Analysis
- max time kernel
101s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 12:20
Behavioral task
behavioral1
Sample
2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe
- Size 1.2MB
- Sample261110-ph2rtsfc55
- SHA256 9631a906d57fd45bf7c3ba4b3d85dc7c2f3bee1a2bb51fb52368078277d18ca2
- MD5 998741169e0c91c905b976b20c2e5b12
- SHA1 c25e89827ef3f7a02ae78a8b14a43f07099b2714
- SHA512 38fc74d7194f3439da7d67c85da5c89fbd3e0648e3ad8030560508702f37478fac806a8a5e7c89bc822371301881683f68e776aa72d3698075c82c48fedd4d5b
- SSDEEP 24576:ouLwoR5RNPjKoOduLwoR5RNPjKoOwuLwoR5RNPjKoO6uLwoR5RNPt:RPjOWPjOJPjOfPt
- TLSH T1E045CF01BEE740F9EAE8003C24FB2776963B6998FB085FD36319EE755833551E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 64 IoCs
resource yara_rule behavioral1/memory/4676-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0008000000024378-12.dat family_gh0strat behavioral1/files/0x000700000002437d-20.dat family_gh0strat behavioral1/memory/1324-26-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3340-891-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3048-873-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1672-855-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1088-837-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4308-819-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2488-801-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2036-788-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4896-755-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2304-747-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/976-729-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4664-711-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4496-693-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1892-675-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3192-657-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2712-643-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4460-636-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4204-618-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/448-600-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4648-586-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4544-564-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4588-546-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/380-528-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3560-510-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3276-492-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2056-474-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3980-456-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3732-438-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2088-420-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5004-402-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3828-385-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3836-356-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243ba-353.dat family_gh0strat behavioral1/memory/1168-334-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243b6-331.dat family_gh0strat behavioral1/memory/4168-324-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243b2-309.dat family_gh0strat behavioral1/memory/3088-302-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243ae-287.dat family_gh0strat behavioral1/memory/3400-280-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243aa-265.dat family_gh0strat behavioral1/memory/4336-258-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243a6-243.dat family_gh0strat behavioral1/memory/4932-236-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000243a2-221.dat family_gh0strat behavioral1/memory/1516-214-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002439e-199.dat family_gh0strat behavioral1/memory/1144-192-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002439a-177.dat family_gh0strat behavioral1/memory/1084-170-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024396-155.dat family_gh0strat behavioral1/memory/1244-148-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024392-133.dat family_gh0strat behavioral1/memory/1072-126-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002438e-111.dat family_gh0strat behavioral1/memory/1520-104-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002438a-89.dat family_gh0strat behavioral1/memory/1776-82-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024386-67.dat family_gh0strat behavioral1/memory/1324-60-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024382-45.