Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/11/2026, 21:28
Behavioral task
behavioral1
Sample
2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe
- Size 897KB
- Sample261111-1btcnaca98
- SHA256 638bc8a46b8d0431b4b2ba20e5310d2d09b2bd8e45d7a54c476c03019ac3fdc1
- MD5 bef95474cb778f3d30927a51f569a31c
- SHA1 19f8787a5dbd964368ba15ee2c5ba6448d816161
- SHA512 71bb679fba2833a09ef78d484fb664bf9a0b091e50e8dad5bdb95048e0cf207715819bb3a063feb2fa51bb998c3d64c748acc06f5fea8eb0be236542eb999866
- SSDEEP 24576:ouLwoR5RNPjKoOwuLwoR5RNPjKoO6uLwoR5RNPD:RPjOJPjOfPD
- TLSH T1FE15CF01BEE740F9EAE8003C24FB2776963B6998FB085FD36319EE755833551E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 51 IoCs
resource yara_rule behavioral1/memory/2448-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0008000000024615-12.dat family_gh0strat behavioral1/files/0x000700000002461a-20.dat family_gh0strat behavioral1/memory/4732-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002461f-43.dat family_gh0strat behavioral1/files/0x0007000000024623-68.dat family_gh0strat behavioral1/files/0x0007000000024627-92.dat family_gh0strat behavioral1/files/0x000700000002463b-207.dat family_gh0strat behavioral1/memory/768-648-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4484-629-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4524-610-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1780-593-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3304-573-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3164-553-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2576-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/396-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1908-497-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2820-477-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4328-460-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4068-440-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4608-420-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3028-401-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/960-382-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024657-369.dat family_gh0strat behavioral1/memory/2320-363-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024653-345.dat family_gh0strat behavioral1/memory/1632-338-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002464f-322.dat family_gh0strat behavioral1/memory/920-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002464b-299.dat family_gh0strat behavioral1/memory/2204-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024647-276.dat family_gh0strat behavioral1/memory/4860-269-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024643-253.dat family_gh0strat behavioral1/memory/1248-246-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002463f-230.dat family_gh0strat behavioral1/memory/4316-211-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2844-188-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024637-184.dat family_gh0strat behavioral1/memory/1988-165-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024633-161.dat family_gh0strat behavioral1/memory/2572-141-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002462f-138.dat family_gh0strat behavioral1/memory/3104-131-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002462b-115.dat family_gh0strat behavioral1/memory/2584-95-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2448-86-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1872-72-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4732-61-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1872-58-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024e1b-8448.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F601B9B1-59AB-4690-9222-7AA7B8272F8F}\stubpath = "C:\\Windows\\system32\\injyqkarh.exe" inzvgovkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADEBB902-205C-47dc-AA11-463271E4BC70}\stubpath = "C:\\Windows\\system32\\insohtodl.exe" inigtklnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{031A87AB-C1A1-4f35-9C96-CFD6291C1F79} inwhpwale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A31A6CE-A482-4241-AC7D-3A47B416AF5F}\stubpath = "C:\\Windows\\system32\\inidwdyvc.exe" inbpftoif.