Analysis
- max time kernel
73s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 22:56
Behavioral task
behavioral1
Sample
2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260910-2wwtysxbpe
- SHA256 12667d3323b0351b2b694cd6a33298ff1f1fee1675127c16856657d4cdb9f26e
- MD5 d75154c9d44103bd1f72d66a78fd4b05
- SHA1 772e7712c42a3cdca56713dd1a5f7097de175ab5
- SHA512 84e0598ed58de0e069c6ec4be7ebaf53c0c54b47a62f3f4c71795bb5a9849fc0c4c02f4d8fd69b049abb5f637e37f6713432a30143283e0c4eb41dd4c9466ef1
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTZ:RPjOa1NxyYtH1Z
- TLSH T11D15AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/1680-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e8-20.dat family_gh0strat behavioral2/memory/1680-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ed-40.dat family_gh0strat behavioral2/files/0x000d00000001c4ec-31.dat family_gh0strat behavioral2/memory/3336-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f1-65.dat family_gh0strat behavioral2/memory/4192-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f5-86.dat family_gh0strat behavioral2/files/0x000d00000001c4f9-108.dat family_gh0strat behavioral2/memory/2828-113-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4fd-130.dat family_gh0strat behavioral2/memory/3140-135-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c501-153.dat family_gh0strat behavioral2/files/0x000d00000001c510-174.dat family_gh0strat behavioral2/files/0x000d00000001c514-197.dat family_gh0strat behavioral2/files/0x000d00000001c518-219.dat family_gh0strat behavioral2/files/0x000d00000001c51c-241.dat family_gh0strat behavioral2/files/0x000d00000001c51f-263.dat family_gh0strat behavioral2/memory/4528-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c52f-351.dat family_gh0strat behavioral2/memory/1172-625-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3424-607-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5176-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2404-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4680-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3316-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2132-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1980-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3976-481-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5952-463-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4504-445-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2068-427-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5344-409-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4580-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4912-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4768-355-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/464-333-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c52b-329.dat family_gh0strat behavioral2/memory/6084-311-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c527-307.dat family_gh0strat behavioral2/files/0x000d00000001c523-285.dat family_gh0strat behavioral2/memory/2384-267-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1704-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1456-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3148-201-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/472-179-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3124-157-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/832-96-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABF4E947-DF99-4f31-BD13-9724880D45A6} indscwrxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03E1F52D-7E57-4bb7-93FE-DB668259D970}\stubpath = "C:\\Windows\\system32\\inotjfrzg.exe" inaqceivb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D20B053-B927-43ae-B725-E48CE1278587} inuonujxj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E74906E4-2DA4-437f-B101-EE60244191F0}\stubpath = "C:\\Windows\\system32\\inlbjrbai.exe" intwamnoz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBB97924-E63F-4785-9E99-E492700EDC61}\stubpath = "C:\\Windows\\system32\\inxbftvlo.exe" inokiqcye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2E570A5-387A-45f3-8052-A210148F2819} infcwfnxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B28E5DFF-049E-4ae0-AAC2-3E1145711D68}\stubpath = "C:\\Windows\\system32\\inyteppma.exe" infudswxj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E74F65A6-1DF8-4d50-B625-15074107BA32}\stubpath = "C:\\Windows\\system32\\inxjymong.exe" inbaqtkjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B3E0345-5BC5-4b43-A4B8-FBF67ABC9897}\stubpath = "C:\\Windows\\system32\\inaqgiwze.exe" inasgqvzt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6FF77E63-3EEC-407d-9A66-85D719A72966}\stubpath = "C:\\Windows\\system32\\intetdxsy.exe" inhzrfkoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{437F8413-81DF-44e4-AEE0-5B0D6DC0D732}\stubpath = "C:\\Windows\\system32\\iniwaqpwa.exe" inewhnrej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FA8F7B8-1D5B-4414-A5C0-604E65A64245}\stubpath = "C:\\Windows\\system32\\inbpjipes.exe" indkntxkp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72A6E05B-79A1-4079-93D3-50CDB4BE2865}\stubpath = "C:\\Windows\\system32\\inytomigo.exe" inbpjipes.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C23A8C8-8575-4352-9C0B-4A03BA1AACFA} inyccnaan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27D109A8-A5BA-44aa-BE84-C173A49726A1}\stubpath = "C:\\Windows\\system32\\inknedlyl.exe" inxjymong.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD96A144-9759-454e-8C64-D2AAE3F7C4DF}\stubpath = "C:\\Windows\\system32\\inumafjdj.exe" infnwdvwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B20124D8-E3A5-420c-BC17-F7429A7CF117} inhiypoew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1E28E5F-770B-4c2d-80CF-CD4C31553559}\stubpath = "C:\\Windows\\system32\\inrtwgusw.exe" inckxztas.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08914FB6-E85F-423f-8FB0-5546403E91B4} infpibkqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86198107-80EA-4f53-8900-2A8DFBAD37C1} inbqiycju.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{712EB71F-68EB-4977-B75C-475CAE3863F8}\stubpath = "C:\\Windows\\system32\\indtosnaj.exe" inyluacnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB47DC83-A1AA-4524-BFA2-B112BBC28C4D} inxrycagn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C2DE317-61D0-4cc6-A639-65A4AEC6E75C} inczeboin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F2F22DC-493B-44a8-833C-2FB8909BDB03}\stubpath = "C:\\Windows\\system32\\intuwvzao.exe" inlvjosms.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61B9CDEC-5C69-4d4e-935E-4C4AACAD77B5} innptoush.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{188007A8-0DA3-4343-85A9-9C385383716C}\stubpath = "C:\\Windows\\system32\\incbzwztd.exe" inujqmuoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B986CA21-D5E9-4ae9-AA84-78A47CC54AD2}\stubpath = "C:\\Windows\\system32\\inrtkcgnc.exe" inxlrthqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A2AD2E8-65A9-4b95-A24F-B018DBC5072D} inyfydwsq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C68A64B6-6965-4a5b-813F-D986E1417B07}\stubpath = "C:\\Windows\\system32\\inttrrtqn.exe" inkesnbrx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F63466F-3968-44d2-8FBD-C32E560FBA15} inltanpsp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58FFECA4-5968-4975-880F-2C130D4705C7} inmtnbdcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECD6A5E9-AB6A-4dd3-B545-5AEC68C21FFA}\stubpath = "C:\\Windows\\system32\\incpcgxnb.exe" invbdruwx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8422E5DE-1AE7-400c-B99B-88CF19E299A3}\stubpath = "C:\\Windows\\system32\\inhxjlpig.exe" inhqlgymf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BC9C728-55FD-4af5-BE1F-3488BAC88630}\stubpath = "C:\\Windows\\system32\\inwldhtuf.exe" inlynkhmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BC04E02-BB3B-4016-9B6E-E2361344DDDF}\stubpath = "C:\\Windows\\system32\\invmsakfo.exe" inodqsvft.