Analysis
- max time kernel
82s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 12:20
Behavioral task
behavioral1
Sample
2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe
- Size 1.2MB
- Sample261110-ph2rtsfc55
- SHA256 9631a906d57fd45bf7c3ba4b3d85dc7c2f3bee1a2bb51fb52368078277d18ca2
- MD5 998741169e0c91c905b976b20c2e5b12
- SHA1 c25e89827ef3f7a02ae78a8b14a43f07099b2714
- SHA512 38fc74d7194f3439da7d67c85da5c89fbd3e0648e3ad8030560508702f37478fac806a8a5e7c89bc822371301881683f68e776aa72d3698075c82c48fedd4d5b
- SSDEEP 24576:ouLwoR5RNPjKoOduLwoR5RNPjKoOwuLwoR5RNPjKoO6uLwoR5RNPt:RPjOWPjOJPjOfPt
- TLSH T1E045CF01BEE740F9EAE8003C24FB2776963B6998FB085FD36319EE755833551E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/4144-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x0008000000016b43-13.dat family_gh0strat behavioral2/memory/4144-27-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4848-25-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c40e-42.dat family_gh0strat behavioral2/files/0x000600000001b872-22.dat family_gh0strat behavioral2/memory/4848-52-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c422-71.dat family_gh0strat behavioral2/files/0x000d00000001c426-96.dat family_gh0strat behavioral2/files/0x000d00000001c42e-144.dat family_gh0strat behavioral2/memory/3020-172-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c442-264.dat family_gh0strat behavioral2/files/0x000d00000001c45d-360.dat family_gh0strat behavioral2/memory/4772-628-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4304-668-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2792-648-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2896-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2616-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2248-568-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1888-548-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5928-528-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1708-508-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5568-488-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1380-468-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4852-448-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1572-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5444-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1760-388-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c461-384.dat family_gh0strat behavioral2/memory/3760-364-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4148-340-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c459-336.dat family_gh0strat behavioral2/memory/5488-316-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c455-312.dat family_gh0strat behavioral2/memory/2696-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c446-288.dat family_gh0strat behavioral2/memory/3508-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4752-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c43e-240.dat family_gh0strat behavioral2/memory/3204-220-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c43a-216.dat family_gh0strat behavioral2/memory/5972-196-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c436-192.dat family_gh0strat behavioral2/files/0x000d00000001c432-168.dat family_gh0strat behavioral2/memory/2132-148-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5520-124-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c42a-120.dat family_gh0strat behavioral2/memory/5792-100-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5848-75-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D940D88E-4E7B-4a2d-BB00-1609803FCF0D} inmeufqjy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{817BD914-44F6-4d13-81EC-429587EC8783}\stubpath = "C:\\Windows\\system32\\inmiqkaqr.exe" inkmhgrmq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABC3ACF0-EAC5-477b-8DAE-829696D2D919} inpleqlxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E534C00D-EBC9-4c51-9442-7DDE0929AC5C}\stubpath = "C:\\Windows\\system32\\ingvetxyk.exe" inionprva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03C56621-1F49-4ce5-8C64-B2466923C840}\stubpath = "C:\\Windows\\system32\\inngmlnpt.exe" inknedlyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62AC5140-1534-4aa4-BE56-9203E3481C34} ingrakqpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F1FD498-22FF-49ca-827A-15061185F231} inqzaupvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2852002D-2A5C-469f-A742-A4B0653C6D09}\stubpath = "C:\\Windows\\system32\\inptcowdq.exe" inzrqlnxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F42F118-214A-4b1d-9173-F8E0672A0125}\stubpath = "C:\\Windows\\system32\\inmrxryds.exe" inzyhfjju.