbas.exe 5720 inruwvobn.exe 5720 inruwvobn.exe 4920 insbquvhx.exe 4920 insbquvhx.exe 4824 inmtnbdcu.exe 4824 inmtnbdcu.exe 3372 insvxwpco.exe 3372 insvxwpco.exe 5172 ingvnhoze.exe 5172 ingvnhoze.exe 5964 inlsmacbt.exe 5964 inlsmacbt.exe 1128 inbqiycju.exe 1128 inbqiycju.exe 4528 inhfsfaqh.exe 4528 inhfsfaqh.exe 5912 inhwfuyzl.exe 5912 inhwfuyzl.exe 1476 injwnoaqy.exe 1476 injwnoaqy.exe 3672 inxtemyti.exe 3672 inxtemyti.exe 5480 incgzwjvl.exe 5480 incgzwjvl.exe 5828 inortslka.exe 5828 inortslka.exe 1488 inrdysgih.exe 1488 inrdysgih.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inlofemzm.exe_lang.ini inzewkdpr.exe File created C:\Windows\SysWOW64\indrmgdxz.exe inucxmxol.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injflluak.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insahbdsg.exe File opened for modification C:\Windows\SysWOW64\inyjbrycn.exe_lang.ini inyorihpp.exe File opened for modification C:\Windows\SysWOW64\inlhzufqa.exe_lang.ini inxhvtpha.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkvbdqbu.exe File created C:\Windows\SysWOW64\infauwnfj.exe inckxztas.exe File created C:\Windows\SysWOW64\inrngsnzc.exe inpqffxwb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inenfezbl.exe File created C:\Windows\SysWOW64\inckxztas.exe injprzfoi.exe File opened for modification C:\Windows\SysWOW64\insnxovkm.exe_lang.ini inhomdgwi.exe File created C:\Windows\SysWOW64\infhthtec.exe invrckwrg.exe File created C:\Windows\SysWOW64\inmzesqny.exe inhuwzjax.exe File created C:\Windows\SysWOW64\inxgaoyjn.exe inquussur.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwmcsiky.exe File created C:\Windows\SysWOW64\ingyagyjp.exe ineugyxhj.exe File opened for modification C:\Windows\SysWOW64\inmflkmos.exe_lang.ini inbalzxgu.exe File created C:\Windows\SysWOW64\invbdruwx.exe inmoropop.exe File opened for modification C:\Windows\SysWOW64\indrmgdxz.exe_lang.ini inucxmxol.exe File opened for modification C:\Windows\SysWOW64\inlfbhwkc.exe_lang.ini inpdraxym.exe File opened for modification C:\Windows\SysWOW64\inhgwhjlo.exe_lang.ini insulctjf.exe File created C:\Windows\SysWOW64\ingtjmoji.exe inertnmni.exe File created C:\Windows\SysWOW64\inisglpjp.exe inwfngdng.exe File opened for modification C:\Windows\SysWOW64\inpdlvxfh.exe_lang.ini inhxjlpig.exe File opened for modification C:\Windows\SysWOW64\inbmmjnwc.exe_lang.ini incraptug.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innhouwkt.exe File opened for modification C:\Windows\SysWOW64\ingxqnxqy.exe_lang.ini inlisltat.exe File created C:\Windows\SysWOW64\insylvfcw.exe inxujybfr.exe File opened for modification C:\Windows\SysWOW64\inlnqnzon.exe_lang.ini inzbfsfjq.exe File created C:\Windows\SysWOW64\ininzqfqh.exe inlgisalg.exe File opened for modification C:\Windows\SysWOW64\inhngmkjz.exe_lang.ini inhlzrduq.exe File created C:\Windows\SysWOW64\inbrulkss.exe inwmpgfnn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbmkzbqa.exe File created C:\Windows\SysWOW64\indkntxkp.exe inqofiykl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inykxcqol.exe File created C:\Windows\SysWOW64\innfajbav.exe inwpxhpfl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inochlfll.exe File created C:\Windows\SysWOW64\ingvfeugi.exe innoddvuk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuloqrtx.exe File opened for modification C:\Windows\SysWOW64\inmsthrks.exe_lang.ini inwyoarng.exe File opened for modification C:\Windows\SysWOW64\inemiltdh.exe_lang.ini inlnqnzon.exe File created C:\Windows\SysWOW64\indwztgsi.exe insohtodl.exe File created C:\Windows\SysWOW64\inqnbrgit.exe indtkzjxv.exe File opened for modification C:\Windows\SysWOW64\inhhsffsh.exe_lang.ini inooxsntm.exe File opened for modification C:\Windows\SysWOW64\inemwygil.exe_lang.ini inghxondz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqdhyock.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incpcgxnb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuizasnp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqofiykl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inugvjlkd.exe File created C:\Windows\SysWOW64\inykznpoh.exe inhegsgsd.exe File created C:\Windows\SysWOW64\intcrvwiy.exe inblsqhkm.exe File created C:\Windows\SysWOW64\incawvwly.exe indtosnaj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpfkwncn.exe File created C:\Windows\SysWOW64\inleqpldr.exe insuhmxsm.exe File created C:\Windows\SysWOW64\indaxahla.exe indzlgiqc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxgaoyjn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmsthrks.