Analysis
- max time kernel
93s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 22:41
Behavioral task
behavioral1
Sample
2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe
- Size 1.9MB
- Sample261111-2me5vayx2k
- SHA256 bf374145bad5ad0cdd12ce1b428da21a7b1513f315186cbb424d20a0c75fb9fb
- MD5 b31174c8802f8ffdc070f1a1ff938f95
- SHA1 3d2b0699d56c18ed3a7e21da7f2ad25bf453c7c2
- SHA512 97a87952efc6aacf08cef3bbcb5bb0f1af2a58ef0e99477c3e96429bc6701b404c14818a41ecd438bf9f140621cca9ec129fb85e48d3425130ad0a1b5ca33336
- SSDEEP 24576:ouLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR5RNPjKoOwuLwoR5T:RPjOrPjOQPjOWPjOJPjOfPk
- TLSH T1AA95DF01BEE740F9EAE8003C20FB2776963B6998FB085FD36319EE755833555E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/4288-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c563-10.dat family_gh0strat behavioral2/files/0x000c00000001c567-22.dat family_gh0strat behavioral2/memory/4288-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c56d-42.dat family_gh0strat behavioral2/memory/1504-52-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c570-75.dat family_gh0strat behavioral2/memory/3596-74-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c574-96.dat family_gh0strat behavioral2/memory/5800-99-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c579-119.dat family_gh0strat behavioral2/memory/5396-124-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c57d-144.dat family_gh0strat behavioral2/memory/1792-148-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3404-172-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c597-287.dat family_gh0strat behavioral2/files/0x000c00000001c5a0-335.dat family_gh0strat behavioral2/files/0x000c00000001c5a9-384.dat family_gh0strat behavioral2/memory/4312-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4192-448-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5248-467-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2788-548-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3048-669-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4352-649-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2256-629-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1416-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5728-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1544-568-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4912-528-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5772-508-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4916-487-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2908-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5744-388-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3768-364-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5a4-360.dat family_gh0strat behavioral2/memory/2972-340-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1656-316-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c59b-312.dat family_gh0strat behavioral2/memory/5148-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3156-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c592-264.dat family_gh0strat behavioral2/memory/5816-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c58e-240.dat family_gh0strat behavioral2/memory/5500-220-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c58a-216.dat family_gh0strat behavioral2/memory/1252-196-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c585-192.dat family_gh0strat behavioral2/files/0x000c00000001c581-168.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49CE2AA3-472D-4779-A62F-D5CAD955C2E6} inbuxzyre.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6C9A9C4-8140-4d8a-9E98-2E3293F3EB14}\stubpath = "C:\\Windows\\system32\\inljyapnv.exe" inyjbrycn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E43F7523-DD99-431b-92C7-D9D3D92F4B84} inclwgwbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA8D4A38-4BB7-4526-84E3-2BB4A8BDBE09}\stubpath = "C:\\Windows\\system32\\ingrakqpr.exe" invmsakfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{361A8A2B-EB6B-475b-88F1-FC32493B47D2}\stubpath = "C:\\Windows\\system32\\inbfffozj.exe" inuhmcksg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CDD91450-546E-40ff-8B8B-F9FA0A8850B6}\stubpath = "C:\\Windows\\system32\\indxawycz.exe" inkzrlbas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{712B2B68-5AE0-4cdb-A36B-5B902861503E}\stubpath = "C:\\Windows\\system32\\inpbwqegf.exe" inxhvtpha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10643184-79B5-4ec0-82D1-07824F445D11}\stubpath = "C:\\Windows\\system32\\inycopaqa.exe" inyodrton.