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A88036E1-91C8-4042-90E4-26CFEE54F415} inemiltdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AD1FC27-1FDC-4e43-B0F0-DBDD20622FEB} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6302B7DB-2C26-46a1-A7A6-7F23F7364C01}\stubpath = "C:\\Windows\\system32\\inmthpmsh.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EF058E0-CCC9-4f84-A1A2-540D709E59CC} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{031A87AB-C1A1-4f35-9C96-CFD6291C1F79}\stubpath = "C:\\Windows\\system32\\inaikwkwh.exe" inwhpwale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95D1E353-679D-456b-B492-128345751D78}\stubpath = "C:\\Windows\\system32\\incybtpgq.exe" inijzqpfx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF872A02-E550-4627-9019-DDC711B78665} inqfeufhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C2144F8-928D-4fd5-911A-22079DD9F27E}\stubpath = "C:\\Windows\\system32\\inzebhpmt.exe" inbkyszdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6D92140-78A5-4147-A909-7B1E91E0A4C4} inloiwrfv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{845407D2-44CD-4566-950C-ABEC3A7B061D}\stubpath = "C:\\Windows\\system32\\inxzfxryi.exe" indjeilnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF0BBDF3-28EE-412d-BF55-923423BCC6FC}\stubpath = "C:\\Windows\\system32\\inpiextzn.exe" inkfbyhcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12E01182-D4E7-4fc0-A39A-519BB117C353}\stubpath = "C:\\Windows\\system32\\ineojcsxs.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C9B625D-7D59-4f85-A39D-97B20C12707B}\stubpath = "C:\\Windows\\system32\\inrkqhiua.exe" incfdqdof.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D5B7963-4BEF-47ba-9DE5-F0517CE690CF} inhlqhxjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D4F30A8-7E15-40db-95D3-42DFBE9D3083}\stubpath = "C:\\Windows\\system32\\inwojflbg.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB0CCC87-A593-4f48-8A95-594C3C4A347B}\stubpath = "C:\\Windows\\system32\\insfizgbe.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E08F00B0-9282-4a3d-B29B-85E900FB402C} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F62C3958-9248-4bb5-858B-0B8C1007A6F4}\stubpath = "C:\\Windows\\system32\\intlmtwdc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{95FB1BBE-87B5-4047-832B-020460F7B439}\stubpath = "C:\\Windows\\system32\\inuxaetfe.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B401EA38-0DBE-41b3-8F3C-1C77A68E5872}\stubpath = "C:\\Windows\\system32\\inuwftrhn.exe" ingrakqpr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D744FA73-7984-42eb-B2CE-B02893B886C3}\stubpath = "C:\\Windows\\system32\\ingcowdkg.exe" inbjdjvkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E756DBD-DC37-4bb6-BF60-AF5B0CA0B9C8} infniwngs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F443479-5AAA-4f2b-BAEE-7FC2667AB349}\stubpath = "C:\\Windows\\system32\\iniuxcykh.exe" invawifmu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{979CB546-6F6E-498e-A419-6F0BCCF09996} ingcykdym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{551C3577-353C-43cc-94F1-CD59AD7BB108}\stubpath = "C:\\Windows\\system32\\inswsewhq.exe" intujfhfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8C63FA8-578C-4eaa-84EE-FC9930C2DAEA}\stubpath = "C:\\Windows\\system32\\inrtpwblh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{707BABE8-E02B-48e0-8FC1-E532E4350DFC}\stubpath = "C:\\Windows\\system32\\inthjosvx.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C151B70-83EB-4edc-B66F-0AE628180762} inbpxnjbw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7A755DE-DF6B-4859-9551-0092000CB03E} inihodrxd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7159658-3357-4986-836D-8A46C1EF8914} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A96EE09C-A84E-4ef3-B79F-AF9F4A9AFC59} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D48D707-F9E3-43ec-9843-B714A0CE6490}\stubpath = "C:\\Windows\\system32\\inrmygnhd.