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innbtqbfb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzebhpmt.exe File created C:\Windows\SysWOW64\inudpxert.exe injyiwuqi.exe File created C:\Windows\SysWOW64\inkmpmynm.exe indbxwxmz.exe File created C:\Windows\SysWOW64\invmsakfo.exe indtfhlye.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwbpnkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insulctjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxbftvlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmbpckft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkbaivic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmxiifwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrshhzyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkfxleq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkveoutv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intekobge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegtexf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrcangym.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inertnmni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invspsmvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indbkovjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilftocs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbyxsvdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwzdpqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqcxrfhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invuwaxma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrjcgagg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomzqrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkxopbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwldhtuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inokiqcye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inigkkvii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intvfbarj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclpwksm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innrmsqfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpdlvxfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpnlpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpljrdzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpzchsnz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpuyhvwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insohtodl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkcszdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqgdzfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inasgqvzt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infbnevol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtzamwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnwdvwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inionprva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktbmkag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inelaxlvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhomdgwi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbpvbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmwcesvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkwkupid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniizepdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineugyxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inprouzhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innbpvwku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insanriau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingerepgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfbqsjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkietvme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdmufdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzicqlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdlvlhw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe 3376 inaexuhtj.exe 3376 inaexuhtj.exe 1832 inqcxrfhg.exe 1832 inqcxrfhg.exe 4532 inzvgovkd.exe 4532 inzvgovkd.exe 2772 inyorihpp.exe 2772 inyorihpp.exe 5520 inyjbrycn.exe 5520 inyjbrycn.exe 1400 insohtodl.exe 1400 insohtodl.exe 572 indwztgsi.exe 572 indwztgsi.exe 6104 inzloqpih.exe 6104 inzloqpih.exe 3772 inqtvunam.exe 3772 inqtvunam.exe 4372 incvyzsfr.exe 4372 incvyzsfr.exe 5540 indhxkwmb.exe 5540 indhxkwmb.exe 2144 intpaiupe.exe 2144 intpaiupe.exe 2708 inyufnzuj.exe 2708 inyufnzuj.exe 1012 inzkcszdo.exe 1012 inzkcszdo.exe 4204 injkrqgyq.exe 4204 injkrqgyq.exe 2304 infumgnyd.exe 2304 infumgnyd.exe 2468 inkzrlbas.exe 2468 inkzrlbas.exe 5720 inruwvobn.exe 5720 inruwvobn.exe 4920 insbquvhx.exe 4920 insbquvhx.exe 4824 inmtnbdcu.exe 4824 inmtnbdcu.exe 3372 insvxwpco.exe 3372 insvxwpco.exe 5172 ingvnhoze.exe 5172 ingvnhoze.exe 5964 inlsmacbt.exe 5964 inlsmacbt.exe 1128 inbqiycju.exe 1128 inbqiycju.exe 4528 inhfsfaqh.exe 4528 inhfsfaqh.exe 5912 inhwfuyzl.exe 5912 inhwfuyzl.exe 1476 injwnoaqy.exe 1476 injwnoaqy.exe 3672 inxtemyti.exe 3672 inxtemyti.exe 5480 incgzwjvl.exe 5480 incgzwjvl.exe 5828 inortslka.exe 5828 inortslka.exe 1488 inrdysgih.exe 1488 inrdysgih.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe Token: SeDebugPrivilege 3376 inaexuhtj.exe Token: SeDebugPrivilege 1832 inqcxrfhg.exe Token: SeDebugPrivilege 4532 inzvgovkd.exe Token: SeDebugPrivilege 2772 inyorihpp.exe Token: SeDebugPrivilege 5520 inyjbrycn.exe Token: SeDebugPrivilege 1400 insohtodl.exe Token: SeDebugPrivilege 572 indwztgsi.exe Token: SeDebugPrivilege 6104 inzloqpih.exe Token: SeDebugPrivilege 3772 inqtvunam.exe Token: SeDebugPrivilege 4372 incvyzsfr.exe Token: SeDebugPrivilege 5540 indhxkwmb.exe Token: SeDebugPrivilege 2144 intpaiupe.exe Token: SeDebugPrivilege 2708 inyufnzuj.exe Token: SeDebugPrivilege 1012 inzkcszdo.exe Token: SeDebugPrivilege 4204 injkrqgyq.exe Token: SeDebugPrivilege 2304 infumgnyd.exe Token: SeDebugPrivilege 2468 inkzrlbas.exe Token: SeDebugPrivilege 5720 inruwvobn.exe Token: SeDebugPrivilege 4920 insbquvhx.exe Token: SeDebugPrivilege 4824 inmtnbdcu.exe Token: SeDebugPrivilege 3372 insvxwpco.exe Token: SeDebugPrivilege 5172 ingvnhoze.exe Token: SeDebugPrivilege 5964 inlsmacbt.exe Token: SeDebugPrivilege 1128 inbqiycju.exe Token: SeDebugPrivilege 4528 inhfsfaqh.exe Token: SeDebugPrivilege 5912 inhwfuyzl.exe Token: SeDebugPrivilege 1476 injwnoaqy.exe Token: SeDebugPrivilege 3672 inxtemyti.exe Token: SeDebugPrivilege 5480 incgzwjvl.exe Token: SeDebugPrivilege 5828 inortslka.exe Token: SeDebugPrivilege 1488 inrdysgih.exe Token: SeDebugPrivilege 1244 inhwoipfi.exe Token: SeDebugPrivilege 4888 inldtepix.exe Token: SeDebugPrivilege 4052 incanalcr.exe Token: SeDebugPrivilege 4408 inwgusogd.exe Token: SeDebugPrivilege 3412 injmdckxk.exe Token: SeDebugPrivilege 1664 inejnhnnw.exe Token: SeDebugPrivilege 2988 inddmxhxc.exe Token: SeDebugPrivilege 4556 inefvmlzb.exe Token: SeDebugPrivilege 2268 inrmslxzd.exe Token: SeDebugPrivilege 1292 invhwkmle.exe Token: SeDebugPrivilege 4592 inmprqjiy.exe Token: SeDebugPrivilege 3300 inpbwqegf.exe Token: SeDebugPrivilege 5848 inugvjlkd.exe Token: SeDebugPrivilege 4456 injyqkarh.exe Token: SeDebugPrivilege 2272 inoavpdfe.exe Token: SeDebugPrivilege 4184 intfuikjc.exe Token: SeDebugPrivilege 4536 inkbaivic.exe Token: SeDebugPrivilege 4944 inwmpgfnn.exe Token: SeDebugPrivilege 3356 inbrulkss.exe Token: SeDebugPrivilege 4240 inixpjqgj.exe Token: SeDebugPrivilege 2352 innuocedv.exe Token: SeDebugPrivilege 2864 insezthji.exe Token: SeDebugPrivilege 972 ingtgabri.exe Token: SeDebugPrivilege 4736 inmeufqjy.exe Token: SeDebugPrivilege 6032 incrjzdkv.exe Token: SeDebugPrivilege 236 infnwdvwr.exe Token: SeDebugPrivilege 2724 ingvzmksi.exe Token: SeDebugPrivilege 5076 inbpxnjbw.exe Token: SeDebugPrivilege 5436 inpsutmlb.exe Token: SeDebugPrivilege 1624 inmnccutj.exe Token: SeDebugPrivilege 5220 injrhdzvq.exe Token: SeDebugPrivilege 1892 inaphxbit.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe 3376 inaexuhtj.exe 1832 inqcxrfhg.exe 4532 inzvgovkd.exe 2772 inyorihpp.exe 5520 inyjbrycn.exe 1400 insohtodl.exe 572 indwztgsi.exe 6104 inzloqpih.exe 3772 inqtvunam.exe 4372 incvyzsfr.exe 5540 indhxkwmb.exe 2144 intpaiupe.exe 2708 inyufnzuj.exe 1012 inzkcszdo.exe 4204 injkrqgyq.exe 2304 infumgnyd.exe 2468 inkzrlbas.exe 5720 inruwvobn.exe 4920 insbquvhx.exe 4824 inmtnbdcu.exe 3372 insvxwpco.exe 5172 ingvnhoze.exe 5964 inlsmacbt.exe 1128 inbqiycju.exe 4528 inhfsfaqh.exe 5912 inhwfuyzl.exe 1476 injwnoaqy.