Analysis
- max time kernel
97s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 22:54
Behavioral task
behavioral1
Sample
2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe
- Size 1.9MB
- Sample261111-2v13aacv6s
- SHA256 1b5919d67f242e95fc17dd73d1fe73d5873e6495c8aa9d8b2d07b7e94224fde6
- MD5 b0962713d0e4fdbe34802e17d7841280
- SHA1 8416ce43a338556fbee8e46e08a365eb852aac9f
- SHA512 accf8b980843bfa86ef222dc4117adff5959f5fbbc00e5a41b68d81879ee5ceb522e829a4594c66271cf2588c6527ccfb2adb733739c8036ab4e88c7378bdc1f
- SSDEEP 24576:ouLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR5RNPjKoOwuLwoR5E:RPjOrPjOQPjOWPjOJPjOfPD
- TLSH T1FF95DF01BEE740F9EAE8003C20FB2776963B6998FB085FD36319EE755833555E632246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/2772-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c553-13.dat family_gh0strat behavioral2/memory/2772-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c557-22.dat family_gh0strat behavioral2/files/0x000d00000001c55d-40.dat family_gh0strat behavioral2/memory/4864-50-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c561-71.dat family_gh0strat behavioral2/files/0x000d00000001c570-95.dat family_gh0strat behavioral2/memory/4240-99-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3800-124-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4460-148-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c57c-167.dat family_gh0strat behavioral2/files/0x000d00000001c584-215.dat family_gh0strat behavioral2/files/0x000d00000001c588-240.dat family_gh0strat behavioral2/memory/4100-467-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2600-668-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3820-648-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5676-628-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1204-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4104-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4276-568-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4140-548-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4908-528-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3944-508-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4912-487-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2740-448-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4508-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4520-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5852-388-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5a0-384.dat family_gh0strat behavioral2/memory/2120-364-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c59c-360.dat family_gh0strat behavioral2/memory/3444-340-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c598-336.dat family_gh0strat behavioral2/memory/5728-316-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c594-312.dat family_gh0strat behavioral2/memory/5932-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c590-288.dat family_gh0strat behavioral2/memory/5516-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c58c-264.dat family_gh0strat behavioral2/memory/2728-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3776-220-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1920-196-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c580-192.dat family_gh0strat behavioral2/memory/1524-172-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c578-144.dat family_gh0strat behavioral2/files/0x000d00000001c574-120.dat family_gh0strat behavioral2/memory/3220-113-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4864-74-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D55BB1E9-F51B-4596-BD55-4390E7BE3588}\stubpath = "C:\\Windows\\system32\\insvsctst.exe" invudbffq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0D300E8-EDCD-48ad-A069-2E6D60217048} inaiqezai.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC9F3E4C-8AA4-400d-AA95-E091986ED193} infyeupzm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{121E2FE2-D82A-4c6e-9AF3-9C7EE9A52057}\stubpath = "C:\\Windows\\system32\\inqswbpnw.exe" inkjzlnrk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C8A741B-6938-466a-B3E7-76BD3649FDFB}\stubpath = "C:\\Windows\\system32\\inamdunku.exe" inrgfvgik.