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{710FA42D-6A2D-4377-81C4-431F456223E1} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E37655F-50A3-4eb8-86A9-C0A28E77949A} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADA02A0F-AFF5-409d-B46A-F7CB8181CD36} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE8DE8E9-F5A4-4105-A8CB-4D5803F69930}\stubpath = "C:\\Windows\\system32\\inxujybfr.exe" inwanaevl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2E7E27E-2897-4123-992C-D31CD07B5076} inskjegqj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47AF1460-6A33-43eb-A29D-D92FEA562242} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{082C437A-F758-4921-9E2C-C6C1384E6916}\stubpath = "C:\\Windows\\system32\\inrznmuad.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60583787-0422-4aad-9F81-3B3399C34B73}\stubpath = "C:\\Windows\\system32\\ineybxzdp.exe" inpsutmlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79ECC1F0-7301-425e-A8E1-92B4D533EBC0} inatwyxqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25489D6C-3676-43f0-B1A6-936B362CA142}\stubpath = "C:\\Windows\\system32\\inakrpgjz.exe" ineugyxhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2100264-9CE1-4b55-9E67-DD58DC037C4E} inzbahzkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7738E82-F6FC-433c-8E24-A41F77EFDF80}\stubpath = "C:\\Windows\\system32\\iniujiyjl.exe" inrzweovz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB0FF5B9-95E4-4188-A436-768CEDE7285A}\stubpath = "C:\\Windows\\system32\\inkquqcuf.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86A60EF8-3C26-49f0-8768-541895D8CE3B} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EF75DD3-1B18-42f9-8CC8-CA8D8BE894C2}\stubpath = "C:\\Windows\\system32\\inzgfmdgp.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE50661B-438D-4d16-A31D-BB941C2E44F7}\stubpath = "C:\\Windows\\system32\\inpeyhpif.exe" inpnehxjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{483DE457-0E85-4a2d-8771-7D5C806336C8}\stubpath = "C:\\Windows\\system32\\invshckbs.exe" inpeyhpif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D600C446-D1BB-40e2-A75C-6FEAA7C59A33}\stubpath = "C:\\Windows\\system32\\inpfvwyie.exe" inbhrywnq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{823B2C03-8FEC-4e50-ABBC-32011D4E370C}\stubpath = "C:\\Windows\\system32\\inmbpckft.exe" inzuolauz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D8F7589-C349-4644-A446-70DCF012D786} inahiaqgt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{458ADCCD-2ECB-4960-BE1D-01A6C2153ED0}\stubpath = "C:\\Windows\\system32\\inzjhwubd.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49985540-BC19-4f50-9520-E927B6A8EB1B} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A31B4A0D-2C30-41ea-8CA0-E5A8B4E7D5A0} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43AC38C1-99DF-4422-83A1-A6EF2265D778}\stubpath = "C:\\Windows\\system32\\inwrmkgem.exe" inpzchsnz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF7ABD68-8862-4a50-90DC-6AA3215FFE2B} inomlwaho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EA2F2A4-784F-4bc5-9B80-F8303224FC38}\stubpath = "C:\\Windows\\system32\\inaiqahiy.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15E4DE60-FA24-429e-9F1E-2F4CF1A17F4D} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D41C22E-4EBA-4a0b-9716-E733889F1BB3} Process not Found - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x001400000002444d-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4732 incvyzsfr.exe 1872 inldtepix.exe 2584 inqmfrmyb.exe 3104 inqcxrfhg.exe 2572 intfuikjc.exe 1988 invhwkmle.exe 2844 inzkcszdo.exe 4316 inmeufqjy.exe 1248 inyorihpp.exe 4860 insezthji.exe 2204 indtwnmuu.exe 920 inxjymong.exe 1632 inpleqlxa.exe 2320 inortslka.exe 960 inruwvobn.exe 3028 inxtemyti.exe 4608 inzvgovkd.exe 4068 injyqkarh.exe 4328 inmtnbdcu.exe 2820 inqtvunam.exe 1908 insvxwpco.exe 396 inwixlnmf.exe 2576 innuocedv.exe 3164 injkrqgyq.exe 3304 inbaqtkjr.exe 1780 indwztgsi.exe 4524 incgzwjvl.exe 4484 inigtklnv.exe 768 insohtodl.exe 