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3648 wrote to memory of 3376 3648 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe 91 PID 3376 wrote to memory of 1832 3376 inaexuhtj.exe 92 PID 1832 wrote to memory of 4532 1832 inqcxrfhg.exe 93 PID 4532 wrote to memory of 2772 4532 inzvgovkd.exe 94 PID 2772 wrote to memory of 5520 2772 inyorihpp.exe 95 PID 5520 wrote to memory of 1400 5520 inyjbrycn.exe 96 PID 1400 wrote to memory of 572 1400 insohtodl.exe 97 PID 572 wrote to memory of 6104 572 indwztgsi.exe 98 PID 6104 wrote to memory of 3772 6104 inzloqpih.exe 99 PID 3772 wrote to memory of 4372 3772 inqtvunam.exe 100 PID 4372 wrote to memory of 5540 4372 incvyzsfr.exe 101 PID 5540 wrote to memory of 2144 5540 indhxkwmb.exe 102 PID 2144 wrote to memory of 2708 2144 intpaiupe.exe 103 PID 2708 wrote to memory of 1012 2708 inyufnzuj.exe 104 PID 1012 wrote to memory of 4204 1012 inzkcszdo.exe 105 PID 4204 wrote to memory of 2304 4204 injkrqgyq.exe 106 PID 2304 wrote to memory of 2468 2304 infumgnyd.exe 107 PID 2468 wrote to memory of 5720 2468 inkzrlbas.exe 108 PID 5720 wrote to memory of 4920 5720 inruwvobn.exe 109 PID 4920 wrote to memory of 4824 4920 insbquvhx.exe 110 PID 4824 wrote to memory of 3372 4824 inmtnbdcu.exe 111 PID 3372 wrote to memory of 5172 3372 insvxwpco.exe 112 PID 5172 wrote to memory of 5964 5172 ingvnhoze.exe 113 PID 5964 wrote to memory of 1128 5964 inlsmacbt.exe 114 PID 1128 wrote to memory of 4528 1128 inbqiycju.exe 115 PID 4528 wrote to memory of 5912 4528 inhfsfaqh.exe 116 PID 5912 wrote to memory of 1476 5912 inhwfuyzl.exe 117 PID 1476 wrote to memory of 3672 1476 injwnoaqy.exe 118 PID 3672 wrote to memory of 5480 3672 inxtemyti.exe 119 PID 5480 wrote to memory of 5828 5480 incgzwjvl.exe 120 PID 5828 wrote to memory of 1488 5828 inortslka.exe 121 PID 1488 wrote to memory of 1244 1488 inrdysgih.exe 122 PID 1244 wrote to memory of 4888 1244 inhwoipfi.exe 123 PID 4888 wrote to memory of 4052 4888 inldtepix.exe 124 PID 4052 wrote to memory of 4408 4052 incanalcr.exe 125 PID 4408 wrote to memory of 3412 4408 inwgusogd.exe 126 PID 3412 wrote to memory of 1664 3412 injmdckxk.exe 127 PID 1664 wrote to memory of 2988 1664 inejnhnnw.exe 128 PID 2988 wrote to memory of 4556 2988 inddmxhxc.exe 129 PID 4556 wrote to memory of 2268 4556 inefvmlzb.exe 130 PID 2268 wrote to memory of 1292 2268 inrmslxzd.exe 131 PID 1292 wrote to memory of 4592 1292 invhwkmle.exe 132 PID 4592 wrote to memory of 3300 4592 inmprqjiy.exe 133 PID 3300 wrote to memory of 5848 3300 inpbwqegf.exe 134 PID 5848 wrote to memory of 4456 5848 inugvjlkd.exe 135 PID 4456 wrote to memory of 2272 4456 injyqkarh.exe 136 PID 2272 wrote to memory of 4184 2272 inoavpdfe.exe 137 PID 4184 wrote to memory of 4536 4184 intfuikjc.exe 138 PID 4536 wrote to memory of 4944 4536 inkbaivic.exe 139 PID 4944 wrote to memory of 3356 4944 inwmpgfnn.exe 140 PID 3356 wrote to memory of 4240 3356 inbrulkss.exe 141 PID 4240 wrote to memory of 2352 4240 inixpjqgj.exe 142 PID 2352 wrote to memory of 2864 2352 innuocedv.exe 143 PID 2864 wrote to memory of 972 2864 insezthji.exe 144 PID 972 wrote to memory of 4736 972 ingtgabri.exe 145 PID 4736 wrote to memory of 6032 4736 inmeufqjy.exe 146 PID 6032 wrote to memory of 236 6032 incrjzdkv.exe 147 PID 236 wrote to memory of 2724 236 infnwdvwr.exe 148 PID 2724 wrote to memory of 5076 2724 ingvzmksi.exe 149 PID 5076 wrote to memory of 5436 5076 inbpxnjbw.exe 150 PID 5436 wrote to memory of 1624 5436 inpsutmlb.exe 151 PID 1624 wrote to memory of 5220 1624 inmnccutj.exe 152 PID 5220 wrote to memory of 1892 5220 injrhdzvq.exe 153 PID 1892 wrote to memory of 3816 1892 inaphxbit.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe23⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe38⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\inrmslxzd.exeC:\Windows\system32\inrmslxzd.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe65⤵
- Executes dropped EXE
PID:3816 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe66⤵PID:4764
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe67⤵PID:5284