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31B37CE1-3E55-48f6-9FC3-F3B33A840733}\stubpath = "C:\\Windows\\system32\\inikygkyc.exe" inaqgiwze.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{498237E2-D706-4771-927B-23905F57D470}\stubpath = "C:\\Windows\\system32\\inocymrvp.exe" indrzpldy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D58892A8-B960-4cd8-B16C-AC9218D1F07E}\stubpath = "C:\\Windows\\system32\\invzzdxxz.exe" ineugyxhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9979DCD8-F569-49c9-8675-604A00E6AD36}\stubpath = "C:\\Windows\\system32\\insohtodl.exe" inmprqjiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56FAA89C-DC32-46ca-9C32-2859921EACB1} inqrgtvyi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47312488-BD26-49b7-91C3-08A72820AB27} insvsctst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1A3E358-FEFE-4204-BF15-71315E6629DD}\stubpath = "C:\\Windows\\system32\\ingvfeugi.exe" ingcowdkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D59FF04-2543-477b-A709-AFA494E8192F} inrumczhz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E6E3CF7-86D7-450e-8D1A-0219BA679CFA}\stubpath = "C:\\Windows\\system32\\inuhmcksg.exe" inwanaevl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89F50EDB-87B1-40fa-A6C0-4EC3DD493E7F} inzwrvbus.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8B1E9C5-2505-4bb5-BB7E-BB1B438D8976} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AB44E4E-5706-45a2-AFCE-0E2036DA819E} incjmswjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D38C29A4-16F7-4971-A3EB-77EEE14B0C24} inkmpnlpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{653439DB-4963-4d01-AA40-0FFA3ECAD958}\stubpath = "C:\\Windows\\system32\\inrngsnzc.exe" inzloqpih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8D6366E-7896-43d6-89CB-0C4EF7CF4CFA}\stubpath = "C:\\Windows\\system32\\inwyzbftn.exe" innswqwhw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2ED8E24D-909A-4d28-A179-3169C25D09B6}\stubpath = "C:\\Windows\\system32\\inenfezbl.exe" ingdjrovg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF038F84-23EC-488a-869F-2D01CA052693} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514006A5-B6E6-4960-A48F-7554498B1F6F} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01B3752A-C94E-4293-8444-FCBED6D99ED3} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB9A72A6-BA57-4b46-BF0C-4EA0B67C79CE} inldtepix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FCFB278-B622-42a5-919F-B950ACDC932F} inkmhgrmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03C2F308-6209-4167-9A00-C6363D984C4C}\stubpath = "C:\\Windows\\system32\\insavkvmj.exe" inbvupzqx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{696BB675-3738-47b8-B44B-909C983CB5A7} inhrycguw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E2FAAE6-8AC0-4496-A572-844D9DB2BAFB} inmtkanwc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F588DBD2-76F1-482a-86E1-F7B89B08C2BE} inortslka.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C9B78BF-65D4-4b40-B603-0B38CFE4D243} inykznpoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7098AE53-80FE-432f-B996-AA2510086060}\stubpath = "C:\\Windows\\system32\\intbpxrhx.exe" inuprejup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B60F708-4499-471b-B56A-6540E0703D3F} inhomdgwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0CC8F2A-706D-4b99-BE8C-B899DAC8F713} inyfydwsq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCBE3901-0BBE-4eb9-9562-F705D0CBF7BE}\stubpath = "C:\\Windows\\system32\\inauwohze.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EE274D1-F9FE-4fb1-B9C0-91D05730237D} incibocxs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4643FED8-3CD1-471c-AEC3-ABCEBBD15437}\stubpath = "C:\\Windows\\system32\\inkfpgznc.