3896 inuqbjvqf.exe 2668 inbqostfv.exe 4172 insbquvhx.exe 4512 inkbaivic.exe 4660 inknedlyl.exe 2772 inoavpdfe.exe 3808 inrdysgih.exe 2384 inbrulkss.exe 4960 ineuxonvv.exe 636 inykznpoh.exe 2328 innqsrkjz.exe 2248 inpsutmlb.exe 3756 ineybxzdp.exe 1188 inbuxzyre.exe 680 inwhpwale.exe 3484 inaikwkwh.exe 4696 injhulmow.exe 1096 injwnoaqy.exe 4048 incrjzdkv.exe 4556 infumgnyd.exe 2696 intcrvwiy.exe 4132 inyjbrycn.exe 2028 inhwnltjf.exe 4204 inogwahsa.exe 1936 inadbobmd.exe 1772 inetlfmxc.exe 728 inpqffxwb.exe 1996 inzloqpih.exe 1716 intsuvkkg.exe 1332 incwvxbyn.exe 4492 indpalewk.exe 2960 inhegsgsd.exe 2956 inaexuhtj.exe 2120 indhxkwmb.exe 2712 innfvgrkz.exe - Loads dropped DLL 64 IoCs
pid Process 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 4732 incvyzsfr.exe 4732 incvyzsfr.exe 1872 inldtepix.exe 1872 inldtepix.exe 2584 inqmfrmyb.exe 2584 inqmfrmyb.exe 3104 inqcxrfhg.exe 3104 inqcxrfhg.exe 2572 intfuikjc.exe 2572 intfuikjc.exe 1988 invhwkmle.exe 1988 invhwkmle.exe 2844 inzkcszdo.exe 2844 inzkcszdo.exe 4316 inmeufqjy.exe 4316 inmeufqjy.exe 1248 inyorihpp.exe 1248 inyorihpp.exe 4860 insezthji.exe 4860 insezthji.exe 2204 indtwnmuu.exe 2204 indtwnmuu.exe 920 inxjymong.exe 920 inxjymong.exe 1632 inpleqlxa.exe 1632 inpleqlxa.exe 2320 inortslka.exe 2320 inortslka.exe 960 inruwvobn.exe 960 inruwvobn.exe 3028 inxtemyti.exe 3028 inxtemyti.exe 4608 inzvgovkd.exe 4608 inzvgovkd.exe 4068 injyqkarh.exe 4068 injyqkarh.exe 4328 inmtnbdcu.exe 4328 inmtnbdcu.exe 2820 inqtvunam.exe 2820 inqtvunam.exe 1908 insvxwpco.exe 1908 insvxwpco.exe 396 inwixlnmf.exe 396 inwixlnmf.exe 2576 innuocedv.exe 2576 innuocedv.exe 3164 injkrqgyq.exe 3164 injkrqgyq.exe 3304 inbaqtkjr.exe 3304 inbaqtkjr.exe 1780 indwztgsi.exe 1780 indwztgsi.exe 4524 incgzwjvl.exe 4524 incgzwjvl.exe 4484 inigtklnv.exe 4484 inigtklnv.exe 768 insohtodl.exe 768 insohtodl.exe 3896 inuqbjvqf.exe 3896 inuqbjvqf.exe 2668 inbqostfv.exe 2668 inbqostfv.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inogxmhdp.exe_lang.ini intbosajb.exe File opened for modification C:\Windows\SysWOW64\infcwfnxi.exe_lang.ini inzajppij.exe File opened for modification C:\Windows\SysWOW64\injkhlstg.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\injgscptp.exe Process not Found File created C:\Windows\SysWOW64\intlbygys.exe Process not Found File opened for modification C:\Windows\SysWOW64\invqmdynu.exe_lang.ini inhiypoew.exe File created C:\Windows\SysWOW64\inragwryq.exe inauxfdek.exe File opened for modification C:\Windows\SysWOW64\infgqgwzc.exe_lang.ini inunawidf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injgmuryj.exe File opened for modification C:\Windows\SysWOW64\inozdkrxq.exe_lang.ini inmzdngio.exe File opened for modification C:\Windows\SysWOW64\inxtlgczi.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\infvqbbup.exe inilcbjwj.exe File opened for modification C:\Windows\SysWOW64\inbipvobx.exe_lang.ini injewsihf.exe File opened for modification C:\Windows\SysWOW64\inbmnexcl.exe_lang.ini inowgoknv.exe File opened for modification C:\Windows\SysWOW64\inhbwuioq.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inpducnjr.exe Process not Found File created C:\Windows\SysWOW64\inmktvyiu.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inmgwpkft.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inhfsfaqh.exe File opened for modification C:\Windows\SysWOW64\inefvqvoa.exe_lang.ini indcsegkx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inriolaaj.exe File opened for modification C:\Windows\SysWOW64\inenfezbl.exe_lang.ini inclbusyn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjibmnx.exe File opened for modification C:\Windows\SysWOW64\inpatbkcw.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inmztlqjf.exe Process not Found File opened for modification C:\Windows\SysWOW64\incvyzsfr.exe_lang.ini 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invtfsnjp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\invtcqgup.exe_lang.ini inyctgpxi.exe File opened for modification C:\Windows\SysWOW64\invhauplr.exe_lang.ini inmachloq.exe File opened for modification C:\Windows\SysWOW64\inddzeqan.