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1C221EF-F117-46d6-B226-A28BA5B31015} inmiqkaqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5219F3FF-D4A7-489e-933F-3F909C8588F2} inyegrpfl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3033C72D-99B8-4cb8-A29F-B47EA5F545B6} inupkqjvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B1981E4-4BB9-4f39-AF2A-7BCBFAD68E77} inthmqkqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01205A06-009C-46e7-A098-BE6AF5CB3BB4} injwylczx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC28FBB4-9F1C-41b5-9316-FFEA8689B761} invmdukgq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A81AC0A-4ABD-4a3c-AA8D-089F664312D2} inbxslgig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3E56524-BAF0-4ad1-8E19-7EC9F37DCE5E}\stubpath = "C:\\Windows\\system32\\inzrqlnxa.exe" inlisltat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A4C6BC4-1CD3-47ea-AC81-8411EB8958E7}\stubpath = "C:\\Windows\\system32\\ineybxzdp.exe" inlsmacbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D1BEBC5-656C-4371-BF2D-F285EC2F623C}\stubpath = "C:\\Windows\\system32\\inenraymu.exe" inlvjosms.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DEA636D-DBDA-42ef-BB34-C51BC5B63B20} inrlmbbts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDD17889-902B-4a9f-9FD5-F34EDD1D2670}\stubpath = "C:\\Windows\\system32\\inkietvme.exe" incraptug.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FEAAE32D-2A99-4da0-903B-05D80D58DA2D} inkveoutv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22948C1B-4A51-40bb-9AB8-EC286FA45EE9} injdwyyif.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96D98D10-8BD3-4adf-B456-B5C7C507C684} inqmfrmyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86F10D81-575D-46cd-948C-8258A1956D85}\stubpath = "C:\\Windows\\system32\\inzhpyfbx.exe" inmktaxgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35D329D6-D8B0-4512-A2CF-09768EA26567}\stubpath = "C:\\Windows\\system32\\inbsfowhf.exe" indtosnaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C8A2037-4DA0-4d7b-B938-258E459C4018}\stubpath = "C:\\Windows\\system32\\inldtepix.exe" inzvgovkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1236779E-66A6-4896-B65D-A71D3693D132} inwmpgfnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94085F97-5C16-47ea-BC6D-7C607EDB8D0E}\stubpath = "C:\\Windows\\system32\\ingoxeawx.exe" indxawycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33BD3C50-FA3E-47b7-B4AF-C766AE2D31EC} inmawkptn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{574BC745-3CBA-417a-B998-F64C349B9C56} inrvqwujd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F3C6EB0-BEFF-4940-A380-0ED0D4A15222} inaqceivb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C585348D-2FFC-45e6-9876-F07A070AB78B} inuvxhdct.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02A5F098-4A27-43db-8FCE-D5ED7CD58BDC}\stubpath = "C:\\Windows\\system32\\injfevnir.exe" inilcbjwj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BE12029-2D84-404f-B672-186EFB9DD40F}\stubpath = "C:\\Windows\\system32\\inwixlnmf.exe" incrjzdkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38F48BE4-9F19-4e4a-B2CD-07DCF58F940E} indpalewk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32B563CC-E248-4b5e-BBC3-159BE575A4CE}\stubpath = "C:\\Windows\\system32\\inmnccutj.exe" inmibthrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F751D3D-EA80-4610-A0E1-41979B5EC979}\stubpath = "C:\\Windows\\system32\\inddqfcew.exe" inhyqlaum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F924756A-64E9-43aa-8399-62ED7360A19C}\stubpath = "C:\\Windows\\system32\\inumafjdj.exe" inddqfcew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12048ED7-87D7-42c3-BE94-3F2295ED29D9}\stubpath = "C:\\Windows\\system32\\inxgusiod.exe" inaouaylq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECC82734-7AD7-4af2-84E2-087EB94E312A}\stubpath = "C:\\Windows\\system32\\inwhjedoj.exe" inxgusiod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67694955-B5D5-472c-BE0A-8763EE6D5D0D}\stubpath = "C:\\Windows\\system32\\inwauuwtq.exe" inyccnaan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB274AAB-1FEA-497a-942B-EE6B7BFC4923}\stubpath = "C:\\Windows\\system32\\infzzbyva.exe" inzhpyfbx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF04637A-567F-473b-8112-13CBE335F7E7}\stubpath = "C:\\Windows\\system32\\inofbieyd.exe" inzprbebn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E85A40D-6E2A-4a26-8CED-AB1CFCD3402A}\stubpath = "C:\\Windows\\system32\\incsdfhkz.exe" inhfbqsjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09322BD9-E834-4252-B7A0-B9AD668717F0}\stubpath = "C:\\Windows\\system32\\inljswfrz.exe" inyvsxuru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB97190F-8796-49ed-8ABC-BF1AFB8865CD}\stubpath = "C:\\Windows\\system32\\incxuerhz.exe" inyazesml.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCB7A3AC-B7EC-45a9-88CA-0F30E0FC94ED} inblsqhkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D594B66-5AA4-4abc-A190-A9F677451E5B}\stubpath = "C:\\Windows\\system32\\iniujiyjl.exe" inriolaaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19A60791-15D8-4856-886A-7CE16AD6C1C4}\stubpath = "C:\\Windows\\system32\\inkmhgrmq.exe" inzjlpkqo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB22DD9F-3B86-47a8-8845-63E7F69E2FFD} inxsdoolp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC8ECAAD-1993-4344-987F-CA003A6827F8} inisglpjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88DC44DF-254A-4cf1-AEC5-970752F963B7} inxndtjlz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E049310-368D-4cc1-8E49-85A48F533A2F}\stubpath = "C:\\Windows\\system32\\inwmcsiky.exe" injidfpid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD4C1632-B4EC-417b-8A20-F5E1918BB2EF} inxavmale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAA81B05-EF85-4064-A9E6-B9EFBB2D9C9C} inufueytz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48956C77-EDDE-4e4e-8420-68F7B7464D67}\stubpath = "C:\\Windows\\system32\\inucxmxol.exe" inclpwksm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{495A0E8B-AEB1-4f04-A010-4B46A44E75A4}\stubpath = "C:\\Windows\\system32\\infmbihgy.exe" inljswfrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FF25A9A-D0AD-44fe-A9AB-2FD608B72C20} inbmmjnwc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B013599E-55A7-4e61-9C00-2BC9E545DD68} inwanaevl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{437FA6D6-33E2-42fc-9826-9C9AD045B02C} innfajbav.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EA0B86E-3453-4caf-BC42-3A5F0CF2B3DE} incxuerhz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCB1184F-DA0B-44fb-856F-B077F188E68D}\stubpath = "C:\\Windows\\system32\\inqmfrmyb.exe" invhwkmle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB134AEB-BC75-4649-8CD3-1303845B7C02}\stubpath = "C:\\Windows\\system32\\inixomukg.exe" ingiuiufd.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000011392-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4848 inogwahsa.exe 5848 inaexuhtj.exe 5792 inzkcszdo.exe 5520 inqcxrfhg.exe 2132 indwztgsi.exe 3020 inmprqjiy.exe 5972 inuqbjvqf.exe 3204 inzvgovkd.exe 4752 inldtepix.exe 3508 inrdysgih.exe 2696 inxiaqxbm.exe 5488 inpsutmlb.exe 4148 inbuxzyre.exe 3760 inykznpoh.exe 1760 insohtodl.exe 5444 infumgnyd.exe 1572 inmeufqjy.exe 4852 incrjzdkv.exe 1380 inwixlnmf.exe 5568 inrngsnzc.exe 1708 insvxwpco.exe 5928 infudswxj.exe 1888 innfvgrkz.exe 2248 indskelwb.exe 2616 ingwzqpxx.exe 2896 innuocedv.exe 4772 inxtemyti.exe 2792 incgzwjvl.exe 4304 injwnoaqy.exe 1088 inatwyxqd.exe 1896 inyjbrycn.exe 3860 inoavpdfe.exe 2200 insbquvhx.exe 1296 inlsmacbt.exe 5020 ineybxzdp.exe 5876 inwhpwale.exe 5660 inhwnltjf.exe 5912 insezthji.exe 5624 inaikwkwh.exe 4896 inljyapnv.exe 5168 inugvjlkd.exe 4408 injyqkarh.exe 4348 inwmpgfnn.exe 2912 intfuikjc.exe 876 ingvzmksi.exe 2740 inbqiycju.exe 3252 invhwkmle.exe 1660 inqmfrmyb.exe 1856 invrckwrg.exe 4700 inhwoipfi.exe 3672 ingtvpopk.exe 3956 incsvmltt.exe 1284 inewrcnnk.exe 5256 inazpsjiq.exe 3444 ingiuiufd.exe 5764 inixomukg.exe 2480 inqgdzfrf.exe 3344 inhwfuyzl.exe 4092 inruwvobn.exe 5636 inxjymong.exe 2720 inbqostfv.exe 5732 intpaiupe.exe 5032 ingvnhoze.exe 2864 inlofemzm.exe - Loads dropped DLL 64 IoCs