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8DF1E52-8311-46cd-84F9-691A378F3A8B} inpdraxym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF13DCCD-D91F-4ea2-B880-11FDC6BE05D5}\stubpath = "C:\\Windows\\system32\\innoaemue.exe" insahbdsg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22C4F585-C87C-43f3-B89F-FF353AB95024} inpzplgqv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB8FCA7F-9EE3-432f-BE19-90E08F5E5D3F} insaljfpw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD7F4E43-5B5D-45bb-9997-45D02092F42E} inmgmynpz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4090981E-655C-4945-A15B-B50008AE4A3C} incixldvq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A44BB67-66F7-4017-BE65-91142EF85BEE} inyepukgs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A75F9E7-29E9-41ff-AAA7-49EDBF5FD613} inilftocs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFD0D62B-94CA-4bfb-B389-A455E0243811} infxsuasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B639E2E1-B514-4de1-8371-1824AA888013} inlhnqivx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D564B10-1D7A-4df7-9414-5A3BB9634461} invaiaqlz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D7B9FB8-96DE-494b-8620-14F4AD602C0E}\stubpath = "C:\\Windows\\system32\\invfrxfpk.exe" injwbpnkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B44E712B-14C3-4197-9745-643920922B55}\stubpath = "C:\\Windows\\system32\\infnxzhjm.exe" inhiypoew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AB64203-6B08-4fd2-AF15-C23FFF9F27AA}\stubpath = "C:\\Windows\\system32\\incmrujul.exe" inftrnfcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB41E400-3D64-4add-AC06-3B16823972C1}\stubpath = "C:\\Windows\\system32\\inclzteci.exe" iniowtbls.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70FDFE53-55FF-4f43-9D83-31DB80C40F9F}\stubpath = "C:\\Windows\\system32\\inxndtjlz.exe" incawvwly.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6708A824-C867-4125-9763-11006ECF8066} inuvkxzmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C403DC9D-4A29-4fea-9167-E02FD9CC537C}\stubpath = "C:\\Windows\\system32\\iniaooxbd.exe" inodqsvft.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD5B7EDC-E757-4633-971F-C46E3A2C6F15} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D24781B3-200E-47ed-8AE7-2FCC1FF23B37}\stubpath = "C:\\Windows\\system32\\inbqiycju.exe" inogwahsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB04167D-B149-44f5-8AC5-7EB455946E6C} inzydrlkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4449EBA0-8407-4b90-9F3B-4F1921BB7022} inxavmale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E93F0C9-15AA-459d-99B6-6F80C21DFA15} inzrqlnxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC30D038-5FFE-4023-AC91-A268D3FD384E}\stubpath = "C:\\Windows\\system32\\inokiqcye.exe" inniombtb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA084BA6-7506-4bc3-8E90-94BB478F16F5}\stubpath = "C:\\Windows\\system32\\inigkkvii.exe" incbrdfjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EF8C0A1-DAEF-4a3d-BC6B-8596234CFABA}\stubpath = "C:\\Windows\\system32\\inkmpnlpp.exe" injqftzfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B2B0E69-316A-4e98-8463-2C29BD52BF27}\stubpath = "C:\\Windows\\system32\\inpscqoss.exe" inynjbljk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1227279D-59A7-416a-9607-70FBAA03FD57} inhwoipfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5ED734B-5AD0-486a-9F8B-BE4D30DA7136}\stubpath = "C:\\Windows\\system32\\inkivmnpx.exe" inqxbfmkb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84E3333C-8A2F-470e-9B80-443FC75959AB} inaeepccp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD927F7F-E294-4de1-908F-4EF6861F9805} inlhpjpqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{633CEA14-69C7-4c8a-937A-BE82C3B0B2EC}\stubpath = "C:\\Windows\\system32\\infhmqtvt.exe" inckscbjk.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b000000024249-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1324 inyufnzuj.exe 1776 inlsmacbt.exe 1520 innuocedv.exe 1072 inruwvobn.exe 1244 inxtemyti.exe 1084 inhwoipfi.exe 1144 inkzrlbas.exe 1516 inortslka.exe 4932 inuqbjvqf.exe 4336 inbqostfv.exe 3400 inzvgovkd.exe 3088 inyjbrycn.exe 4168 inmtnbdcu.exe 1168 innlypqcs.exe 3836 inetlfmxc.exe 3828 inxiaqxbm.exe 5004 innqsrkjz.exe 2088 inpsutmlb.exe 3732 indskelwb.exe 3980 invhwkmle.exe 2056 incgzwjvl.exe 3276 inmeufqjy.exe 3560 inqcxrfhg.exe 380 inbuxzyre.exe 4588 ingtgabri.exe 4544 inilcbjwj.exe 4648 inutvwllh.exe 448 inaivxrqr.exe 4204 infdqdofu.exe 4460 inxhvtpha.exe 2712 inpleqlxa.exe 3192 inogwahsa.exe 4496 inesqmezb.exe 4664 inwixlnmf.exe 976 inykznpoh.exe 2304 innfvgrkz.exe 4896 insvxwpco.exe 2036 incraptug.exe 2488 inaikwkwh.exe 4308 inqmfrmyb.exe 1088 inaphxbit.exe 1672 insezthji.exe 3048 indwztgsi.exe 3340 indeulkya.exe 2928 inasgqvzt.exe 4748 inmhxsddw.exe 464 indlyubtu.exe 1604 ineuxonvv.exe 3460 inzloqpih.exe 1612 inrngsnzc.exe 2096 inarenvge.exe 4928 inwsdlxsh.exe 1868 insbquvhx.exe 2252 infudswxj.exe 1508 intsuvkkg.exe 3248 invuwaxma.exe 2032 ineybxzdp.exe 4028 inqgdzfrf.exe 968 inaexuhtj.exe 8 inzkcszdo.exe 868 inlofemzm.exe 5152 inyorihpp.exe 5240 inbaqtkjr.exe 5328 indtwnmuu.exe - Loads dropped DLL 64 IoCs