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inygzkpww.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inzesnhey.exe File created C:\Windows\SysWOW64\iniszdhvx.exe inniucjdf.exe File opened for modification C:\Windows\SysWOW64\inhvtxxbv.exe_lang.ini insqkrbxb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inragwryq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\infciqnuf.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inbjudnts.exe_lang.ini infhthtec.exe File opened for modification C:\Windows\SysWOW64\intxmhybx.exe_lang.ini inqpqfsux.exe File created C:\Windows\SysWOW64\inaqqubah.exe Process not Found File created C:\Windows\SysWOW64\inyegrpfl.exe inocymrvp.exe File created C:\Windows\SysWOW64\inarenvge.exe ingfvhjng.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkmhgrmq.exe File opened for modification C:\Windows\SysWOW64\inanbwzzr.exe_lang.ini inhrtbdgd.exe File opened for modification C:\Windows\SysWOW64\inlrrkalf.exe_lang.ini inpjeydbp.exe File created C:\Windows\SysWOW64\inbrumuek.exe inmeomnmv.exe File opened for modification C:\Windows\SysWOW64\ingdeousr.exe_lang.ini inaxtyzbi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\ingugrwmi.exe inuwftrhn.exe File opened for modification C:\Windows\SysWOW64\infvqbbup.exe_lang.ini inilcbjwj.exe File opened for modification C:\Windows\SysWOW64\inicbilrv.exe_lang.ini inilkidhu.exe File created C:\Windows\SysWOW64\injkufcol.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inpzplgqv.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\iniyjujuj.exe Process not Found File created C:\Windows\SysWOW64\inhjmjvkj.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inljwnoaq.exe File opened for modification C:\Windows\SysWOW64\inigawxmy.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\ingklvgdp.exe_lang.ini Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbhfeuxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inscqyokc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvzmksi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirmhzng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyepukgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatybwnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwbpnkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlubyhti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwgmmfga.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insaljfpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoqadam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsdlxsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwemzvcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkuaczqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqqspmro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insylvfcw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwgusogd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmrxryds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykgfwoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insnslxws.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhnmoqun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmbpckft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvpwggs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbaqbdfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwikohfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzzdxxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incmrujul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpljrdzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfvwyie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inolzclrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqjwwyse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbxslgig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inblsqhkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmqlrpew.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 4732 incvyzsfr.exe 4732 incvyzsfr.exe 1872 inldtepix.exe 1872 inldtepix.exe 2584 inqmfrmyb.exe 2584 inqmfrmyb.exe 3104 inqcxrfhg.exe 3104 inqcxrfhg.exe 2572 intfuikjc.exe 2572 intfuikjc.exe 1988 invhwkmle.exe 1988 invhwkmle.exe 2844 inzkcszdo.exe 2844 inzkcszdo.exe 4316 inmeufqjy.exe 4316 inmeufqjy.exe 1248 inyorihpp.exe 1248 inyorihpp.exe 4860 insezthji.exe 4860 insezthji.exe 2204 indtwnmuu.exe 2204 indtwnmuu.exe 920 inxjymong.exe 920 inxjymong.exe 1632 inpleqlxa.exe 1632 inpleqlxa.exe 2320 inortslka.exe 2320 inortslka.exe 960 inruwvobn.exe 960 inruwvobn.exe 3028 inxtemyti.exe 3028 inxtemyti.exe 4608 inzvgovkd.exe 4608 inzvgovkd.exe 4068 injyqkarh.exe 4068 injyqkarh.exe 4328 inmtnbdcu.exe 4328 inmtnbdcu.exe 2820 inqtvunam.exe 2820 inqtvunam.exe 1908 insvxwpco.exe 1908 insvxwpco.exe 396 inwixlnmf.exe 396 inwixlnmf.exe 2576 innuocedv.exe 2576 innuocedv.exe 3164 injkrqgyq.exe 3164 injkrqgyq.exe 3304 inbaqtkjr.exe 3304 inbaqtkjr.exe 1780 indwztgsi.exe 1780 indwztgsi.exe 4524 incgzwjvl.exe 4524 incgzwjvl.exe 4484 inigtklnv.exe 4484 inigtklnv.exe 768 insohtodl.exe 768 insohtodl.exe 3896 inuqbjvqf.exe 3896 inuqbjvqf.exe 2668 inbqostfv.exe 2668 inbqostfv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe Token: SeDebugPrivilege 4732 incvyzsfr.exe Token: SeDebugPrivilege 1872 inldtepix.exe Token: SeDebugPrivilege 2584 inqmfrmyb.exe Token: SeDebugPrivilege 3104 inqcxrfhg.exe Token: SeDebugPrivilege 2572 intfuikjc.exe Token: SeDebugPrivilege 1988 invhwkmle.exe Token: SeDebugPrivilege 2844 inzkcszdo.exe Token: SeDebugPrivilege 4316 inmeufqjy.exe Token: SeDebugPrivilege 1248 inyorihpp.exe Token: SeDebugPrivilege 4860 insezthji.exe Token: SeDebugPrivilege 2204 indtwnmuu.exe Token: SeDebugPrivilege 920 inxjymong.exe Token: SeDebugPrivilege 1632 inpleqlxa.exe Token: SeDebugPrivilege 2320 inortslka.exe Token: SeDebugPrivilege 960 inruwvobn.exe Token: SeDebugPrivilege 3028 inxtemyti.exe Token: SeDebugPrivilege 4608 inzvgovkd.exe Token: SeDebugPrivilege 4068 injyqkarh.exe Token: SeDebugPrivilege 4328 inmtnbdcu.exe Token: SeDebugPrivilege 2820 inqtvunam.exe Token: SeDebugPrivilege 1908 insvxwpco.exe Token: SeDebugPrivilege 396 inwixlnmf.exe Token: SeDebugPrivilege 2576 innuocedv.exe Token: SeDebugPrivilege 3164 injkrqgyq.exe Token: SeDebugPrivilege 3304 inbaqtkjr.exe Token: SeDebugPrivilege 1780 indwztgsi.exe Token: SeDebugPrivilege 4524 incgzwjvl.exe Token: SeDebugPrivilege 4484 inigtklnv.exe Token: SeDebugPrivilege 768 insohtodl.exe Token: SeDebugPrivilege 3896 inuqbjvqf.exe Token: SeDebugPrivilege 2668 inbqostfv.exe Token: SeDebugPrivilege 4172 insbquvhx.exe Token: SeDebugPrivilege 4512 inkbaivic.exe Token: SeDebugPrivilege 4660 inknedlyl.exe Token: SeDebugPrivilege 2772 inoavpdfe.exe Token: SeDebugPrivilege 3808 inrdysgih.exe Token: SeDebugPrivilege 2384 inbrulkss.exe Token: SeDebugPrivilege 4960 ineuxonvv.exe Token: SeDebugPrivilege 636 inykznpoh.exe Token: SeDebugPrivilege 2328 innqsrkjz.exe Token: SeDebugPrivilege 2248 inpsutmlb.exe Token: SeDebugPrivilege 3756 ineybxzdp.exe Token: SeDebugPrivilege 1188 inbuxzyre.exe Token: SeDebugPrivilege 680 inwhpwale.exe Token: SeDebugPrivilege 3484 inaikwkwh.exe Token: SeDebugPrivilege 4696 injhulmow.exe Token: SeDebugPrivilege 1096 injwnoaqy.exe Token: SeDebugPrivilege 4048 incrjzdkv.exe Token: SeDebugPrivilege 4556 infumgnyd.exe Token: SeDebugPrivilege 2696 intcrvwiy.exe Token: SeDebugPrivilege 4132 inyjbrycn.exe Token: SeDebugPrivilege 2028 inhwnltjf.exe Token: SeDebugPrivilege 4204 inogwahsa.exe Token: SeDebugPrivilege 1936 inadbobmd.exe Token: SeDebugPrivilege 1772 inetlfmxc.exe Token: SeDebugPrivilege 728 inpqffxwb.exe Token: SeDebugPrivilege 1996 inzloqpih.exe Token: SeDebugPrivilege 1716 intsuvkkg.exe Token: SeDebugPrivilege 1332 incwvxbyn.exe Token: SeDebugPrivilege 4492 indpalewk.exe Token: SeDebugPrivilege 2960 inhegsgsd.exe Token: SeDebugPrivilege 2956 inaexuhtj.exe Token: SeDebugPrivilege 2120 indhxkwmb.