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B099BE0C-516C-4def-8FAC-99C5578CE652} inewhnrej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7C19CE4-EE25-48dc-89F2-C1DFB4A4B9FF}\stubpath = "C:\\Windows\\system32\\infumgnyd.exe" inulkzdji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA5D723B-9A6E-4dc9-9C71-A532CE890750} ineugyxhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B66E12A4-531B-4f38-987F-038443A20312} invpovkyk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2861F81F-67FD-45f0-AB66-1A345D8777CF}\stubpath = "C:\\Windows\\system32\\incbrcegj.exe" infrfqjpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF751DA4-50FB-40f4-84DC-F810012711B5}\stubpath = "C:\\Windows\\system32\\infjxbrqx.exe" inpwglkgm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B92BA0E3-F72B-44b4-B004-E78F7CAA8966}\stubpath = "C:\\Windows\\system32\\ingvnhoze.exe" inoavpdfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE307542-B267-4185-A70A-9F039DF3F76B} inwgusogd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC709D48-5E5F-4aa4-A2D1-61847FB7151B} inupalliz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{208AAC7F-8083-425e-8701-B1BA61A01C72}\stubpath = "C:\\Windows\\system32\\inortslka.exe" ingtgabri.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43BDD7DE-3362-4fa5-8898-C3485633BB4E} innlypqcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4DBEC06-19AE-4b99-AD66-3812F24F9BFC}\stubpath = "C:\\Windows\\system32\\inuloqrtx.exe" inmhxsddw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C26683BC-910F-482c-9310-7733D418B288} infnxzhjm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81A6036D-25AC-45b2-9AE0-2C0856D05E5B}\stubpath = "C:\\Windows\\system32\\inmtiwity.exe" inivlaoql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C54C8A4D-30B1-41ff-9588-BB1323881632}\stubpath = "C:\\Windows\\system32\\injwnoaqy.exe" indwztgsi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F86D801-0E5B-40de-9E6B-F2941B71B6F3} instvzuyn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91B27A83-CF4D-4d00-96B4-22E12A6B3B41}\stubpath = "C:\\Windows\\system32\\innhouwkt.exe" inivxkbyw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30B63177-D367-4244-9E3F-5388B47F668A}\stubpath = "C:\\Windows\\system32\\intfwsljg.exe" inhxamofz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50ED5773-7EC0-4cdd-8BA9-3375B5FC098E}\stubpath = "C:\\Windows\\system32\\indaxahla.exe" inqbcmcsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71B71A96-B2FA-4188-90F4-C2CA980FEB00}\stubpath = "C:\\Windows\\system32\\indeoeuxa.exe" inirveqyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22563DD8-6448-44b2-953B-A5EA22D75006} inftrnfcc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91BFDCA8-5BDE-47dd-8375-84DC4EA64AE3} inakrpgjz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A00ED010-06E7-4d8f-BAC2-442BE6CF3E4A}\stubpath = "C:\\Windows\\system32\\inmkimmxk.exe" inytozkkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C6CDFB4-BB84-4b17-B778-6293C11FEBFA}\stubpath = "C:\\Windows\\system32\\inhgncqwc.exe" invqmdynu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5593BEFE-4DE7-4e60-84F8-1A2F8B5B4D3E} inlvjosms.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{998FC15C-E46D-4031-9F15-02EA60F16E91} inbmmjnwc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5CDF8D0-8EF9-4df1-BF1C-01FDE5565F91} inixpjqgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A137349F-8B75-4dfe-B974-5FCF02234E59} inrngsnzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C018F4F-F267-475b-9F34-2463C0F54E40} innrmsqfx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA209067-376F-4b54-A76D-F211D84F179B}\stubpath = "C:\\Windows\\system32\\inltanpsp.exe" inniucjdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1AD77CA-464C-4cd0-BE03-01E3A268D66F} inqswbpnw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91A847E5-F29D-4d09-8EF6-B757368A40B1}\stubpath = "C:\\Windows\\system32\\ingvzmksi.exe" incsvmltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1CF38F8-DFD2-4ddc-8C48-35113E4F8EA0} innqsrkjz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BD22EEB-FB6D-4d70-AFCD-F1DEB109E3FC}\stubpath = "C:\\Windows\\system32\\inuytzxmg.exe" inadbobmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1428221F-FD22-4f64-9252-A458C6225768} inergdafx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09166459-34B0-4877-BCC5-ADD1CCEB727E}\stubpath = "C:\\Windows\\system32\\inhvtxxbv.exe" inadlmaxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{691EC465-FFF2-40ea-B185-C6DA5882C37C} iniqjgqjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD617D88-2FAD-4a13-8C13-6EEE1AD4A1F7}\stubpath = "C:\\Windows\\system32\\indwztgsi.exe" insohtodl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D166D89-AF58-4b78-ADD1-87AAA486CC9C}\stubpath = "C:\\Windows\\system32\\inmibthrw.exe" inhsblrqs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B118935E-7686-4457-8CEB-32953F25F605} inooxsntm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EB992A62-48C7-4311-B7E9-860685BCBC2C}\stubpath = "C:\\Windows\\system32\\inaaajueu.exe" inlcfvhzy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2D1BC98-B0FA-4ddc-8822-E654D782EF7C} inzhpyfbx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{726F89CE-7AF9-4f8e-B9A7-093B3848D00B}\stubpath = "C:\\Windows\\system32\\inkmpmynm.exe" inlmosntr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BC89754-9001-46ee-8FAA-7B39576C5D9D} invgvfzue.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9265CD6A-C19E-48ec-B1DE-DECDA175D275} invhwkmle.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D6E4CE1-69A8-40b3-B4C0-8863E4B1AEDF} inykznpoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FCFFF8A-ADEA-4cd1-9419-F84BD98BB5AC}\stubpath = "C:\\Windows\\system32\\ineybxzdp.exe" ingwzqpxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D498032-0F72-42da-9B5B-3ADF602E92A1}\stubpath = "C:\\Windows\\system32\\inhbuwzwg.exe" inigkkvii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A9432FF-BB4A-43de-BF5C-900F7B50C89E}\stubpath = "C:\\Windows\\system32\\inzjlpkqo.exe" incajnuiq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FECB58D0-84B4-4754-A9F9-4EBA665FEAB0} innoaemue.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2694D12E-8D9C-4016-9B36-201C4BF17715} inxrycagn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38A5C0A4-0401-41c1-817D-A78C89077012}\stubpath = "C:\\Windows\\system32\\inrfvkmdx.exe" intmsjkwc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34081A67-3C4D-41af-ACC0-7E30EFD91BF7}\stubpath = "C:\\Windows\\system32\\inknhvqeu.exe" inwikohfo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA9AE2AA-99D9-4ff9-8C0F-74F68B2A7A2D} inmeufqjy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{241B2510-8DC6-4f8b-9F03-BD58C443F95A} inhgwhjlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E40FF6BE-9650-46c5-AECC-3631EB6CB34F}\stubpath = "C:\\Windows\\system32\\inmnccutj.exe" ineupaato.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8948B66-0222-45ad-A10C-AB8615C22D23}\stubpath = "C:\\Windows\\system32\\inhjvjvge.exe" inhticvxx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BD16A2-38EC-4c0a-B01F-83606619BEC2} inrxixhwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A80D85E-322C-43d9-A43B-3EC003CBE3B2} inpdimgmm.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000019c9f-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3220 inqtvunam.exe 4864 inoavpdfe.exe 4240 ingvnhoze.exe 3800 insohtodl.exe 4460 indwztgsi.exe 1524 injwnoaqy.exe 1920 inzvgovkd.exe 3776 inmtnbdcu.exe 2728 inhfsfaqh.exe 5516 inpsutmlb.exe 5932 inaexuhtj.exe 5728 ingtvpopk.exe 3444 invhwkmle.exe 2120 inknedlyl.exe 5852 inatwyxqd.exe 4520 injyqkarh.exe 4508 inbqiycju.exe 2740 inxiaqxbm.exe 4100 inwmpgfnn.exe 4912 indtwnmuu.exe 3944 inqmfrmyb.exe 4908 insezthji.exe 4140 infgwnmcy.exe 4276 inxtemyti.exe 4104 inzloqpih.exe 1204 incanalcr.exe 5676 ingiuiufd.exe 3820 inhiypoew.exe 2600 intfuikjc.exe 1992 inzkcszdo.exe 4596 inruwvobn.exe 5132 inwhpwale.exe 1316 infvqbbup.exe 6028 inugvjlkd.exe 1480 inldtepix.exe 4932 inrdysgih.exe 1088 inqjpgzht.exe 2556 invuwaxma.exe 2856 inwgusogd.exe 3096 inmeufqjy.exe 4144 inbuxzyre.exe 6104 inmprqjiy.exe 1280 incsvmltt.exe 2284 ingvzmksi.exe 4856 inwsdlxsh.exe 6020 infhthtec.exe 3032 inclzteci.exe 3408 inetlfmxc.exe 1540 inpleqlxa.exe 2012 inazpsjiq.exe 3376 inhsblrqs.exe 3428 inmibthrw.exe 4808 inopeewva.exe 2352 injhulmow.exe 1284 indxawycz.exe 4820 inpiofygs.exe 4112 inhwnltjf.exe 1432 infdqdofu.exe 5128 inumafjdj.exe 4116 inqklaasr.exe 2548 inwixlnmf.exe 5036 inochlfll.exe 1568 indskelwb.exe 2328 inixpjqgj.exe - Loads dropped DLL 64 IoCs