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{717ED144-816B-473a-9DE7-D44587F8BC21} inowmiavg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE71B302-EF70-4016-B6A6-47F8B49DF823} inqdmufdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89A54DF1-2B1A-4e84-92E3-771595F9CA77}\stubpath = "C:\\Windows\\system32\\invhwkmle.exe" inaphxbit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{745D2B7F-CAE6-4f4d-8C25-1369EB923E1C}\stubpath = "C:\\Windows\\system32\\inhsblrqs.exe" inapnrseu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45C00342-150F-4f0f-9E37-04E2FEFC7963} inaouaylq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B0EEEB5-2E8F-49d0-8D87-59D3464338A4}\stubpath = "C:\\Windows\\system32\\inoxlbteg.exe" incldxuje.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4B47C4B-1C56-4448-AAD6-851872EB93E3} inofbieyd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5DBB284-7E35-424f-A297-E6F733411A5A} incrjzdkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB1FE328-AA7A-435b-930D-8DED2C60D586} ingyagyjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C9471BC-A197-4317-8BD6-FC490DD26333}\stubpath = "C:\\Windows\\system32\\intfwsljg.exe" inmawkptn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABF4E947-DF99-4f31-BD13-9724880D45A6}\stubpath = "C:\\Windows\\system32\\inepndjtb.exe" indscwrxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DFD4E5A-40F0-4c1b-810B-365137D78D4F} inxbftvlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{687D610B-1864-42dd-A561-E27734EF1BD2}\stubpath = "C:\\Windows\\system32\\inwtzamwg.exe" inyctgpxi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0544AE6-9B75-424a-8AEE-B91410734E40} ingerepgv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFB45C75-FA1C-4906-8440-541A59044EFF} inqxvmprs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{786146FA-65E8-4649-BAB6-035A8EFE8179} intndtuwg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22826CD8-9B62-46aa-B38E-1A6FD7B062B9} inxtleici.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D843F92E-AB9E-439a-B9ED-B8245C732EB4} inuhqyjhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96E6C0B1-1EAC-4cbf-802B-8BBA2CFF6CCD} infrgacrf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C281745-DDBE-446a-BA03-18B5DF9860FD} ingkycsra.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{235EAC1A-5CE4-44de-A7DD-18A12BEEC66E} intfuikjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC097065-82B7-47f2-AEEA-9D0F021B2FCC} indwztgsi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{110431BC-905E-4a6c-A29E-C2DAE56F90C2}\stubpath = "C:\\Windows\\system32\\invzesqzg.exe" inwmcsiky.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{534B7F8F-A94A-4c22-BA40-BC2E5268812B} inwtixaeq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5193FCB4-A36D-4d76-A1BE-06063B9061E2} indxawycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28B66E9A-C530-4c34-9400-BDE963792EDF} inoxlbteg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{702EE731-AF64-4c46-9294-A0F5DE7FE1A3}\stubpath = "C:\\Windows\\system32\\inwonikuc.exe" inpiqqmhr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E74F65A6-1DF8-4d50-B625-15074107BA32} inbaqtkjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{839A31D6-C6C0-4303-B933-8545B6D853FF} inmwcesvx.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000b000000016cdf-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3336 inpsutmlb.exe 4192 inxtemyti.exe 832 inmtnbdcu.exe 2828 inwsdlxsh.exe 3140 inaexuhtj.exe 3124 innfvgrkz.exe 472 indskelwb.exe 3148 inykznpoh.exe 1456 insohtodl.exe 1704 infumgnyd.exe 2384 inmprqjiy.exe 4528 inruwvobn.exe 6084 inzvgovkd.exe 464 inldtepix.exe 4768 insvxwpco.exe 4912 inxiaqxbm.exe 4580 inixomukg.exe 5344 intfuikjc.exe 2068 inixpjqgj.exe 4504 invuwaxma.exe 5952 insezthji.exe 3976 incgzwjvl.exe 1980 inortslka.exe 2132 inatwyxqd.exe 3316 inbfyviuk.exe 4680 inrngsnzc.exe 2404 ineybxzdp.exe 5176 infudswxj.exe 3424 inyteppma.exe 1172 inbrulkss.exe 244 inwhpwale.exe 940 innuocedv.exe 5668 inbaqtkjr.exe 1668 inxjymong.exe 1892 inknedlyl.exe 5200 inbqostfv.exe 1252 ingwzqpxx.exe 3444 inmibthrw.exe 1512 inmnccutj.exe 2540 inrshhzyd.exe 5928 inulkzdji.exe 3304 inbuxzyre.exe 3484 infvypoww.exe 8 infgwnmcy.exe 1616 inrdysgih.exe 5980 inhjvjvge.exe 4156 inoavpdfe.exe 3220 incvyzsfr.exe 2788 indhxkwmb.exe 1516 intpaiupe.exe 6080 inyufnzuj.exe 1952 inzkcszdo.exe 3760 injwnoaqy.exe 5116 inqgdzfrf.exe 1772 inkzrlbas.exe 5904 inuqbjvqf.exe 980 insbquvhx.exe 2356 ingvzmksi.exe 5224 inbqiycju.exe 3992 inwixlnmf.exe 4776 inwmpgfnn.exe 1148 inthmqkqb.exe 2008 inocymrvp.exe 2140 inaphxbit.exe - Loads dropped DLL 64 IoCs