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 4732 incvyzsfr.exe 1872 inldtepix.exe 2584 inqmfrmyb.exe 3104 inqcxrfhg.exe 2572 intfuikjc.exe 1988 invhwkmle.exe 2844 inzkcszdo.exe 4316 inmeufqjy.exe 1248 inyorihpp.exe 4860 insezthji.exe 2204 indtwnmuu.exe 920 inxjymong.exe 1632 inpleqlxa.exe 2320 inortslka.exe 960 inruwvobn.exe 3028 inxtemyti.exe 4608 inzvgovkd.exe 4068 injyqkarh.exe 4328 inmtnbdcu.exe 2820 inqtvunam.exe 1908 insvxwpco.exe 396 inwixlnmf.exe 2576 innuocedv.exe 3164 injkrqgyq.exe 3304 inbaqtkjr.exe 1780 indwztgsi.exe 4524 incgzwjvl.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 4732 2448 2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe 85 PID 4732 wrote to memory of 1872 4732 incvyzsfr.exe 86 PID 1872 wrote to memory of 2584 1872 inldtepix.exe 87 PID 2584 wrote to memory of 3104 2584 inqmfrmyb.exe 88 PID 3104 wrote to memory of 2572 3104 inqcxrfhg.exe 89 PID 2572 wrote to memory of 1988 2572 intfuikjc.exe 90 PID 1988 wrote to memory of 2844 1988 invhwkmle.exe 91 PID 2844 wrote to memory of 4316 2844 inzkcszdo.exe 92 PID 4316 wrote to memory of 1248 4316 inmeufqjy.exe 93 PID 1248 wrote to memory of 4860 1248 inyorihpp.exe 94 PID 4860 wrote to memory of 2204 4860 insezthji.exe 95 PID 2204 wrote to memory of 920 2204 indtwnmuu.exe 96 PID 920 wrote to memory of 1632 920 inxjymong.exe 97 PID 1632 wrote to memory of 2320 1632 inpleqlxa.exe 98 PID 2320 wrote to memory of 960 2320 inortslka.exe 99 PID 960 wrote to memory of 3028 960 inruwvobn.exe 100 PID 3028 wrote to memory of 4608 3028 inxtemyti.exe 101 PID 4608 wrote to memory of 4068 4608 inzvgovkd.exe 102 PID 4068 wrote to memory of 4328 4068 injyqkarh.exe 103 PID 4328 wrote to memory of 2820 4328 inmtnbdcu.exe 104 PID 2820 wrote to memory of 1908 2820 inqtvunam.exe 105 PID 1908 wrote to memory of 396 1908 insvxwpco.exe 106 PID 396 wrote to memory of 2576 396 inwixlnmf.exe 107 PID 2576 wrote to memory of 3164 2576 innuocedv.exe 108 PID 3164 wrote to memory of 3304 3164 injkrqgyq.exe 109 PID 3304 wrote to memory of 1780 3304 inbaqtkjr.exe 110 PID 1780 wrote to memory of 4524 1780 indwztgsi.exe 111 PID 4524 wrote to memory of 4484 4524 incgzwjvl.exe 112 PID 4484 wrote to memory of 768 4484 inigtklnv.exe 113 PID 768 wrote to memory of 3896 768 insohtodl.exe 114 PID 3896 wrote to memory of 2668 3896 inuqbjvqf.exe 115 PID 2668 wrote to memory of 4172 2668 inbqostfv.exe 116 PID 4172 wrote to memory of 4512 4172 insbquvhx.exe 117 PID 4512 wrote to memory of 4660 4512 inkbaivic.exe 118 PID 4660 wrote to memory of 2772 4660 inknedlyl.exe 119 PID 2772 wrote to memory of 3808 2772 inoavpdfe.exe 120 PID 3808 wrote to memory of 2384 3808 inrdysgih.exe 121 PID 2384 wrote to memory of 4960 2384 inbrulkss.exe 122 PID 4960 wrote to memory of 636 4960 ineuxonvv.exe 123 PID 636 wrote to memory of 2328 636 inykznpoh.exe 124 PID 2328 wrote to memory of 2248 2328 innqsrkjz.exe 125 PID 2248 wrote to memory of 3756 2248 inpsutmlb.exe 126 PID 3756 wrote to memory of 1188 3756 ineybxzdp.exe 127 PID 1188 wrote to memory of 680 1188 inbuxzyre.exe 128 PID 680 wrote to memory of 3484 680 inwhpwale.exe 129 PID 3484 wrote to memory of 4696 3484 inaikwkwh.exe 130 PID 4696 wrote to memory of 1096 4696 injhulmow.exe 131 PID 1096 wrote to memory of 4048 1096 injwnoaqy.exe 132 PID 4048 wrote to memory of 4556 4048 incrjzdkv.exe 133 PID 4556 wrote to memory of 2696 4556 infumgnyd.exe 134 PID 2696 wrote to memory of 4132 2696 intcrvwiy.exe 135 PID 4132 wrote to memory of 2028 4132 inyjbrycn.exe 136 PID 2028 wrote to memory of 4204 2028 inhwnltjf.exe 137 PID 4204 wrote to memory of 1936 4204 inogwahsa.exe 138 PID 1936 wrote to memory of 1772 1936 inadbobmd.exe 139 PID 1772 wrote to memory of 728 1772 inetlfmxc.exe 140 PID 728 wrote to memory of 1996 728 inpqffxwb.exe 141 PID 1996 wrote to memory of 1716 1996 inzloqpih.exe 142 PID 1716 wrote to memory of 1332 1716 intsuvkkg.exe 143 PID 1332 wrote to memory of 4492 1332 incwvxbyn.exe 144 PID 4492 wrote to memory of 2960 4492 indpalewk.exe 145 PID 2960 wrote to memory of 2956 2960 inhegsgsd.exe 146 PID 2956 wrote to memory of 2120 2956 inaexuhtj.exe 147 PID 2120 wrote to memory of 2712 2120 indhxkwmb.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_bef95474cb778f3d30927a51f569a31c_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe42⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe65⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe66⤵PID:1764