pid Process 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe 3220 inqtvunam.exe 3220 inqtvunam.exe 4864 inoavpdfe.exe 4864 inoavpdfe.exe 4240 ingvnhoze.exe 4240 ingvnhoze.exe 3800 insohtodl.exe 3800 insohtodl.exe 4460 indwztgsi.exe 4460 indwztgsi.exe 1524 injwnoaqy.exe 1524 injwnoaqy.exe 1920 inzvgovkd.exe 1920 inzvgovkd.exe 3776 inmtnbdcu.exe 3776 inmtnbdcu.exe 2728 inhfsfaqh.exe 2728 inhfsfaqh.exe 5516 inpsutmlb.exe 5516 inpsutmlb.exe 5932 inaexuhtj.exe 5932 inaexuhtj.exe 5728 ingtvpopk.exe 5728 ingtvpopk.exe 3444 invhwkmle.exe 3444 invhwkmle.exe 2120 inknedlyl.exe 2120 inknedlyl.exe 5852 inatwyxqd.exe 5852 inatwyxqd.exe 4520 injyqkarh.exe 4520 injyqkarh.exe 4508 inbqiycju.exe 4508 inbqiycju.exe 2740 inxiaqxbm.exe 2740 inxiaqxbm.exe 4100 inwmpgfnn.exe 4100 inwmpgfnn.exe 4912 indtwnmuu.exe 4912 indtwnmuu.exe 3944 inqmfrmyb.exe 3944 inqmfrmyb.exe 4908 insezthji.exe 4908 insezthji.exe 4140 infgwnmcy.exe 4140 infgwnmcy.exe 4276 inxtemyti.exe 4276 inxtemyti.exe 4104 inzloqpih.exe 4104 inzloqpih.exe 1204 incanalcr.exe 1204 incanalcr.exe 5676 ingiuiufd.exe 5676 ingiuiufd.exe 3820 inhiypoew.exe 3820 inhiypoew.exe 2600 intfuikjc.exe 2600 intfuikjc.exe 1992 inzkcszdo.exe 1992 inzkcszdo.exe 4596 inruwvobn.exe 4596 inruwvobn.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inmtnbdcu.exe inzvgovkd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inquussur.exe File opened for modification C:\Windows\SysWOW64\inutvwllh.exe_lang.ini intcrvwiy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infnxzhjm.exe File opened for modification C:\Windows\SysWOW64\inpdimgmm.exe_lang.ini inmvbdomc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrtkbsie.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmfbghny.exe File created C:\Windows\SysWOW64\inirmhzng.exe inimbeutc.exe File opened for modification C:\Windows\SysWOW64\inaqceivb.exe_lang.ini innvfndjn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injrhdzvq.exe File opened for modification C:\Windows\SysWOW64\infzzbyva.exe_lang.ini inbkobdgw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invecggre.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkwblfyk.exe File opened for modification C:\Windows\SysWOW64\ineguxzcg.exe_lang.ini inclpwksm.exe File created C:\Windows\SysWOW64\inbqostfv.exe inmqlrpew.exe File opened for modification C:\Windows\SysWOW64\injkrqgyq.exe_lang.ini inlsmacbt.exe File opened for modification C:\Windows\SysWOW64\infslrijv.exe_lang.ini inbrulkss.exe File created C:\Windows\SysWOW64\inlmosntr.exe inwskdhbh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpleqlxa.exe File created C:\Windows\SysWOW64\inmlwcerc.exe inqdhyock.exe File created C:\Windows\SysWOW64\injwbpnkv.exe injlxlxig.exe File created C:\Windows\SysWOW64\infmbpvbz.exe injwbpnkv.exe File opened for modification C:\Windows\SysWOW64\infxiosfk.exe_lang.ini inbhrywnq.exe File opened for modification C:\Windows\SysWOW64\ingvnhoze.exe_lang.ini inoavpdfe.exe File opened for modification C:\Windows\SysWOW64\inupeyqpk.exe_lang.ini inxcfnkrc.exe File created C:\Windows\SysWOW64\inujqmuoe.exe iniszdhvx.exe File created C:\Windows\SysWOW64\inhwoipfi.exe incrjzdkv.exe File created C:\Windows\SysWOW64\ineybxzdp.exe ingwzqpxx.exe File opened for modification C:\Windows\SysWOW64\inkmpnlpp.exe_lang.ini inniombtb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innoaemue.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inctpigdo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insfkvqkr.exe File opened for modification C:\Windows\SysWOW64\inupalliz.exe_lang.ini inocokdvj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhgwhjlo.exe File created C:\Windows\SysWOW64\inpdimgmm.exe inmvbdomc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inczogbkc.exe File opened for modification C:\Windows\SysWOW64\infzicqlp.exe_lang.ini inquussur.exe File opened for modification C:\Windows\SysWOW64\inyteppma.exe_lang.ini inzajppij.exe File opened for modification C:\Windows\SysWOW64\inldtepix.exe_lang.ini inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\ingwzqpxx.exe_lang.ini inesqmezb.exe File opened for modification C:\Windows\SysWOW64\inrqyysti.exe_lang.ini inpbwqegf.exe File opened for modification C:\Windows\SysWOW64\inipelkjl.exe_lang.ini inthmqkqb.exe File created C:\Windows\SysWOW64\inblsqhkm.exe inrxixhwa.exe File created C:\Windows\SysWOW64\inhqlgymf.exe indzyzoqh.exe File created C:\Windows\SysWOW64\inbqiycju.exe injyqkarh.exe File opened for modification C:\Windows\SysWOW64\inpleqlxa.exe_lang.ini inetlfmxc.exe File opened for modification C:\Windows\SysWOW64\inxtleici.exe_lang.ini inmnccutj.exe File created C:\Windows\SysWOW64\inbdhuahl.exe intfwsljg.exe File opened for modification C:\Windows\SysWOW64\inctckufj.exe_lang.ini infjxbrqx.exe File opened for modification C:\Windows\SysWOW64\insezthji.exe_lang.ini inqmfrmyb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inigkkvii.