pid Process 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4848 inogwahsa.exe 4848 inogwahsa.exe 5848 inaexuhtj.exe 5848 inaexuhtj.exe 5792 inzkcszdo.exe 5792 inzkcszdo.exe 5520 inqcxrfhg.exe 5520 inqcxrfhg.exe 2132 indwztgsi.exe 2132 indwztgsi.exe 3020 inmprqjiy.exe 3020 inmprqjiy.exe 5972 inuqbjvqf.exe 5972 inuqbjvqf.exe 3204 inzvgovkd.exe 3204 inzvgovkd.exe 4752 inldtepix.exe 4752 inldtepix.exe 3508 inrdysgih.exe 3508 inrdysgih.exe 2696 inxiaqxbm.exe 2696 inxiaqxbm.exe 5488 inpsutmlb.exe 5488 inpsutmlb.exe 4148 inbuxzyre.exe 4148 inbuxzyre.exe 3760 inykznpoh.exe 3760 inykznpoh.exe 1760 insohtodl.exe 1760 insohtodl.exe 5444 infumgnyd.exe 5444 infumgnyd.exe 1572 inmeufqjy.exe 1572 inmeufqjy.exe 4852 incrjzdkv.exe 4852 incrjzdkv.exe 1380 inwixlnmf.exe 1380 inwixlnmf.exe 5568 inrngsnzc.exe 5568 inrngsnzc.exe 1708 insvxwpco.exe 1708 insvxwpco.exe 5928 infudswxj.exe 5928 infudswxj.exe 1888 innfvgrkz.exe 1888 innfvgrkz.exe 2248 indskelwb.exe 2248 indskelwb.exe 2616 ingwzqpxx.exe 2616 ingwzqpxx.exe 2896 innuocedv.exe 2896 innuocedv.exe 4772 inxtemyti.exe 4772 inxtemyti.exe 2792 incgzwjvl.exe 2792 incgzwjvl.exe 4304 injwnoaqy.exe 4304 injwnoaqy.exe 1088 inatwyxqd.exe 1088 inatwyxqd.exe 1896 inyjbrycn.exe 1896 inyjbrycn.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inzvgovkd.exe inuqbjvqf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inahuhbcs.exe File opened for modification C:\Windows\SysWOW64\inebgydau.exe_lang.ini inhbuwzwg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inilftocs.exe File opened for modification C:\Windows\SysWOW64\invbdruwx.exe_lang.ini inuydrpyf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuwftrhn.exe File opened for modification C:\Windows\SysWOW64\iniszaxor.exe_lang.ini inmgmynpz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indkgfezw.exe File created C:\Windows\SysWOW64\inahuhbcs.exe indrzpldy.exe File created C:\Windows\SysWOW64\invpovkyk.exe insacfcod.exe File created C:\Windows\SysWOW64\injyixbhg.exe inwhxahtz.exe File created C:\Windows\SysWOW64\inblsqhkm.exe invspsmvj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inewrcnnk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoxdfqoe.exe File created C:\Windows\SysWOW64\inenraymu.exe inlvjosms.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innajnacf.exe File opened for modification C:\Windows\SysWOW64\inrbvqwap.exe_lang.ini inujqmuoe.exe File created C:\Windows\SysWOW64\inowqgwxz.exe inotjfrzg.exe File created C:\Windows\SysWOW64\incsdfhkz.exe inhfbqsjb.exe File opened for modification C:\Windows\SysWOW64\inmzesqny.exe_lang.ini injhpghxs.exe File opened for modification C:\Windows\SysWOW64\inngmlnpt.exe_lang.ini inknedlyl.exe File created C:\Windows\SysWOW64\inokbwlsa.exe intuwvzao.exe File created C:\Windows\SysWOW64\inwuyycww.exe inimthpzj.exe File opened for modification C:\Windows\SysWOW64\ingatvyvf.exe_lang.ini inidwdyvc.exe File created C:\Windows\SysWOW64\indvdvgmq.exe infqlxfmg.exe File created C:\Windows\SysWOW64\ingrakqpr.exe inasgqvzt.exe File opened for modification C:\Windows\SysWOW64\inhbuwzwg.exe_lang.ini invmdukgq.exe File created C:\Windows\SysWOW64\injhpghxs.exe initcmsrt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbsfowhf.exe File created C:\Windows\SysWOW64\inkmhgrmq.exe inzjlpkqo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhwoipfi.exe File created C:\Windows\SysWOW64\inalzlawr.exe inefvmlzb.exe File opened for modification C:\Windows\SysWOW64\injvkjzkm.exe_lang.ini inmkimmxk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infzicqlp.exe File opened for modification C:\Windows\SysWOW64\invecggre.exe_lang.ini inzebhpmt.exe File created C:\Windows\SysWOW64\indvjzcoq.exe inujlcwuk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invwyxcqk.exe File opened for modification C:\Windows\SysWOW64\inykmqjhq.exe_lang.ini inrjcgagg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkzrlbas.exe File created C:\Windows\SysWOW64\ingwobgus.exe inmkoozmm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inknedlyl.exe File created C:\Windows\SysWOW64\inmzfdmqx.exe insgoyikn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inljswfrz.exe File opened for modification C:\Windows\SysWOW64\inqklaasr.exe_lang.ini inxrqyyst.