pid Process 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 1324 inyufnzuj.exe 1324 inyufnzuj.exe 1776 inlsmacbt.exe 1776 inlsmacbt.exe 1520 innuocedv.exe 1520 innuocedv.exe 1072 inruwvobn.exe 1072 inruwvobn.exe 1244 inxtemyti.exe 1244 inxtemyti.exe 1084 inhwoipfi.exe 1084 inhwoipfi.exe 1144 inkzrlbas.exe 1144 inkzrlbas.exe 1516 inortslka.exe 1516 inortslka.exe 4932 inuqbjvqf.exe 4932 inuqbjvqf.exe 4336 inbqostfv.exe 4336 inbqostfv.exe 3400 inzvgovkd.exe 3400 inzvgovkd.exe 3088 inyjbrycn.exe 3088 inyjbrycn.exe 4168 inmtnbdcu.exe 4168 inmtnbdcu.exe 1168 innlypqcs.exe 1168 innlypqcs.exe 3836 inetlfmxc.exe 3836 inetlfmxc.exe 3828 inxiaqxbm.exe 3828 inxiaqxbm.exe 5004 innqsrkjz.exe 5004 innqsrkjz.exe 2088 inpsutmlb.exe 2088 inpsutmlb.exe 3732 indskelwb.exe 3732 indskelwb.exe 3980 invhwkmle.exe 3980 invhwkmle.exe 2056 incgzwjvl.exe 2056 incgzwjvl.exe 3276 inmeufqjy.exe 3276 inmeufqjy.exe 3560 inqcxrfhg.exe 3560 inqcxrfhg.exe 380 inbuxzyre.exe 380 inbuxzyre.exe 4588 ingtgabri.exe 4588 ingtgabri.exe 4544 inilcbjwj.exe 4544 inilcbjwj.exe 4648 inutvwllh.exe 4648 inutvwllh.exe 448 inaivxrqr.exe 448 inaivxrqr.exe 4204 infdqdofu.exe 4204 infdqdofu.exe 4460 inxhvtpha.exe 4460 inxhvtpha.exe 2712 inpleqlxa.exe 2712 inpleqlxa.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inomzqrdt.exe_lang.ini injwnoaqy.exe File created C:\Windows\SysWOW64\inhhujgdi.exe indlvgkyq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infrgacrf.exe File opened for modification C:\Windows\SysWOW64\infrgispe.exe_lang.ini inmowclfg.exe File opened for modification C:\Windows\SysWOW64\iniaooxbd.exe_lang.ini inodqsvft.exe File created C:\Windows\SysWOW64\inrneghei.exe Process not Found File created C:\Windows\SysWOW64\injwylczx.exe injyixbhg.exe File opened for modification C:\Windows\SysWOW64\inxavmale.exe_lang.ini invzzdxxz.exe File opened for modification C:\Windows\SysWOW64\injltfsal.exe_lang.ini inyxynpgc.exe File created C:\Windows\SysWOW64\inthxpach.exe insnxovkm.exe File created C:\Windows\SysWOW64\inpiextzn.exe inzlighvn.exe File opened for modification C:\Windows\SysWOW64\inmyifozp.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inmdzgilx.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inleuzbus.exe_lang.ini inojudayu.exe File opened for modification C:\Windows\SysWOW64\inmowclfg.exe_lang.ini inirwtfkt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inapytoun.exe File created C:\Windows\SysWOW64\innbpvwku.exe inpgijgkr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\indexckbc.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat indtwnmuu.exe File created C:\Windows\SysWOW64\inzkzjyci.exe insrzztuj.exe File opened for modification C:\Windows\SysWOW64\incvyzsfr.exe_lang.ini inhzrfkoi.exe File opened for modification C:\Windows\SysWOW64\inokbwlsa.exe_lang.ini intekobge.exe File created C:\Windows\SysWOW64\intbpxrhx.exe inuprejup.exe File opened for modification C:\Windows\SysWOW64\inrnfatcb.exe_lang.ini incqyokcx.exe File opened for modification C:\Windows\SysWOW64\inipelkjl.exe_lang.ini inatybwnb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indscwrxb.exe File opened for modification C:\Windows\SysWOW64\inetgedis.exe_lang.ini inycopaqa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inbmkzbqa.exe inxsdoolp.exe File opened for modification C:\Windows\SysWOW64\inlgisalg.exe_lang.ini inpeapdzu.exe File opened for modification C:\Windows\SysWOW64\inrkdmspp.