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{956BF1FD-30C5-483f-A8F0-72A0032DE3A5}\stubpath = "C:\\Windows\\system32\\iniszdhvx.exe" insuxuebv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FC60776-C88D-42e1-A50E-D6C119377AED} inyteppma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F07B22F-0AFF-4bf8-A3BD-E7EA99A2888E}\stubpath = "C:\\Windows\\system32\\inhwfuyzl.exe" inionprva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{039D22F3-7661-4f03-9447-6B0839111EA2}\stubpath = "C:\\Windows\\system32\\innusjmop.exe" intikurgv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59033732-A105-45b2-864F-55686DD337B3} intmsjkwc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C0ECB2F-4D61-455e-ACEC-D0406C37C5C2} inbsebpqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{830737D0-2AB7-408f-AD17-3CAFD924218D}\stubpath = "C:\\Windows\\system32\\inqtvunam.exe" inzloqpih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F9771BF-1DED-4ca7-91C2-38E5FB7F3FBE} inuydrpyf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9230E695-10ED-4331-A26C-9A6ABDDC4F87}\stubpath = "C:\\Windows\\system32\\inczeboin.exe" inblsqhkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D3793BC-424A-4110-8D97-59ED13198720} inxbftvlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14367BA0-650C-40d9-A16D-B765E8CDC777} injvkjzkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{587C9ED1-7911-4505-9DFC-711FB4DF035B} inxavmale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC564907-426C-48a2-A943-3537634457C6}\stubpath = "C:\\Windows\\system32\\ineamubie.exe" inzvnieka.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{830737D0-2AB7-408f-AD17-3CAFD924218D} inzloqpih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACC14816-C6B5-456f-9404-F81B99387A46} inqcxrfhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3C43A99-7FEF-47f7-A326-9FD65E84177F} injrhdzvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34F2990D-AF20-44e7-B342-C81A114056CD}\stubpath = "C:\\Windows\\system32\\intetdxsy.exe" inxitdtqe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72621672-AE76-43db-9532-2B7E7B930FA2} indrmgdxz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCE991A7-C726-4baa-848D-EF9E865525AB}\stubpath = "C:\\Windows\\system32\\invirzkie.exe" inmkimmxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB275B9D-C6FE-4e9b-9FB3-E3DB560DE471} inncprues.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FEF515FF-EC5C-4c27-AB25-07C30980D8F5} infpibkqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDB36C8E-503D-49b6-B6C3-0EFAB0C8DF7C} inhwfuyzl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1296CB6A-F8CC-4a32-96DB-D49D9EA7BD87} indeulkya.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C60C4ED7-DDE1-485a-8EC3-ED7B6A418E4F}\stubpath = "C:\\Windows\\system32\\inbdhuahl.exe" inmtiwity.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77D33072-008D-4f06-9EC2-56C0F4B74BF3} incbskfog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDFB7359-E596-4704-B7A0-57E3288A7B4D}\stubpath = "C:\\Windows\\system32\\inhrmfavc.exe" inuvkxzmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9A5ECA5-2214-4e02-8E5B-26CD2E2A1080}\stubpath = "C:\\Windows\\system32\\inxbftvlo.exe" intxmhybx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8FC705B-3C47-4f71-AD74-3EEAC3936CED}\stubpath = "C:\\Windows\\system32\\inrmslxzd.exe" infslrijv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21C02257-7105-471a-AACD-34EA23416951} inknhvqeu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26A3F630-C84A-4841-BA05-F68450AEE034} invirzkie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD43B281-3E6F-43f0-98D8-32CC57F6FAD7}\stubpath = "C:\\Windows\\system32\\intdzdpys.exe" intojzuff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CEF25B5-CE08-4b5c-B88B-4236A19F7080}\stubpath = "C:\\Windows\\system32\\inahuhbcs.exe" inecpcnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{279415A7-E531-4cbd-8114-8B2C5649557C} inbjwysrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F68AF958-83A3-4e81-8C1B-29A96B188C35} injyixbhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{361A8A2B-EB6B-475b-88F1-FC32493B47D2} inuhmcksg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69C6B7F0-D667-4bb8-BA40-B03E8BD9235C} inadbobmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68D9CE74-7263-44e8-9CA8-DAE7DA4E06B6} inokbwlsa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37EEAD6A-0947-44b5-8D13-27DBC6FCD022}\stubpath = "C:\\Windows\\system32\\inowmiavg.exe" inzprbebn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48BA0737-0288-48e9-99BF-A850375AC372}\stubpath = "C:\\Windows\\system32\\inkmhgrmq.exe" inwtyvsvp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28166F39-C97E-49ec-ABAF-891CDD5494E6}\stubpath = "C:\\Windows\\system32\\insvsctst.exe" inmhgesgy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B89D43D-5DFB-485c-AEDF-F66959E6AC5F} invuwaxma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{273968CB-18D8-4309-AFAC-4AE01B47A6EE}\stubpath = "C:\\Windows\\system32\\insaljfpw.exe" inbpxnjbw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8D4F497-4D8F-4c7d-B5D2-B04AD818945A} inctpigdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{468666BC-EB93-475b-B7E2-D94F89FB855E}\stubpath = "C:\\Windows\\system32\\inhiypoew.exe" inkbaivic.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE1A4848-F3D3-4be9-8E45-DC9834769D12} inxsdoolp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A7DFA4D-9BFF-456a-9154-F6574DE191CA} inniombtb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84E03DED-00EE-4a75-AE8C-5A252AA04395}\stubpath = "C:\\Windows\\system32\\inogxmhdp.exe" inpkuzhdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F15665C8-D4D7-4d81-BF3A-944DF72B8DF2}\stubpath = "C:\\Windows\\system32\\inbkobdgw.exe" inrfvkmdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51E5F617-A32B-4e7a-A7CD-33A0776937FB}\stubpath = "C:\\Windows\\system32\\innezovdr.exe" infjmomlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4044FF2D-77F7-4d6b-B8FB-C344FDC89F20}\stubpath = "C:\\Windows\\system32\\inqjwwyse.exe" inmlwcerc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13BB7064-BC5A-4744-B30D-8E0C62561B57}\stubpath = "C:\\Windows\\system32\\inmwmixdn.exe" inotqnqky.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A836EAB-83C9-4114-B2D3-B7BF0B878A27} inkuaczqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FA0E973-AF98-47d3-ADF0-6327747129A9}\stubpath = "C:\\Windows\\system32\\indtfhlye.exe" inqzaupvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AED9AFA-D6A2-488f-8111-83269F74E884} inymcufhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B582A7F-8ECB-450c-9DBF-E80EA0A1265E}\stubpath = "C:\\Windows\\system32\\infudswxj.exe" inapnrseu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71C3652C-DE5B-40d4-A83B-9FDD7E37D588}\stubpath = "C:\\Windows\\system32\\inrtkbsie.exe" indtyatrn.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000001138c-6.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1504 inqmfrmyb.exe 3596 inortslka.exe 5800 inldtepix.exe 5396 innfvgrkz.exe 1792 inykznpoh.exe 3404 inwhpwale.exe 1252 inutvwllh.exe 5500 inatwyxqd.exe 5816 inzloqpih.exe 3156 inqtvunam.exe 5148 ingvnhoze.exe 1656 injhulmow.exe 2972 inbuxzyre.exe 3768 inzkcszdo.exe 5744 inqcxrfhg.exe 2908 invhwkmle.exe 4312 inmeufqjy.exe 4192 inrdysgih.exe 5248 inbfyviuk.exe 4916 inogwahsa.exe 5772 intfuikjc.exe 4912 ingwzqpxx.exe 2788 intpaiupe.exe 1544 inyufnzuj.exe 5728 inlsmacbt.exe 1416 inyorihpp.exe 2256 indtwnmuu.exe 4352 inmprqjiy.exe 3048 inruwvobn.exe 5984 inzvgovkd.exe 1568 ingvzmksi.exe 4360 inazpsjiq.exe 4152 inaexuhtj.exe 2316 inertnmni.exe 696 invrckwrg.exe 1884 intcrvwiy.exe 1096 innuocedv.exe 2524 inqgdzfrf.exe 5868 inyjbrycn.exe 4624 inljyapnv.exe 5760 inugvjlkd.exe 2760 inmtnbdcu.exe 5184 inqklaasr.exe 2220 inwixlnmf.exe 1960 inixomukg.exe 1392 indskelwb.exe 2604 inixpjqgj.exe 1284 inaphxbit.exe 2540 infumgnyd.exe 4084 insrzztuj.exe 868 inuqbjvqf.exe 1772 insbquvhx.exe 5536 inknedlyl.exe 120 insvxwpco.exe 820 ineuxonvv.exe 5464 indtosnaj.exe 5180 incraptug.exe 5836 inrshhzyd.exe 4428 insohtodl.exe 2900 inxtemyti.exe 2912 inkzrlbas.exe 4140 indxawycz.exe 4412 infnwdvwr.exe 1776 inpleqlxa.exe - Loads dropped DLL 64 IoCs