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpqffxwb.exe File opened for modification C:\Windows\SysWOW64\inpkvggzd.exe_lang.ini ingvetxyk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmgmynpz.exe File created C:\Windows\SysWOW64\inyazesml.exe instvzuyn.exe File opened for modification C:\Windows\SysWOW64\inckscbjk.exe_lang.ini inniombtb.exe File opened for modification C:\Windows\SysWOW64\insezthji.exe_lang.ini inhwnltjf.exe File opened for modification C:\Windows\SysWOW64\inqmfrmyb.exe_lang.ini invhwkmle.exe File created C:\Windows\SysWOW64\inxitdtqe.exe invnbgkek.exe File created C:\Windows\SysWOW64\incbrdfjw.exe inngmlnpt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inljhllwj.exe File created C:\Windows\SysWOW64\iniqgcwmo.exe inrfvkmdx.exe File created C:\Windows\SysWOW64\inzebhpmt.exe inolzclrb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indvjzcoq.exe File created C:\Windows\SysWOW64\inthmqkqb.exe inqtvunam.exe File opened for modification C:\Windows\SysWOW64\insjarhdx.exe_lang.ini inthmqkqb.exe File opened for modification C:\Windows\SysWOW64\indjvakex.exe_lang.ini infgwnmcy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inumafjdj.exe File created C:\Windows\SysWOW64\ineqbmfxl.exe injsnioht.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuwegjgs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqxbfmkb.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqzaupvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogxmhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmeufqjy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insaljfpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxqcxpkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwztgsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqmfrmyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzhuwqpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtjmoji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlolxmlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbzddobb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsdfhkz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inepndjtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inixomukg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insulctjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indeulkya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inttrrtqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuypzsaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbobfwma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invudbffq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhpjpqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniombtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpriaela.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqostfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniizepdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inahuhbcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowqgwxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsnrmiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inptcowdq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtwnmuu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwgusogd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmflkmos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbrulkss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inumafjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwaxmami.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniujiyjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmiqkaqr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inonisjqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqiycju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intekobge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtgabri.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhjedoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkjzlnrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmhgrmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insezthji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbkvfva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgisalg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhgncqwc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvdvgmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzebhpmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inarenvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infcpjolj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsbjtei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegtexf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfkwncn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthmqkqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmosntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbpftoif.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4848 inogwahsa.exe 4848 inogwahsa.exe 5848 inaexuhtj.exe 5848 inaexuhtj.exe 5792 inzkcszdo.exe 5792 inzkcszdo.exe 5520 inqcxrfhg.exe 5520 inqcxrfhg.exe 2132 indwztgsi.exe 2132 indwztgsi.exe 3020 inmprqjiy.exe 3020 inmprqjiy.exe 5972 inuqbjvqf.exe 5972 inuqbjvqf.exe 3204 inzvgovkd.exe 3204 inzvgovkd.exe 4752 inldtepix.exe 4752 inldtepix.exe 3508 inrdysgih.exe 3508 inrdysgih.exe 2696 inxiaqxbm.exe 2696 inxiaqxbm.exe 5488 inpsutmlb.exe 5488 inpsutmlb.exe 4148 inbuxzyre.exe 4148 inbuxzyre.exe 3760 inykznpoh.exe 3760 inykznpoh.exe 1760 insohtodl.exe 1760 insohtodl.exe 5444 infumgnyd.exe 5444 infumgnyd.exe 1572 inmeufqjy.exe 1572 inmeufqjy.exe 4852 incrjzdkv.exe 4852 incrjzdkv.exe 1380 inwixlnmf.exe 1380 inwixlnmf.exe 5568 inrngsnzc.exe 5568 inrngsnzc.exe 1708 insvxwpco.exe 1708 insvxwpco.exe 5928 infudswxj.exe 5928 infudswxj.exe 1888 innfvgrkz.exe 1888 innfvgrkz.exe 2248 indskelwb.exe 2248 indskelwb.exe 2616 ingwzqpxx.exe 2616 ingwzqpxx.exe 2896 innuocedv.exe 2896 innuocedv.exe 4772 inxtemyti.exe 4772 inxtemyti.exe 2792 incgzwjvl.exe 2792 incgzwjvl.exe 4304 injwnoaqy.exe 4304 injwnoaqy.exe 1088 inatwyxqd.exe 1088 inatwyxqd.exe 1896 inyjbrycn.exe 1896 inyjbrycn.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe Token: SeDebugPrivilege 4848 inogwahsa.exe Token: SeDebugPrivilege 5848 inaexuhtj.exe Token: SeDebugPrivilege 5792 inzkcszdo.exe Token: SeDebugPrivilege 5520 inqcxrfhg.exe Token: SeDebugPrivilege 2132 indwztgsi.exe Token: SeDebugPrivilege 3020 inmprqjiy.exe Token: SeDebugPrivilege 5972 inuqbjvqf.exe Token: SeDebugPrivilege 3204 inzvgovkd.exe Token: SeDebugPrivilege 4752 inldtepix.exe Token: SeDebugPrivilege 3508 inrdysgih.exe Token: SeDebugPrivilege 2696 inxiaqxbm.exe Token: SeDebugPrivilege 5488 inpsutmlb.exe Token: SeDebugPrivilege 4148 inbuxzyre.exe Token: SeDebugPrivilege 3760 inykznpoh.exe Token: SeDebugPrivilege 1760 insohtodl.exe Token: SeDebugPrivilege 5444 infumgnyd.exe Token: SeDebugPrivilege 1572 inmeufqjy.exe Token: SeDebugPrivilege 4852 incrjzdkv.exe Token: SeDebugPrivilege 1380 inwixlnmf.exe Token: SeDebugPrivilege 5568 inrngsnzc.exe Token: SeDebugPrivilege 1708 insvxwpco.exe Token: SeDebugPrivilege 5928 infudswxj.exe Token: SeDebugPrivilege 1888 innfvgrkz.exe Token: SeDebugPrivilege 2248 indskelwb.exe Token: SeDebugPrivilege 2616 ingwzqpxx.exe Token: SeDebugPrivilege 2896 innuocedv.exe Token: SeDebugPrivilege 4772 inxtemyti.exe Token: SeDebugPrivilege 2792 incgzwjvl.exe Token: SeDebugPrivilege 4304 injwnoaqy.exe Token: SeDebugPrivilege 1088 inatwyxqd.exe Token: SeDebugPrivilege 1896 inyjbrycn.exe Token: SeDebugPrivilege 3860 inoavpdfe.exe Token: SeDebugPrivilege 2200 insbquvhx.exe Token: SeDebugPrivilege 1296 inlsmacbt.exe Token: SeDebugPrivilege 5020 ineybxzdp.exe Token: SeDebugPrivilege 5876 inwhpwale.exe Token: SeDebugPrivilege 5660 inhwnltjf.exe Token: SeDebugPrivilege 5912 insezthji.exe Token: SeDebugPrivilege 5624 inaikwkwh.exe Token: SeDebugPrivilege 4896 inljyapnv.exe Token: SeDebugPrivilege 5168 inugvjlkd.exe Token: SeDebugPrivilege 4408 injyqkarh.exe Token: SeDebugPrivilege 4348 inwmpgfnn.exe Token: SeDebugPrivilege 2912 intfuikjc.exe Token: SeDebugPrivilege 876 ingvzmksi.exe Token: SeDebugPrivilege 2740 inbqiycju.exe Token: SeDebugPrivilege 3252 invhwkmle.exe Token: SeDebugPrivilege 1660 inqmfrmyb.exe Token: SeDebugPrivilege 1856 invrckwrg.exe Token: SeDebugPrivilege 4700 inhwoipfi.exe Token: SeDebugPrivilege 3672 ingtvpopk.exe Token: SeDebugPrivilege 3956 incsvmltt.exe Token: SeDebugPrivilege 1284 inewrcnnk.exe Token: SeDebugPrivilege 5256 inazpsjiq.exe Token: SeDebugPrivilege 3444 ingiuiufd.exe Token: SeDebugPrivilege 5764 inixomukg.exe Token: SeDebugPrivilege 2480 inqgdzfrf.exe Token: SeDebugPrivilege 3344 inhwfuyzl.exe Token: SeDebugPrivilege 4092 inruwvobn.exe Token: SeDebugPrivilege 5636 inxjymong.exe Token: SeDebugPrivilege 2720 inbqostfv.exe Token: SeDebugPrivilege 5732 intpaiupe.exe Token: SeDebugPrivilege 5032 ingvnhoze.