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inknedlyl.exe injyqkarh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inscqyokc.exe File opened for modification C:\Windows\SysWOW64\inddqfcew.exe_lang.ini inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\inrshhzyd.exe_lang.ini inmawkptn.exe File opened for modification C:\Windows\SysWOW64\inkmpmynm.exe_lang.ini inniucjdf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innjrlbrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkwlklan.exe File opened for modification C:\Windows\SysWOW64\inomaugiq.exe_lang.ini inleqpldr.exe File opened for modification C:\Windows\SysWOW64\inxitdtqe.exe_lang.ini inbmkzbqa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqhodfle.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\incybtpgq.exe_lang.ini inokiqcye.exe File created C:\Windows\SysWOW64\inokbwlsa.exe intekobge.exe File opened for modification C:\Windows\SysWOW64\incbskfog.exe_lang.ini inxajcwrn.exe File created C:\Windows\SysWOW64\inknhvqeu.exe intkkwbze.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infzicqlp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\indbugdrs.exe Process not Found File created C:\Windows\SysWOW64\injvkjzkm.exe inooxsntm.exe File opened for modification C:\Windows\SysWOW64\incvdypdo.exe_lang.ini inpnehxjk.exe File created C:\Windows\SysWOW64\invshckbs.exe inykgfwoj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inthxpach.exe File created C:\Windows\SysWOW64\insvsctst.exe inwuyycww.exe File opened for modification C:\Windows\SysWOW64\inucbcecy.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inbuzcxoc.exe_lang.ini inmibthrw.exe File created C:\Windows\SysWOW64\invmsakfo.exe indutoqdi.exe File created C:\Windows\SysWOW64\inewrcnnk.exe inhsblrqs.exe File opened for modification C:\Windows\SysWOW64\inesqmezb.exe_lang.ini inbqiycju.exe File created C:\Windows\SysWOW64\inbjwysrs.exe inupkqjvx.exe File created C:\Windows\SysWOW64\inxajcwrn.exe iniqjgqjr.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczeboin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqgiwze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineqbmfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incajnuiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inycopaqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfkwncn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqlzpgys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbkobdgw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomaugiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inivxkbyw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intojzuff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intekobge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inligcrtk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbwxiybi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxjwepwt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inijzqpfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhztqfaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtjigwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhjrgabu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxcfnkrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogwahsa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjudnts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbrocsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inertnmni.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbgwtosr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnewqnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invspsmvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqyuxptk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzwrvbus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqofiykl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzicqlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisywvgk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkvggzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztjzmib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuvrtzkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzjrnqyi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdmufdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzvnieka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invapablb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvdypdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inquussur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbxwxmzo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhlzrduq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlcfvhzy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inskscibo.