pid Process 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe 1504 inqmfrmyb.exe 1504 inqmfrmyb.exe 3596 inortslka.exe 3596 inortslka.exe 5800 inldtepix.exe 5800 inldtepix.exe 5396 innfvgrkz.exe 5396 innfvgrkz.exe 1792 inykznpoh.exe 1792 inykznpoh.exe 3404 inwhpwale.exe 3404 inwhpwale.exe 1252 inutvwllh.exe 1252 inutvwllh.exe 5500 inatwyxqd.exe 5500 inatwyxqd.exe 5816 inzloqpih.exe 5816 inzloqpih.exe 3156 inqtvunam.exe 3156 inqtvunam.exe 5148 ingvnhoze.exe 5148 ingvnhoze.exe 1656 injhulmow.exe 1656 injhulmow.exe 2972 inbuxzyre.exe 2972 inbuxzyre.exe 3768 inzkcszdo.exe 3768 inzkcszdo.exe 5744 inqcxrfhg.exe 5744 inqcxrfhg.exe 2908 invhwkmle.exe 2908 invhwkmle.exe 4312 inmeufqjy.exe 4312 inmeufqjy.exe 4192 inrdysgih.exe 4192 inrdysgih.exe 5248 inbfyviuk.exe 5248 inbfyviuk.exe 4916 inogwahsa.exe 4916 inogwahsa.exe 5772 intfuikjc.exe 5772 intfuikjc.exe 4912 ingwzqpxx.exe 4912 ingwzqpxx.exe 2788 intpaiupe.exe 2788 intpaiupe.exe 1544 inyufnzuj.exe 1544 inyufnzuj.exe 5728 inlsmacbt.exe 5728 inlsmacbt.exe 1416 inyorihpp.exe 1416 inyorihpp.exe 2256 indtwnmuu.exe 2256 indtwnmuu.exe 4352 inmprqjiy.exe 4352 inmprqjiy.exe 3048 inruwvobn.exe 3048 inruwvobn.exe 5984 inzvgovkd.exe 5984 inzvgovkd.exe 1568 ingvzmksi.exe 1568 ingvzmksi.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inmtnbdcu.exe inugvjlkd.exe File created C:\Windows\SysWOW64\inpfzcyeq.exe infgwnmcy.exe File created C:\Windows\SysWOW64\inebdvara.exe inwbpkebv.exe File opened for modification C:\Windows\SysWOW64\ingyagyjp.exe_lang.ini infhfyusg.exe File created C:\Windows\SysWOW64\innwfcplb.exe inmwmixdn.exe File created C:\Windows\SysWOW64\infslrijv.exe inomzqrdt.exe File created C:\Windows\SysWOW64\intojzuff.exe inbmyhvlc.exe File opened for modification C:\Windows\SysWOW64\inwldhtuf.exe_lang.ini insvsctst.exe File opened for modification C:\Windows\SysWOW64\inkwblfyk.exe_lang.ini inxujybfr.exe File created C:\Windows\SysWOW64\inhxjlpig.exe innbxlquo.exe File opened for modification C:\Windows\SysWOW64\inlmnyysj.exe_lang.ini inwikshbc.exe File opened for modification C:\Windows\SysWOW64\inkjzlnrk.exe_lang.ini inebgydau.exe File opened for modification C:\Windows\SysWOW64\inyccnaan.exe_lang.ini inkxmjgli.exe File opened for modification C:\Windows\SysWOW64\inhqlgymf.exe_lang.ini inodazcuq.exe File opened for modification C:\Windows\SysWOW64\inniucjdf.exe_lang.ini inxzfxryi.exe File opened for modification C:\Windows\SysWOW64\intpaiupe.exe_lang.ini ingwzqpxx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inknedlyl.exe File created C:\Windows\SysWOW64\injwnoaqy.exe inocymrvp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbuzcxoc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbsfowhf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzfhvydh.exe File opened for modification C:\Windows\SysWOW64\inakrpgjz.exe_lang.ini inwuyycww.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuisngbw.exe File opened for modification C:\Windows\SysWOW64\intnjpska.exe_lang.ini injfiqaer.exe File opened for modification C:\Windows\SysWOW64\inadbobmd.exe_lang.ini inucuflpc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infyeupzm.exe File created C:\Windows\SysWOW64\inqqspmro.exe inijzqpfx.exe File opened for modification C:\Windows\SysWOW64\injhulmow.exe_lang.ini ingvnhoze.exe File opened for modification C:\Windows\SysWOW64\invudbffq.exe_lang.ini inbaqtkjr.exe File created C:\Windows\SysWOW64\inrkqhiua.exe inuhqyjhd.exe File created C:\Windows\SysWOW64\inknhvqeu.exe inudpxert.exe File opened for modification C:\Windows\SysWOW64\inujlcwuk.exe_lang.ini inuvxhdct.exe File created C:\Windows\SysWOW64\inyegtexf.exe inlisltat.exe File created C:\Windows\SysWOW64\inckekwln.exe inbxslgig.exe File opened for modification C:\Windows\SysWOW64\indryibnm.exe_lang.ini inzrcejxv.exe File created C:\Windows\SysWOW64\inhztqfaz.exe invkhejgd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inortslka.exe File opened for modification C:\Windows\SysWOW64\innfvgrkz.exe_lang.ini inldtepix.exe File opened for modification C:\Windows\SysWOW64\inxhvtpha.exe_lang.ini inrmslxzd.exe File created C:\Windows\SysWOW64\inspmpjxs.exe inofbieyd.exe File opened for modification C:\Windows\SysWOW64\infzicqlp.exe_lang.ini iniizepdz.exe File opened for modification C:\Windows\SysWOW64\inuisngbw.exe_lang.ini indnibrwr.exe File opened for modification C:\Windows\SysWOW64\indwbuqoc.exe_lang.ini inpljrdzf.exe File opened for modification C:\Windows\SysWOW64\inkuaczqt.exe_lang.ini