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 4848 inogwahsa.exe 5848 inaexuhtj.exe 5792 inzkcszdo.exe 5520 inqcxrfhg.exe 2132 indwztgsi.exe 3020 inmprqjiy.exe 5972 inuqbjvqf.exe 3204 inzvgovkd.exe 4752 inldtepix.exe 3508 inrdysgih.exe 2696 inxiaqxbm.exe 5488 inpsutmlb.exe 4148 inbuxzyre.exe 3760 inykznpoh.exe 1760 insohtodl.exe 5444 infumgnyd.exe 1572 inmeufqjy.exe 4852 incrjzdkv.exe 1380 inwixlnmf.exe 5568 inrngsnzc.exe 1708 insvxwpco.exe 5928 infudswxj.exe 1888 innfvgrkz.exe 2248 indskelwb.exe 2616 ingwzqpxx.exe 2896 innuocedv.exe 4772 inxtemyti.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4848 4144 2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe 91 PID 4848 wrote to memory of 5848 4848 inogwahsa.exe 92 PID 5848 wrote to memory of 5792 5848 inaexuhtj.exe 93 PID 5792 wrote to memory of 5520 5792 inzkcszdo.exe 94 PID 5520 wrote to memory of 2132 5520 inqcxrfhg.exe 95 PID 2132 wrote to memory of 3020 2132 indwztgsi.exe 96 PID 3020 wrote to memory of 5972 3020 inmprqjiy.exe 97 PID 5972 wrote to memory of 3204 5972 inuqbjvqf.exe 98 PID 3204 wrote to memory of 4752 3204 inzvgovkd.exe 99 PID 4752 wrote to memory of 3508 4752 inldtepix.exe 100 PID 3508 wrote to memory of 2696 3508 inrdysgih.exe 101 PID 2696 wrote to memory of 5488 2696 inxiaqxbm.exe 102 PID 5488 wrote to memory of 4148 5488 inpsutmlb.exe 103 PID 4148 wrote to memory of 3760 4148 inbuxzyre.exe 104 PID 3760 wrote to memory of 1760 3760 inykznpoh.exe 105 PID 1760 wrote to memory of 5444 1760 insohtodl.exe 106 PID 5444 wrote to memory of 1572 5444 infumgnyd.exe 107 PID 1572 wrote to memory of 4852 1572 inmeufqjy.exe 108 PID 4852 wrote to memory of 1380 4852 incrjzdkv.exe 109 PID 1380 wrote to memory of 5568 1380 inwixlnmf.exe 110 PID 5568 wrote to memory of 1708 5568 inrngsnzc.exe 111 PID 1708 wrote to memory of 5928 1708 insvxwpco.exe 112 PID 5928 wrote to memory of 1888 5928 infudswxj.exe 113 PID 1888 wrote to memory of 2248 1888 innfvgrkz.exe 114 PID 2248 wrote to memory of 2616 2248 indskelwb.exe 115 PID 2616 wrote to memory of 2896 2616 ingwzqpxx.exe 116 PID 2896 wrote to memory of 4772 2896 innuocedv.exe 117 PID 4772 wrote to memory of 2792 4772 inxtemyti.exe 118 PID 2792 wrote to memory of 4304 2792 incgzwjvl.exe 119 PID 4304 wrote to memory of 1088 4304 injwnoaqy.exe 120 PID 1088 wrote to memory of 1896 1088 inatwyxqd.exe 121 PID 1896 wrote to memory of 3860 1896 inyjbrycn.exe 122 PID 3860 wrote to memory of 2200 3860 inoavpdfe.exe 123 PID 2200 wrote to memory of 1296 2200 insbquvhx.exe 124 PID 1296 wrote to memory of 5020 1296 inlsmacbt.exe 125 PID 5020 wrote to memory of 5876 5020 ineybxzdp.exe 126 PID 5876 wrote to memory of 5660 5876 inwhpwale.exe 127 PID 5660 wrote to memory of 5912 5660 inhwnltjf.exe 128 PID 5912 wrote to memory of 5624 5912 insezthji.exe 129 PID 5624 wrote to memory of 4896 5624 inaikwkwh.exe 130 PID 4896 wrote to memory of 5168 4896 inljyapnv.exe 131 PID 5168 wrote to memory of 4408 5168 inugvjlkd.exe 132 PID 4408 wrote to memory of 4348 4408 injyqkarh.exe 133 PID 4348 wrote to memory of 2912 4348 inwmpgfnn.exe 134 PID 2912 wrote to memory of 876 2912 intfuikjc.exe 135 PID 876 wrote to memory of 2740 876 ingvzmksi.exe 136 PID 2740 wrote to memory of 3252 2740 inbqiycju.exe 137 PID 3252 wrote to memory of 1660 3252 invhwkmle.exe 138 PID 1660 wrote to memory of 1856 1660 inqmfrmyb.exe 139 PID 1856 wrote to memory of 4700 1856 invrckwrg.exe 140 PID 4700 wrote to memory of 3672 4700 inhwoipfi.exe 141 PID 3672 wrote to memory of 3956 3672 ingtvpopk.exe 142 PID 3956 wrote to memory of 1284 3956 incsvmltt.exe 143 PID 1284 wrote to memory of 5256 1284 inewrcnnk.exe 144 PID 5256 wrote to memory of 3444 5256 inazpsjiq.exe 145 PID 3444 wrote to memory of 5764 3444 ingiuiufd.exe 146 PID 5764 wrote to memory of 2480 5764 inixomukg.exe 147 PID 2480 wrote to memory of 3344 2480 inqgdzfrf.exe 148 PID 3344 wrote to memory of 4092 3344 inhwfuyzl.exe 149 PID 4092 wrote to memory of 5636 4092 inruwvobn.exe 150 PID 5636 wrote to memory of 2720 5636 inxjymong.exe 151 PID 2720 wrote to memory of 5732 2720 inbqostfv.exe 152 PID 5732 wrote to memory of 5032 5732 intpaiupe.exe 153 PID 5032 wrote to memory of 2864 5032 ingvnhoze.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_998741169e0c91c905b976b20c2e5b12_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe35⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe38⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe48⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe49⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe56⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe65⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe66⤵PID:2376