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe68⤵PID:3884
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe69⤵PID:4956
-
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe70⤵PID:2196
-
C:\Windows\SysWOW64\inuiybnpg.exeC:\Windows\system32\inuiybnpg.exe71⤵PID:5396
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe72⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe73⤵
- Drops file in System32 directory
PID:3740 -
C:\Windows\SysWOW64\inbmmjnwc.exeC:\Windows\system32\inbmmjnwc.exe74⤵PID:4172
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe75⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4132 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe76⤵
- System Location Discovery: System Language Discovery
PID:5620 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe77⤵PID:1212
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe78⤵PID:2068
-
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe79⤵PID:3040
-
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe80⤵PID:4796
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe81⤵PID:4864
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2836 -
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe83⤵PID:5656
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe84⤵PID:1192
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe85⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3284 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe86⤵
- Drops file in System32 directory
PID:5388 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe87⤵PID:2216
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe88⤵PID:3132
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe89⤵PID:2996
-
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe90⤵PID:1384
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe91⤵
- System Location Discovery: System Language Discovery
PID:5292 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe92⤵
- Drops file in System32 directory
PID:5452 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe93⤵PID:3220
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe94⤵PID:5260
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe95⤵PID:2948
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe96⤵PID:3468
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe97⤵PID:3448
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe98⤵PID:3464
-
C:\Windows\SysWOW64\inrxixhwa.exeC:\Windows\system32\inrxixhwa.exe99⤵PID:3164
-
C:\Windows\SysWOW64\inijzqpfx.exeC:\Windows\system32\inijzqpfx.exe100⤵PID:1520
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe101⤵
- Drops file in System32 directory
PID:3452 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe102⤵PID:2880
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe103⤵PID:1348
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe104⤵PID:4868
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe105⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2984 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe106⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4076 -
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe107⤵PID:4056
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe108⤵PID:3868
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe109⤵PID:4620
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe110⤵PID:4168
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe111⤵PID:2672
-
C:\Windows\SysWOW64\iniizepdz.exeC:\Windows\system32\iniizepdz.exe112⤵
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe113⤵PID:3088
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe114⤵PID:5896
-
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe115⤵PID:3124
-
C:\Windows\SysWOW64\inqzaupvo.exeC:\Windows\system32\inqzaupvo.exe116⤵PID:3500
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe117⤵PID:3416
-
C:\Windows\SysWOW64\inqdhyock.exeC:\Windows\system32\inqdhyock.exe118⤵
- Drops file in System32 directory
PID:3680 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe119⤵PID:3380
-
C:\Windows\SysWOW64\ingfvhjng.exeC:\Windows\system32\ingfvhjng.exe120⤵PID:4756
-
C:\Windows\SysWOW64\inpdimgmm.exeC:\Windows\system32\inpdimgmm.exe121⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-