infhthtec.exe File created C:\Windows\SysWOW64\insaljfpw.exe inbpxnjbw.exe File created C:\Windows\SysWOW64\inxitdtqe.exe ineugyxhj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuzplcxm.exe File created C:\Windows\SysWOW64\invwyxcqk.exe inthmqkqb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhegsgsd.exe File opened for modification C:\Windows\SysWOW64\ineugyxhj.exe_lang.ini indkgfezw.exe File opened for modification C:\Windows\SysWOW64\infmbpvbz.exe_lang.ini inkesnbrx.exe File opened for modification C:\Windows\SysWOW64\inaqgiwze.exe_lang.ini ingfvhjng.exe File created C:\Windows\SysWOW64\inqswbpnw.exe inrurbsrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intmsjkwc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insvsctst.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxavmale.exe File opened for modification C:\Windows\SysWOW64\infxsuasm.exe_lang.ini ingkycsra.exe File created C:\Windows\SysWOW64\inrurbsrs.exe intuwvzao.exe File created C:\Windows\SysWOW64\inyxynpgc.exe injfdlthy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjwysrs.exe File created C:\Windows\SysWOW64\inuwegjgs.exe inirmhzng.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intuwvzao.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inphclvql.exe File created C:\Windows\SysWOW64\invfrxfpk.exe iniaooxbd.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfkwncn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indskelwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpsutmlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvqbbup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwgusogd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkjzlnrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoioprby.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inshvhsxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intojzuff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoropope.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoyifzki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdbjsnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaphxbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inazpsjiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqnbrgit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtleici.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwbuqoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhpjpqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invaiaqlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzleble.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insbquvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsnrmiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrkqhiua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkivmnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvnhoze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insezthji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbwxiybi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpljrdzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inptcowdq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmsevrki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insaljfpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmktaxgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlisltat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxncqsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxuxrboe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaexuhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjwysrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infudswxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwskdhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inudpxert.