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inebgydau.exe File created C:\Windows\SysWOW64\invakwebu.exe injrhdzvq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqdmufdj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invpovkyk.exe File opened for modification C:\Windows\SysWOW64\inzyhfjju.exe_lang.ini inqswbpnw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhzrfkoi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingvfeugi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inebdvara.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingtjmoji.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inspmpjxs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infjxbrqx.exe File created C:\Windows\SysWOW64\incraptug.exe inxuxrboe.exe File created C:\Windows\SysWOW64\innsieqyf.exe iniqjgqjr.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegrpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbrcegj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqgyjlgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkfxleq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuqbjvqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilcbjwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclpwksm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrgfvgik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuxzyre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhsblrqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpiofygs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infsuonoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inawcknai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhjvjvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxcfnkrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomzqrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlsmacbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrkqhiua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzhpyfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invkhejgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inadlmaxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhhujgdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insfkvqkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuiybnpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpdimgmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indaxahla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyaereiz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnwdvwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inblsqhkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incepndjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisglpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmrxryds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insaljfpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insjarhdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwskdhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniucjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbrocsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inamdunku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkvggzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhxamofz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhztqfaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqgdzfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaivxrqr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfnbzwf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrlmbbts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoaemue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtixaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intxcqoxe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtdautu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inorbpnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbkobdgw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzzbyva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwrmkgem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injausioy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invuwaxma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe 3220 inqtvunam.exe 3220 inqtvunam.exe 4864 inoavpdfe.exe 4864 inoavpdfe.exe 4240 ingvnhoze.exe 4240 ingvnhoze.exe 3800 insohtodl.exe 3800 insohtodl.exe 4460 indwztgsi.exe 4460 indwztgsi.exe 1524 injwnoaqy.exe 1524 injwnoaqy.exe 1920 inzvgovkd.exe 1920 inzvgovkd.exe 3776 inmtnbdcu.exe 3776 inmtnbdcu.exe 2728 inhfsfaqh.exe 2728 inhfsfaqh.exe 5516 inpsutmlb.exe 5516 inpsutmlb.exe 5932 inaexuhtj.exe 5932 inaexuhtj.exe 5728 ingtvpopk.exe 5728 ingtvpopk.exe 3444 invhwkmle.exe 3444 invhwkmle.exe 2120 inknedlyl.exe 2120 inknedlyl.exe 5852 inatwyxqd.exe 5852 inatwyxqd.exe 4520 injyqkarh.exe 4520 injyqkarh.exe 4508 inbqiycju.exe 4508 inbqiycju.exe 2740 inxiaqxbm.exe 2740 inxiaqxbm.exe 4100 inwmpgfnn.exe 4100 inwmpgfnn.exe 4912 indtwnmuu.exe 4912 indtwnmuu.exe 3944 inqmfrmyb.exe 3944 inqmfrmyb.exe 4908 insezthji.exe 4908 insezthji.exe 4140 infgwnmcy.exe 4140 infgwnmcy.exe 4276 inxtemyti.exe 4276 inxtemyti.exe 4104 inzloqpih.exe 4104 inzloqpih.exe 1204 incanalcr.exe 1204 incanalcr.exe 5676 ingiuiufd.exe 5676 ingiuiufd.exe 3820 inhiypoew.exe 3820 inhiypoew.exe 2600 intfuikjc.exe 2600 intfuikjc.exe 1992 inzkcszdo.exe 1992 inzkcszdo.exe 4596 inruwvobn.exe 4596 inruwvobn.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe Token: SeDebugPrivilege 3220 inqtvunam.exe Token: SeDebugPrivilege 4864 inoavpdfe.exe Token: SeDebugPrivilege 4240 ingvnhoze.exe Token: SeDebugPrivilege 3800 insohtodl.exe Token: SeDebugPrivilege 4460 indwztgsi.exe Token: SeDebugPrivilege 1524 injwnoaqy.exe Token: SeDebugPrivilege 1920 inzvgovkd.exe Token: SeDebugPrivilege 3776 inmtnbdcu.exe Token: SeDebugPrivilege 2728 inhfsfaqh.exe Token: SeDebugPrivilege 5516 inpsutmlb.exe Token: SeDebugPrivilege 5932 inaexuhtj.exe Token: SeDebugPrivilege 5728 ingtvpopk.exe Token: SeDebugPrivilege 3444 invhwkmle.exe Token: SeDebugPrivilege 2120 inknedlyl.exe Token: SeDebugPrivilege 5852 inatwyxqd.exe Token: SeDebugPrivilege 4520 injyqkarh.exe Token: SeDebugPrivilege 4508 inbqiycju.exe Token: SeDebugPrivilege 2740 inxiaqxbm.exe Token: SeDebugPrivilege 4100 inwmpgfnn.exe Token: SeDebugPrivilege 4912 indtwnmuu.exe Token: SeDebugPrivilege 3944 inqmfrmyb.exe Token: SeDebugPrivilege 4908 insezthji.exe Token: SeDebugPrivilege 4140 infgwnmcy.exe Token: SeDebugPrivilege 4276 inxtemyti.exe Token: SeDebugPrivilege 4104 inzloqpih.exe Token: SeDebugPrivilege 1204 incanalcr.exe Token: SeDebugPrivilege 5676 ingiuiufd.exe Token: SeDebugPrivilege 3820 inhiypoew.exe Token: SeDebugPrivilege 2600 intfuikjc.exe Token: SeDebugPrivilege 1992 inzkcszdo.exe Token: SeDebugPrivilege 4596 inruwvobn.exe Token: SeDebugPrivilege 5132 inwhpwale.exe Token: SeDebugPrivilege 1316 infvqbbup.exe Token: SeDebugPrivilege 6028 inugvjlkd.exe Token: SeDebugPrivilege 1480 inldtepix.exe Token: SeDebugPrivilege 4932 inrdysgih.exe Token: SeDebugPrivilege 1088 inqjpgzht.exe Token: SeDebugPrivilege 2556 invuwaxma.exe Token: SeDebugPrivilege 2856 inwgusogd.exe Token: SeDebugPrivilege 3096 inmeufqjy.exe Token: SeDebugPrivilege 4144 inbuxzyre.exe Token: SeDebugPrivilege 6104 inmprqjiy.exe Token: SeDebugPrivilege 1280 incsvmltt.exe Token: SeDebugPrivilege 2284 ingvzmksi.exe Token: SeDebugPrivilege 4856 inwsdlxsh.exe Token: SeDebugPrivilege 6020 infhthtec.exe Token: SeDebugPrivilege 3032 inclzteci.exe Token: SeDebugPrivilege 3408 inetlfmxc.exe Token: SeDebugPrivilege 1540 inpleqlxa.exe Token: SeDebugPrivilege 2012 inazpsjiq.exe Token: SeDebugPrivilege 3376 inhsblrqs.exe Token: SeDebugPrivilege 3428 inmibthrw.exe Token: SeDebugPrivilege 4808 inopeewva.exe Token: SeDebugPrivilege 2352 injhulmow.exe Token: SeDebugPrivilege 1284 indxawycz.exe Token: SeDebugPrivilege 4820 inpiofygs.exe Token: SeDebugPrivilege 4112 inhwnltjf.exe Token: SeDebugPrivilege 1432 infdqdofu.exe Token: SeDebugPrivilege 5128 inumafjdj.exe Token: SeDebugPrivilege 4116 inqklaasr.exe Token: SeDebugPrivilege 2548 inwixlnmf.exe Token: SeDebugPrivilege 5036 inochlfll.exe Token: SeDebugPrivilege 1568 indskelwb.exe - Suspicious use of SetWindowsHookEx 27 IoCs