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 1324 inyufnzuj.exe 1324 inyufnzuj.exe 1776 inlsmacbt.exe 1776 inlsmacbt.exe 1520 innuocedv.exe 1520 innuocedv.exe 1072 inruwvobn.exe 1072 inruwvobn.exe 1244 inxtemyti.exe 1244 inxtemyti.exe 1084 inhwoipfi.exe 1084 inhwoipfi.exe 1144 inkzrlbas.exe 1144 inkzrlbas.exe 1516 inortslka.exe 1516 inortslka.exe 4932 inuqbjvqf.exe 4932 inuqbjvqf.exe 4336 inbqostfv.exe 4336 inbqostfv.exe 3400 inzvgovkd.exe 3400 inzvgovkd.exe 3088 inyjbrycn.exe 3088 inyjbrycn.exe 4168 inmtnbdcu.exe 4168 inmtnbdcu.exe 1168 innlypqcs.exe 1168 innlypqcs.exe 3836 inetlfmxc.exe 3836 inetlfmxc.exe 3828 inxiaqxbm.exe 3828 inxiaqxbm.exe 5004 innqsrkjz.exe 5004 innqsrkjz.exe 2088 inpsutmlb.exe 2088 inpsutmlb.exe 3732 indskelwb.exe 3732 indskelwb.exe 3980 invhwkmle.exe 3980 invhwkmle.exe 2056 incgzwjvl.exe 2056 incgzwjvl.exe 3276 inmeufqjy.exe 3276 inmeufqjy.exe 3560 inqcxrfhg.exe 3560 inqcxrfhg.exe 380 inbuxzyre.exe 380 inbuxzyre.exe 4588 ingtgabri.exe 4588 ingtgabri.exe 4544 inilcbjwj.exe 4544 inilcbjwj.exe 4648 inutvwllh.exe 4648 inutvwllh.exe 448 inaivxrqr.exe 448 inaivxrqr.exe 4204 infdqdofu.exe 4204 infdqdofu.exe 4460 inxhvtpha.exe 4460 inxhvtpha.exe 2712 inpleqlxa.exe 2712 inpleqlxa.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe Token: SeDebugPrivilege 1324 inyufnzuj.exe Token: SeDebugPrivilege 1776 inlsmacbt.exe Token: SeDebugPrivilege 1520 innuocedv.exe Token: SeDebugPrivilege 1072 inruwvobn.exe Token: SeDebugPrivilege 1244 inxtemyti.exe Token: SeDebugPrivilege 1084 inhwoipfi.exe Token: SeDebugPrivilege 1144 inkzrlbas.exe Token: SeDebugPrivilege 1516 inortslka.exe Token: SeDebugPrivilege 4932 inuqbjvqf.exe Token: SeDebugPrivilege 4336 inbqostfv.exe Token: SeDebugPrivilege 3400 inzvgovkd.exe Token: SeDebugPrivilege 3088 inyjbrycn.exe Token: SeDebugPrivilege 4168 inmtnbdcu.exe Token: SeDebugPrivilege 1168 innlypqcs.exe Token: SeDebugPrivilege 3836 inetlfmxc.exe Token: SeDebugPrivilege 3828 inxiaqxbm.exe Token: SeDebugPrivilege 5004 innqsrkjz.exe Token: SeDebugPrivilege 2088 inpsutmlb.exe Token: SeDebugPrivilege 3732 indskelwb.exe Token: SeDebugPrivilege 3980 invhwkmle.exe Token: SeDebugPrivilege 2056 incgzwjvl.exe Token: SeDebugPrivilege 3276 inmeufqjy.exe Token: SeDebugPrivilege 3560 inqcxrfhg.exe Token: SeDebugPrivilege 380 inbuxzyre.exe Token: SeDebugPrivilege 4588 ingtgabri.exe Token: SeDebugPrivilege 4544 inilcbjwj.exe Token: SeDebugPrivilege 4648 inutvwllh.exe Token: SeDebugPrivilege 448 inaivxrqr.exe Token: SeDebugPrivilege 4204 infdqdofu.exe Token: SeDebugPrivilege 4460 inxhvtpha.exe Token: SeDebugPrivilege 2712 inpleqlxa.exe Token: SeDebugPrivilege 1892 inbqiycju.exe Token: SeDebugPrivilege 4496 inesqmezb.exe Token: SeDebugPrivilege 4664 inwixlnmf.exe Token: SeDebugPrivilege 976 inykznpoh.exe Token: SeDebugPrivilege 2304 innfvgrkz.exe Token: SeDebugPrivilege 4896 insvxwpco.exe Token: SeDebugPrivilege 2036 incraptug.exe Token: SeDebugPrivilege 2488 inaikwkwh.exe Token: SeDebugPrivilege 4308 inqmfrmyb.exe Token: SeDebugPrivilege 1088 inaphxbit.exe Token: SeDebugPrivilege 1672 insezthji.exe Token: SeDebugPrivilege 3048 indwztgsi.exe Token: SeDebugPrivilege 3340 indeulkya.exe Token: SeDebugPrivilege 2928 inasgqvzt.exe Token: SeDebugPrivilege 4748 inmhxsddw.exe Token: SeDebugPrivilege 464 indlyubtu.exe Token: SeDebugPrivilege 1604 ineuxonvv.exe Token: SeDebugPrivilege 3460 inzloqpih.exe Token: SeDebugPrivilege 1612 inrngsnzc.exe Token: SeDebugPrivilege 2096 inarenvge.exe Token: SeDebugPrivilege 4928 inwsdlxsh.exe Token: SeDebugPrivilege 1868 insbquvhx.exe Token: SeDebugPrivilege 2252 infudswxj.exe Token: SeDebugPrivilege 1508 intsuvkkg.exe Token: SeDebugPrivilege 3248 invuwaxma.exe Token: SeDebugPrivilege 2032 ineybxzdp.exe Token: SeDebugPrivilege 4028 inqgdzfrf.exe Token: SeDebugPrivilege 968 inaexuhtj.exe Token: SeDebugPrivilege 8 inzkcszdo.exe Token: SeDebugPrivilege 868 inlofemzm.exe Token: SeDebugPrivilege 5152 inyorihpp.exe Token: SeDebugPrivilege 5240 inbaqtkjr.