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe67⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3684 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe68⤵PID:2344
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe69⤵
- System Location Discovery: System Language Discovery
PID:5528 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe70⤵PID:3944
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe71⤵
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe72⤵PID:4900
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe73⤵PID:5536
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe74⤵PID:1020
-
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe75⤵PID:1032
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe76⤵PID:1192
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe77⤵PID:3192
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe78⤵PID:3200
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe79⤵PID:1228
-
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe80⤵PID:4264
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe81⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1580 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe82⤵PID:2648
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe83⤵PID:3880
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe84⤵PID:4292
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe85⤵PID:5720
-
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe86⤵PID:3308
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe87⤵PID:5580
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe88⤵PID:2328
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe89⤵PID:5924
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe90⤵PID:5836
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe91⤵
- System Location Discovery: System Language Discovery
PID:2468 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe92⤵PID:6088
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe93⤵PID:4952
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe94⤵PID:5212
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe95⤵PID:2600
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe96⤵PID:2676
-
C:\Windows\SysWOW64\invnbgkek.exeC:\Windows\system32\invnbgkek.exe97⤵
- Drops file in System32 directory
PID:4956 -
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe98⤵PID:4328
-
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe99⤵PID:3528
-
C:\Windows\SysWOW64\inrhnxdft.exeC:\Windows\system32\inrhnxdft.exe100⤵PID:3016
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe101⤵PID:3932
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe102⤵
- Drops file in System32 directory
PID:5460 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe103⤵PID:3312
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe104⤵PID:8
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe105⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3916 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe106⤵PID:3384
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe107⤵PID:1224
-
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe108⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5964 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe109⤵PID:4116
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe110⤵PID:5808
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe111⤵PID:1172
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe112⤵PID:5196
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe113⤵
- Drops file in System32 directory
PID:1232 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe114⤵PID:5388
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe115⤵
- Drops file in System32 directory
PID:4412 -
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\system32\inyteppma.exe116⤵PID:708
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe117⤵PID:2388
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe118⤵PID:4132
-
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe119⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5940 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe120⤵PID:4776
-
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe121⤵PID:5100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-