pid Process 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe 3220 inqtvunam.exe 4864 inoavpdfe.exe 4240 ingvnhoze.exe 3800 insohtodl.exe 4460 indwztgsi.exe 1524 injwnoaqy.exe 1920 inzvgovkd.exe 3776 inmtnbdcu.exe 2728 inhfsfaqh.exe 5516 inpsutmlb.exe 5932 inaexuhtj.exe 5728 ingtvpopk.exe 3444 invhwkmle.exe 2120 inknedlyl.exe 5852 inatwyxqd.exe 4520 injyqkarh.exe 4508 inbqiycju.exe 2740 inxiaqxbm.exe 4100 inwmpgfnn.exe 4912 indtwnmuu.exe 3944 inqmfrmyb.exe 4908 insezthji.exe 4140 infgwnmcy.exe 4276 inxtemyti.exe 4104 inzloqpih.exe 1204 incanalcr.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 3220 2772 2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe 89 PID 3220 wrote to memory of 4864 3220 inqtvunam.exe 90 PID 4864 wrote to memory of 4240 4864 inoavpdfe.exe 91 PID 4240 wrote to memory of 3800 4240 ingvnhoze.exe 92 PID 3800 wrote to memory of 4460 3800 insohtodl.exe 93 PID 4460 wrote to memory of 1524 4460 indwztgsi.exe 94 PID 1524 wrote to memory of 1920 1524 injwnoaqy.exe 95 PID 1920 wrote to memory of 3776 1920 inzvgovkd.exe 96 PID 3776 wrote to memory of 2728 3776 inmtnbdcu.exe 97 PID 2728 wrote to memory of 5516 2728 inhfsfaqh.exe 98 PID 5516 wrote to memory of 5932 5516 inpsutmlb.exe 99 PID 5932 wrote to memory of 5728 5932 inaexuhtj.exe 100 PID 5728 wrote to memory of 3444 5728 ingtvpopk.exe 101 PID 3444 wrote to memory of 2120 3444 invhwkmle.exe 102 PID 2120 wrote to memory of 5852 2120 inknedlyl.exe 103 PID 5852 wrote to memory of 4520 5852 inatwyxqd.exe 104 PID 4520 wrote to memory of 4508 4520 injyqkarh.exe 105 PID 4508 wrote to memory of 2740 4508 inbqiycju.exe 106 PID 2740 wrote to memory of 4100 2740 inxiaqxbm.exe 107 PID 4100 wrote to memory of 4912 4100 inwmpgfnn.exe 108 PID 4912 wrote to memory of 3944 4912 indtwnmuu.exe 109 PID 3944 wrote to memory of 4908 3944 inqmfrmyb.exe 110 PID 4908 wrote to memory of 4140 4908 insezthji.exe 111 PID 4140 wrote to memory of 4276 4140 infgwnmcy.exe 112 PID 4276 wrote to memory of 4104 4276 inxtemyti.exe 113 PID 4104 wrote to memory of 1204 4104 inzloqpih.exe 114 PID 1204 wrote to memory of 5676 1204 incanalcr.exe 115 PID 5676 wrote to memory of 3820 5676 ingiuiufd.exe 116 PID 3820 wrote to memory of 2600 3820 inhiypoew.exe 117 PID 2600 wrote to memory of 1992 2600 intfuikjc.exe 118 PID 1992 wrote to memory of 4596 1992 inzkcszdo.exe 119 PID 4596 wrote to memory of 5132 4596 inruwvobn.exe 120 PID 5132 wrote to memory of 1316 5132 inwhpwale.exe 121 PID 1316 wrote to memory of 6028 1316 infvqbbup.exe 122 PID 6028 wrote to memory of 1480 6028 inugvjlkd.exe 123 PID 1480 wrote to memory of 4932 1480 inldtepix.exe 124 PID 4932 wrote to memory of 1088 4932 inrdysgih.exe 125 PID 1088 wrote to memory of 2556 1088 inqjpgzht.exe 126 PID 2556 wrote to memory of 2856 2556 invuwaxma.exe 127 PID 2856 wrote to memory of 3096 2856 inwgusogd.exe 128 PID 3096 wrote to memory of 4144 3096 inmeufqjy.exe 129 PID 4144 wrote to memory of 6104 4144 inbuxzyre.exe 130 PID 6104 wrote to memory of 1280 6104 inmprqjiy.exe 131 PID 1280 wrote to memory of 2284 1280 incsvmltt.exe 132 PID 2284 wrote to memory of 4856 2284 ingvzmksi.exe 133 PID 4856 wrote to memory of 6020 4856 inwsdlxsh.exe 134 PID 6020 wrote to memory of 3032 6020 infhthtec.exe 135 PID 3032 wrote to memory of 3408 3032 inclzteci.exe 136 PID 3408 wrote to memory of 1540 3408 inetlfmxc.exe 137 PID 1540 wrote to memory of 2012 1540 inpleqlxa.exe 138 PID 2012 wrote to memory of 3376 2012 inazpsjiq.exe 139 PID 3376 wrote to memory of 3428 3376 inhsblrqs.exe 140 PID 3428 wrote to memory of 4808 3428 inmibthrw.exe 141 PID 4808 wrote to memory of 2352 4808 inopeewva.exe 142 PID 2352 wrote to memory of 1284 2352 injhulmow.exe 143 PID 1284 wrote to memory of 4820 1284 indxawycz.exe 144 PID 4820 wrote to memory of 4112 4820 inpiofygs.exe 145 PID 4112 wrote to memory of 1432 4112 inhwnltjf.exe 146 PID 1432 wrote to memory of 5128 1432 infdqdofu.exe 147 PID 5128 wrote to memory of 4116 5128 inumafjdj.exe 148 PID 4116 wrote to memory of 2548 4116 inqklaasr.exe 149 PID 2548 wrote to memory of 5036 2548 inwixlnmf.exe 150 PID 5036 wrote to memory of 1568 5036 inochlfll.exe 151 PID 1568 wrote to memory of 2328 1568 indskelwb.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_b0962713d0e4fdbe34802e17d7841280_elex_parite_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe40⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe41⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe52⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe65⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe66⤵PID:5392