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inauwohze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineuxonvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewhnrej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniizepdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infcwfnxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqklaasr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwezqep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwixlnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoeaukm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilftocs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztjzmib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inocokdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineugyxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inauxfdek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innfajbav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuvkxzmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniqjgqjr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe 1504 inqmfrmyb.exe 1504 inqmfrmyb.exe 3596 inortslka.exe 3596 inortslka.exe 5800 inldtepix.exe 5800 inldtepix.exe 5396 innfvgrkz.exe 5396 innfvgrkz.exe 1792 inykznpoh.exe 1792 inykznpoh.exe 3404 inwhpwale.exe 3404 inwhpwale.exe 1252 inutvwllh.exe 1252 inutvwllh.exe 5500 inatwyxqd.exe 5500 inatwyxqd.exe 5816 inzloqpih.exe 5816 inzloqpih.exe 3156 inqtvunam.exe 3156 inqtvunam.exe 5148 ingvnhoze.exe 5148 ingvnhoze.exe 1656 injhulmow.exe 1656 injhulmow.exe 2972 inbuxzyre.exe 2972 inbuxzyre.exe 3768 inzkcszdo.exe 3768 inzkcszdo.exe 5744 inqcxrfhg.exe 5744 inqcxrfhg.exe 2908 invhwkmle.exe 2908 invhwkmle.exe 4312 inmeufqjy.exe 4312 inmeufqjy.exe 4192 inrdysgih.exe 4192 inrdysgih.exe 5248 inbfyviuk.exe 5248 inbfyviuk.exe 4916 inogwahsa.exe 4916 inogwahsa.exe 5772 intfuikjc.exe 5772 intfuikjc.exe 4912 ingwzqpxx.exe 4912 ingwzqpxx.exe 2788 intpaiupe.exe 2788 intpaiupe.exe 1544 inyufnzuj.exe 1544 inyufnzuj.exe 5728 inlsmacbt.exe 5728 inlsmacbt.exe 1416 inyorihpp.exe 1416 inyorihpp.exe 2256 indtwnmuu.exe 2256 indtwnmuu.exe 4352 inmprqjiy.exe 4352 inmprqjiy.exe 3048 inruwvobn.exe 3048 inruwvobn.exe 5984 inzvgovkd.exe 5984 inzvgovkd.exe 1568 ingvzmksi.exe 1568 ingvzmksi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe Token: SeDebugPrivilege 1504 inqmfrmyb.exe Token: SeDebugPrivilege 3596 inortslka.exe Token: SeDebugPrivilege 5800 inldtepix.exe Token: SeDebugPrivilege 5396 innfvgrkz.exe Token: SeDebugPrivilege 1792 inykznpoh.exe Token: SeDebugPrivilege 3404 inwhpwale.exe Token: SeDebugPrivilege 1252 inutvwllh.exe Token: SeDebugPrivilege 5500 inatwyxqd.exe Token: SeDebugPrivilege 5816 inzloqpih.exe Token: SeDebugPrivilege 3156 inqtvunam.exe Token: SeDebugPrivilege 5148 ingvnhoze.exe Token: SeDebugPrivilege 1656 injhulmow.exe Token: SeDebugPrivilege 2972 inbuxzyre.exe Token: SeDebugPrivilege 3768 inzkcszdo.exe Token: SeDebugPrivilege 5744 inqcxrfhg.exe Token: SeDebugPrivilege 2908 invhwkmle.exe Token: SeDebugPrivilege 4312 inmeufqjy.exe Token: SeDebugPrivilege 4192 inrdysgih.exe Token: SeDebugPrivilege 5248 inbfyviuk.exe Token: SeDebugPrivilege 4916 inogwahsa.exe Token: SeDebugPrivilege 5772 intfuikjc.exe Token: SeDebugPrivilege 4912 ingwzqpxx.exe Token: SeDebugPrivilege 2788 intpaiupe.exe Token: SeDebugPrivilege 1544 inyufnzuj.exe Token: SeDebugPrivilege 5728 inlsmacbt.exe Token: SeDebugPrivilege 1416 inyorihpp.exe Token: SeDebugPrivilege 2256 indtwnmuu.exe Token: SeDebugPrivilege 4352 inmprqjiy.exe Token: SeDebugPrivilege 3048 inruwvobn.exe Token: SeDebugPrivilege 5984 inzvgovkd.exe Token: SeDebugPrivilege 1568 ingvzmksi.exe Token: SeDebugPrivilege 4360 inazpsjiq.exe Token: SeDebugPrivilege 4152 inaexuhtj.exe Token: SeDebugPrivilege 2316 inertnmni.exe Token: SeDebugPrivilege 696 invrckwrg.exe Token: SeDebugPrivilege 1884 intcrvwiy.exe Token: SeDebugPrivilege 1096 innuocedv.exe Token: SeDebugPrivilege 2524 inqgdzfrf.exe Token: SeDebugPrivilege 5868 inyjbrycn.exe Token: SeDebugPrivilege 4624 inljyapnv.exe Token: SeDebugPrivilege 5760 inugvjlkd.exe Token: SeDebugPrivilege 2760 inmtnbdcu.exe Token: SeDebugPrivilege 5184 inqklaasr.exe Token: SeDebugPrivilege 2220 inwixlnmf.exe Token: SeDebugPrivilege 1960 inixomukg.exe Token: SeDebugPrivilege 1392 indskelwb.exe Token: SeDebugPrivilege 2604 inixpjqgj.exe Token: SeDebugPrivilege 1284 inaphxbit.exe Token: SeDebugPrivilege 2540 infumgnyd.exe Token: SeDebugPrivilege 4084 insrzztuj.exe Token: SeDebugPrivilege 868 inuqbjvqf.exe Token: SeDebugPrivilege 1772 insbquvhx.exe Token: SeDebugPrivilege 5536 inknedlyl.exe Token: SeDebugPrivilege 120 insvxwpco.exe Token: SeDebugPrivilege 820 ineuxonvv.exe Token: SeDebugPrivilege 5464 indtosnaj.exe Token: SeDebugPrivilege 5180 incraptug.exe Token: SeDebugPrivilege 5836 inrshhzyd.exe Token: SeDebugPrivilege 4428 insohtodl.exe Token: SeDebugPrivilege 2900 inxtemyti.exe Token: SeDebugPrivilege 2912 inkzrlbas.exe Token: SeDebugPrivilege 4140 indxawycz.exe Token: SeDebugPrivilege 4412 infnwdvwr.