-
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe67⤵PID:2312
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe68⤵PID:2424
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe69⤵PID:2436
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe70⤵PID:4712
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe71⤵PID:2852
-
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe72⤵PID:968
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe73⤵PID:4996
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe74⤵PID:4432
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe75⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1496 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe76⤵PID:4128
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe77⤵PID:4180
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe78⤵
- System Location Discovery: System Language Discovery
PID:4384 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe79⤵PID:3296
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe80⤵PID:3504
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe81⤵PID:4744
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe82⤵PID:3420
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe83⤵PID:1668
-
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe84⤵PID:3760
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe85⤵PID:3524
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe86⤵PID:1052
-
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe87⤵PID:3380
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe88⤵PID:4212
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe89⤵PID:4380
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe90⤵PID:5084
-
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe91⤵PID:4292
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe92⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe93⤵PID:2476
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe94⤵
- Drops file in System32 directory
PID:2704 -
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe95⤵PID:3300
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe96⤵PID:3964
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe97⤵
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe98⤵PID:2504
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe99⤵PID:5104
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe100⤵PID:404
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe101⤵PID:5088
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe102⤵PID:3140
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe103⤵PID:1036
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe104⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3960 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe105⤵PID:1016
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe106⤵PID:868
-
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe107⤵PID:1636
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe108⤵PID:3748
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe109⤵PID:4752
-
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe110⤵PID:3788
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe111⤵PID:1816
-
C:\Windows\SysWOW64\inmflkmos.exeC:\Windows\system32\inmflkmos.exe112⤵PID:1364
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe113⤵PID:2660
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe114⤵PID:4708
-
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe115⤵PID:1912
-
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe116⤵PID:4444
-
C:\Windows\SysWOW64\infrfqjpo.exeC:\Windows\system32\infrfqjpo.exe117⤵PID:3980
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe118⤵PID:4564
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe119⤵PID:4032
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe120⤵PID:900
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe121⤵PID:3528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-