-
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe67⤵
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe68⤵PID:4792
-
C:\Windows\SysWOW64\inpnehxjk.exeC:\Windows\system32\inpnehxjk.exe69⤵PID:2136
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe70⤵PID:4332
-
C:\Windows\SysWOW64\injsnioht.exeC:\Windows\system32\injsnioht.exe71⤵PID:3392
-
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe72⤵
- System Location Discovery: System Language Discovery
PID:724 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe73⤵PID:4264
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe74⤵PID:3360
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe75⤵PID:5980
-
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4756 -
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe77⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4876 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe78⤵PID:5744
-
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe79⤵PID:1636
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe80⤵
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe81⤵PID:4564
-
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4360 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe83⤵
- Drops file in System32 directory
PID:5048 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe84⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:3684 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe85⤵PID:1164
-
C:\Windows\SysWOW64\inuydrpyf.exeC:\Windows\system32\inuydrpyf.exe86⤵PID:5264
-
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe87⤵PID:800
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe88⤵PID:692
-
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe89⤵PID:1168
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe90⤵
- Drops file in System32 directory
PID:2020 -
C:\Windows\SysWOW64\inrqyysti.exeC:\Windows\system32\inrqyysti.exe91⤵PID:3840
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe92⤵
- Drops file in System32 directory
PID:1876 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe93⤵PID:5504
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe94⤵PID:5368
-
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe95⤵PID:3532
-
C:\Windows\SysWOW64\inmqlrpew.exeC:\Windows\system32\inmqlrpew.exe96⤵
- Drops file in System32 directory
PID:1744 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe97⤵PID:2864
-
C:\Windows\SysWOW64\inewhnrej.exeC:\Windows\system32\inewhnrej.exe98⤵
- Boot or Logon Autostart Execution: Active Setup
PID:804 -
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe99⤵PID:5372
-
C:\Windows\SysWOW64\inupkqjvx.exeC:\Windows\system32\inupkqjvx.exe100⤵PID:5332
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe101⤵PID:5720
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe102⤵
- System Location Discovery: System Language Discovery
PID:3188 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe103⤵PID:4952
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe104⤵PID:5408
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe105⤵PID:904
-
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe106⤵PID:1616
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe107⤵PID:2932
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe108⤵PID:3196
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe109⤵PID:560
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe110⤵PID:1452
-
C:\Windows\SysWOW64\inhpdyhbh.exeC:\Windows\system32\inhpdyhbh.exe111⤵PID:4284
-
C:\Windows\SysWOW64\intxcqoxe.exeC:\Windows\system32\intxcqoxe.exe112⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe113⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5472 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe114⤵PID:2128
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe115⤵PID:5792
-
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe116⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe117⤵PID:5252
-
C:\Windows\SysWOW64\inlaxcmgz.exeC:\Windows\system32\inlaxcmgz.exe118⤵PID:2008
-
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe119⤵PID:5684
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe120⤵PID:4816
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe121⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-