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe 1504 inqmfrmyb.exe 3596 inortslka.exe 5800 inldtepix.exe 5396 innfvgrkz.exe 1792 inykznpoh.exe 3404 inwhpwale.exe 1252 inutvwllh.exe 5500 inatwyxqd.exe 5816 inzloqpih.exe 3156 inqtvunam.exe 5148 ingvnhoze.exe 1656 injhulmow.exe 2972 inbuxzyre.exe 3768 inzkcszdo.exe 5744 inqcxrfhg.exe 2908 invhwkmle.exe 4312 inmeufqjy.exe 4192 inrdysgih.exe 5248 inbfyviuk.exe 4916 inogwahsa.exe 5772 intfuikjc.exe 4912 ingwzqpxx.exe 2788 intpaiupe.exe 1544 inyufnzuj.exe 5728 inlsmacbt.exe 1416 inyorihpp.exe 2256 indtwnmuu.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4288 wrote to memory of 1504 4288 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe 88 PID 1504 wrote to memory of 3596 1504 inqmfrmyb.exe 89 PID 3596 wrote to memory of 5800 3596 inortslka.exe 90 PID 5800 wrote to memory of 5396 5800 inldtepix.exe 91 PID 5396 wrote to memory of 1792 5396 innfvgrkz.exe 92 PID 1792 wrote to memory of 3404 1792 inykznpoh.exe 93 PID 3404 wrote to memory of 1252 3404 inwhpwale.exe 94 PID 1252 wrote to memory of 5500 1252 inutvwllh.exe 95 PID 5500 wrote to memory of 5816 5500 inatwyxqd.exe 96 PID 5816 wrote to memory of 3156 5816 inzloqpih.exe 97 PID 3156 wrote to memory of 5148 3156 inqtvunam.exe 98 PID 5148 wrote to memory of 1656 5148 ingvnhoze.exe 99 PID 1656 wrote to memory of 2972 1656 injhulmow.exe 100 PID 2972 wrote to memory of 3768 2972 inbuxzyre.exe 101 PID 3768 wrote to memory of 5744 3768 inzkcszdo.exe 102 PID 5744 wrote to memory of 2908 5744 inqcxrfhg.exe 103 PID 2908 wrote to memory of 4312 2908 invhwkmle.exe 104 PID 4312 wrote to memory of 4192 4312 inmeufqjy.exe 105 PID 4192 wrote to memory of 5248 4192 inrdysgih.exe 106 PID 5248 wrote to memory of 4916 5248 inbfyviuk.exe 107 PID 4916 wrote to memory of 5772 4916 inogwahsa.exe 108 PID 5772 wrote to memory of 4912 5772 intfuikjc.exe 109 PID 4912 wrote to memory of 2788 4912 ingwzqpxx.exe 110 PID 2788 wrote to memory of 1544 2788 intpaiupe.exe 111 PID 1544 wrote to memory of 5728 1544 inyufnzuj.exe 112 PID 5728 wrote to memory of 1416 5728 inlsmacbt.exe 113 PID 1416 wrote to memory of 2256 1416 inyorihpp.exe 114 PID 2256 wrote to memory of 4352 2256 indtwnmuu.exe 115 PID 4352 wrote to memory of 3048 4352 inmprqjiy.exe 116 PID 3048 wrote to memory of 5984 3048 inruwvobn.exe 117 PID 5984 wrote to memory of 1568 5984 inzvgovkd.exe 118 PID 1568 wrote to memory of 4360 1568 ingvzmksi.exe 119 PID 4360 wrote to memory of 4152 4360 inazpsjiq.exe 120 PID 4152 wrote to memory of 2316 4152 inaexuhtj.exe 121 PID 2316 wrote to memory of 696 2316 inertnmni.exe 122 PID 696 wrote to memory of 1884 696 invrckwrg.exe 123 PID 1884 wrote to memory of 1096 1884 intcrvwiy.exe 124 PID 1096 wrote to memory of 2524 1096 innuocedv.exe 125 PID 2524 wrote to memory of 5868 2524 inqgdzfrf.exe 126 PID 5868 wrote to memory of 4624 5868 inyjbrycn.exe 127 PID 4624 wrote to memory of 5760 4624 inljyapnv.exe 128 PID 5760 wrote to memory of 2760 5760 inugvjlkd.exe 129 PID 2760 wrote to memory of 5184 2760 inmtnbdcu.exe 130 PID 5184 wrote to memory of 2220 5184 inqklaasr.exe 131 PID 2220 wrote to memory of 1960 2220 inwixlnmf.exe 132 PID 1960 wrote to memory of 1392 1960 inixomukg.exe 133 PID 1392 wrote to memory of 2604 1392 indskelwb.exe 134 PID 2604 wrote to memory of 1284 2604 inixpjqgj.exe 135 PID 1284 wrote to memory of 2540 1284 inaphxbit.exe 136 PID 2540 wrote to memory of 4084 2540 infumgnyd.exe 137 PID 4084 wrote to memory of 868 4084 insrzztuj.exe 138 PID 868 wrote to memory of 1772 868 inuqbjvqf.exe 139 PID 1772 wrote to memory of 5536 1772 insbquvhx.exe 140 PID 5536 wrote to memory of 120 5536 inknedlyl.exe 141 PID 120 wrote to memory of 820 120 insvxwpco.exe 142 PID 820 wrote to memory of 5464 820 ineuxonvv.exe 143 PID 5464 wrote to memory of 5180 5464 indtosnaj.exe 144 PID 5180 wrote to memory of 5836 5180 incraptug.exe 145 PID 5836 wrote to memory of 4428 5836 inrshhzyd.exe 146 PID 4428 wrote to memory of 2900 4428 insohtodl.exe 147 PID 2900 wrote to memory of 2912 2900 inxtemyti.exe 148 PID 2912 wrote to memory of 4140 2912 inkzrlbas.exe 149 PID 4140 wrote to memory of 4412 4140 indxawycz.exe 150 PID 4412 wrote to memory of 1776 4412 infnwdvwr.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe16⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe40⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe62⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe65⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe66⤵PID:2792