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 1324 inyufnzuj.exe 1776 inlsmacbt.exe 1520 innuocedv.exe 1072 inruwvobn.exe 1244 inxtemyti.exe 1084 inhwoipfi.exe 1144 inkzrlbas.exe 1516 inortslka.exe 4932 inuqbjvqf.exe 4336 inbqostfv.exe 3400 inzvgovkd.exe 3088 inyjbrycn.exe 4168 inmtnbdcu.exe 1168 innlypqcs.exe 3836 inetlfmxc.exe 3828 inxiaqxbm.exe 5004 innqsrkjz.exe 2088 inpsutmlb.exe 3732 indskelwb.exe 3980 invhwkmle.exe 2056 incgzwjvl.exe 3276 inmeufqjy.exe 3560 inqcxrfhg.exe 380 inbuxzyre.exe 4588 ingtgabri.exe 4544 inilcbjwj.exe 4648 inutvwllh.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 1324 4676 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 84 PID 1324 wrote to memory of 1776 1324 inyufnzuj.exe 85 PID 1776 wrote to memory of 1520 1776 inlsmacbt.exe 86 PID 1520 wrote to memory of 1072 1520 innuocedv.exe 87 PID 1072 wrote to memory of 1244 1072 inruwvobn.exe 88 PID 1244 wrote to memory of 1084 1244 inxtemyti.exe 89 PID 1084 wrote to memory of 1144 1084 inhwoipfi.exe 90 PID 1144 wrote to memory of 1516 1144 inkzrlbas.exe 91 PID 1516 wrote to memory of 4932 1516 inortslka.exe 92 PID 4932 wrote to memory of 4336 4932 inuqbjvqf.exe 93 PID 4336 wrote to memory of 3400 4336 inbqostfv.exe 94 PID 3400 wrote to memory of 3088 3400 inzvgovkd.exe 95 PID 3088 wrote to memory of 4168 3088 inyjbrycn.exe 96 PID 4168 wrote to memory of 1168 4168 inmtnbdcu.exe 97 PID 1168 wrote to memory of 3836 1168 innlypqcs.exe 98 PID 3836 wrote to memory of 3828 3836 inetlfmxc.exe 99 PID 3828 wrote to memory of 5004 3828 inxiaqxbm.exe 100 PID 5004 wrote to memory of 2088 5004 innqsrkjz.exe 101 PID 2088 wrote to memory of 3732 2088 inpsutmlb.exe 102 PID 3732 wrote to memory of 3980 3732 indskelwb.exe 103 PID 3980 wrote to memory of 2056 3980 invhwkmle.exe 104 PID 2056 wrote to memory of 3276 2056 incgzwjvl.exe 105 PID 3276 wrote to memory of 3560 3276 inmeufqjy.exe 106 PID 3560 wrote to memory of 380 3560 inqcxrfhg.exe 107 PID 380 wrote to memory of 4588 380 inbuxzyre.exe 108 PID 4588 wrote to memory of 4544 4588 ingtgabri.exe 109 PID 4544 wrote to memory of 4648 4544 inilcbjwj.exe 110 PID 4648 wrote to memory of 448 4648 inutvwllh.exe 111 PID 448 wrote to memory of 4204 448 inaivxrqr.exe 112 PID 4204 wrote to memory of 4460 4204 infdqdofu.exe 113 PID 4460 wrote to memory of 2712 4460 inxhvtpha.exe 114 PID 2712 wrote to memory of 3192 2712 inpleqlxa.exe 115 PID 1892 wrote to memory of 4496 1892 inbqiycju.exe 117 PID 4496 wrote to memory of 4664 4496 inesqmezb.exe 118 PID 4664 wrote to memory of 976 4664 inwixlnmf.exe 119 PID 976 wrote to memory of 2304 976 inykznpoh.exe 120 PID 2304 wrote to memory of 4896 2304 innfvgrkz.exe 121 PID 4896 wrote to memory of 2036 4896 insvxwpco.exe 122 PID 2036 wrote to memory of 2488 2036 incraptug.exe 123 PID 2488 wrote to memory of 4308 2488 inaikwkwh.exe 124 PID 4308 wrote to memory of 1088 4308 inqmfrmyb.exe 125 PID 1088 wrote to memory of 1672 1088 inaphxbit.exe 126 PID 1672 wrote to memory of 3048 1672 insezthji.exe 127 PID 3048 wrote to memory of 3340 3048 indwztgsi.exe 128 PID 3340 wrote to memory of 2928 3340 indeulkya.exe 129 PID 2928 wrote to memory of 4748 2928 inasgqvzt.exe 130 PID 4748 wrote to memory of 464 4748 inmhxsddw.exe 131 PID 464 wrote to memory of 1604 464 indlyubtu.exe 132 PID 1604 wrote to memory of 3460 1604 ineuxonvv.exe 133 PID 3460 wrote to memory of 1612 3460 inzloqpih.exe 134 PID 1612 wrote to memory of 2096 1612 inrngsnzc.exe 135 PID 2096 wrote to memory of 4928 2096 inarenvge.exe 136 PID 4928 wrote to memory of 1868 4928 inwsdlxsh.exe 137 PID 1868 wrote to memory of 2252 1868 insbquvhx.exe 138 PID 2252 wrote to memory of 1508 2252 infudswxj.exe 139 PID 1508 wrote to memory of 3248 1508 intsuvkkg.exe 140 PID 3248 wrote to memory of 2032 3248 invuwaxma.exe 141 PID 2032 wrote to memory of 4028 2032 ineybxzdp.exe 142 PID 4028 wrote to memory of 968 4028 inqgdzfrf.exe 143 PID 968 wrote to memory of 8 968 inaexuhtj.exe 144 PID 8 wrote to memory of 868 8 inzkcszdo.exe 145 PID 868 wrote to memory of 5152 868 inlofemzm.exe 146 PID 5152 wrote to memory of 5240 5152 inyorihpp.exe 147 PID 5240 wrote to memory of 5328 5240 inbaqtkjr.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3192 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe34⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe37⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\system32\indeulkya.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\inarenvge.exeC:\Windows\system32\inarenvge.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe66⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5328 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe67⤵PID:5416
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe68⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5504 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe69⤵PID:5592
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe70⤵PID:5680
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe71⤵PID:5768
-
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe72⤵PID:5856
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe73⤵
- Drops file in System32 directory
PID:5944 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe74⤵PID:6032
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe75⤵PID:6120
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe76⤵PID:2332
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe77⤵PID:2792
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe78⤵PID:2076
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe79⤵PID:3524
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe80⤵
- Drops file in System32 directory
PID:3656 -
C:\Windows\SysWOW64\inbuzcxoc.exeC:\Windows\system32\inbuzcxoc.exe81⤵PID:3008
-
C:\Windows\SysWOW64\inwemzvcu.exeC:\Windows\system32\inwemzvcu.exe82⤵PID:1120
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe83⤵PID:4484
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe84⤵PID:1860
-
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe85⤵PID:1412
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe86⤵PID:1688
-
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe87⤵
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\indvjzcoq.exeC:\Windows\system32\indvjzcoq.exe88⤵PID:1440
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe89⤵
- Drops file in System32 directory
PID:5032 -
C:\Windows\SysWOW64\inzkzjyci.exeC:\Windows\system32\inzkzjyci.exe90⤵PID:2312
-
C:\Windows\SysWOW64\inakrpgjz.exeC:\Windows\system32\inakrpgjz.exe91⤵PID:5228
-
C:\Windows\SysWOW64\inuhqyjhd.exeC:\Windows\system32\inuhqyjhd.exe92⤵PID:5316
-
C:\Windows\SysWOW64\inhzpfbvl.exeC:\Windows\system32\inhzpfbvl.exe93⤵PID:5348
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe94⤵PID:5512
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe95⤵PID:5600
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe96⤵PID:5672
-
C:\Windows\SysWOW64\insgwlney.exeC:\Windows\system32\insgwlney.exe97⤵PID:4860
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe98⤵PID:5848
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe99⤵PID:5932
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe100⤵
- System Location Discovery: System Language Discovery
PID:6016 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe101⤵PID:6088
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe102⤵PID:1420
-
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe103⤵PID:2412
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe104⤵PID:3596
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe105⤵PID:4248
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe106⤵PID:2284
-
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe107⤵PID:4060
-
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe108⤵PID:5400
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe109⤵PID:1768
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe110⤵PID:2380
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe111⤵PID:4220
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe112⤵PID:1592
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe113⤵PID:5620
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe114⤵
- Drops file in System32 directory
PID:4428 -
C:\Windows\SysWOW64\inwmcsiky.exeC:\Windows\system32\inwmcsiky.exe115⤵PID:1500
-
C:\Windows\SysWOW64\innajnacf.exeC:\Windows\system32\innajnacf.exe116⤵PID:4444
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe117⤵PID:4956
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe118⤵PID:5204
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe119⤵PID:5284
-
C:\Windows\SysWOW64\ingkycsra.exeC:\Windows\system32\ingkycsra.exe120⤵PID:5364
-
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe121⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-