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe67⤵PID:5904
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe68⤵PID:5964
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe69⤵PID:4952
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe70⤵PID:5288
-
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe71⤵
- System Location Discovery: System Language Discovery
PID:3352 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe72⤵PID:4616
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe73⤵PID:2004
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe74⤵PID:4556
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe75⤵PID:2772
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe76⤵PID:2080
-
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe77⤵PID:5520
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe78⤵PID:3672
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe79⤵PID:4896
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe80⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2212 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe81⤵PID:4308
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe82⤵PID:2204
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe83⤵PID:1484
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe84⤵PID:1072
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe85⤵PID:4432
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe86⤵PID:3224
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe87⤵PID:4588
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe88⤵PID:3124
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe89⤵PID:3396
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe90⤵PID:2424
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe91⤵PID:2976
-
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe92⤵
- Drops file in System32 directory
PID:5076 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe93⤵PID:4544
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe94⤵PID:5724
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe95⤵
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe96⤵PID:896
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe97⤵PID:1304
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe98⤵PID:3796
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe99⤵PID:3680
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe100⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4388 -
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe101⤵PID:4300
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe102⤵PID:3424
-
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe103⤵
- System Location Discovery: System Language Discovery
PID:2516 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe104⤵PID:5876
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe105⤵
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe106⤵PID:1236
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe107⤵PID:924
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe108⤵PID:5280
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe109⤵PID:4956
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe110⤵PID:2068
-
C:\Windows\SysWOW64\inwemzvcu.exeC:\Windows\system32\inwemzvcu.exe111⤵PID:4948
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe112⤵PID:3940
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe113⤵PID:2840
-
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe114⤵PID:608
-
C:\Windows\SysWOW64\inrhnxdft.exeC:\Windows\system32\inrhnxdft.exe115⤵
- System Location Discovery: System Language Discovery
PID:2548 -
C:\Windows\SysWOW64\inuinrlrc.exeC:\Windows\system32\inuinrlrc.exe116⤵PID:1028
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe117⤵
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe118⤵PID:2464
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe119⤵PID:2884
-
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\system32\inyteppma.exe120⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2768 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe121⤵PID:6076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-