pid Process 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe 3336 inpsutmlb.exe 3336 inpsutmlb.exe 4192 inxtemyti.exe 4192 inxtemyti.exe 832 inmtnbdcu.exe 832 inmtnbdcu.exe 2828 inwsdlxsh.exe 2828 inwsdlxsh.exe 3140 inaexuhtj.exe 3140 inaexuhtj.exe 3124 innfvgrkz.exe 3124 innfvgrkz.exe 472 indskelwb.exe 472 indskelwb.exe 3148 inykznpoh.exe 3148 inykznpoh.exe 1456 insohtodl.exe 1456 insohtodl.exe 1704 infumgnyd.exe 1704 infumgnyd.exe 2384 inmprqjiy.exe 2384 inmprqjiy.exe 4528 inruwvobn.exe 4528 inruwvobn.exe 6084 inzvgovkd.exe 6084 inzvgovkd.exe 464 inldtepix.exe 464 inldtepix.exe 4768 insvxwpco.exe 4768 insvxwpco.exe 4912 inxiaqxbm.exe 4912 inxiaqxbm.exe 4580 inixomukg.exe 4580 inixomukg.exe 5344 intfuikjc.exe 5344 intfuikjc.exe 2068 inixpjqgj.exe 2068 inixpjqgj.exe 4504 invuwaxma.exe 4504 invuwaxma.exe 5952 insezthji.exe 5952 insezthji.exe 3976 incgzwjvl.exe 3976 incgzwjvl.exe 1980 inortslka.exe 1980 inortslka.exe 2132 inatwyxqd.exe 2132 inatwyxqd.exe 3316 inbfyviuk.exe 3316 inbfyviuk.exe 4680 inrngsnzc.exe 4680 inrngsnzc.exe 2404 ineybxzdp.exe 2404 ineybxzdp.exe 5176 infudswxj.exe 5176 infudswxj.exe 3424 inyteppma.exe 3424 inyteppma.exe 1172 inbrulkss.exe 1172 inbrulkss.exe 244 inwhpwale.exe 244 inwhpwale.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inmtiwity.exe File created C:\Windows\SysWOW64\inhxamofz.exe inmflkmos.exe File created C:\Windows\SysWOW64\invlbrhjx.exe inxnewqnc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlvjosms.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insywlfel.exe File opened for modification C:\Windows\SysWOW64\infrgacrf.exe_lang.ini inrvkfwvq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjdjvkm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmjhdsul.exe File created C:\Windows\SysWOW64\inrvkfwvq.exe invzesqzg.exe File created C:\Windows\SysWOW64\inpdraxym.exe insvsctst.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoioprby.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incldxuje.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inocymrvp.exe File opened for modification C:\Windows\SysWOW64\inwemzvcu.exe_lang.ini invqmdynu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incsdfhkz.exe File opened for modification C:\Windows\SysWOW64\inwhjedoj.exe_lang.ini inkuaczqt.exe File opened for modification C:\Windows\SysWOW64\inujqmuoe.exe_lang.ini indbkovjr.exe File created C:\Windows\SysWOW64\inyaereiz.exe inlhnqivx.exe File opened for modification C:\Windows\SysWOW64\injwylczx.exe_lang.ini inaikwkwh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpqffxwb.exe File created C:\Windows\SysWOW64\inujlcwuk.exe inxsdoolp.exe File opened for modification C:\Windows\SysWOW64\inimbeutc.exe_lang.ini inxujybfr.exe File created C:\Windows\SysWOW64\inatybwnb.exe inefvmlzb.exe File opened for modification C:\Windows\SysWOW64\inhfbqsjb.exe_lang.ini inblsqhkm.exe File created C:\Windows\SysWOW64\infrgacrf.exe inrvkfwvq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innfvgrkz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intfwsljg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incbrdfjw.exe File opened for modification C:\Windows\SysWOW64\inpeyhpif.exe_lang.ini inycykdza.exe File created C:\Windows\SysWOW64\inidwdyvc.exe inpkuzhdr.exe File opened for modification C:\Windows\SysWOW64\injwnoaqy.exe_lang.ini inzkcszdo.exe File opened for modification C:\Windows\SysWOW64\inahuhbcs.exe_lang.ini injkrqgyq.exe File opened for modification C:\Windows\SysWOW64\inzjwmbpr.exe_lang.ini indrmgdxz.exe File created C:\Windows\SysWOW64\inbsfowhf.exe inbobfwma.exe File opened for modification C:\Windows\SysWOW64\inkesnbrx.exe_lang.ini inpfvwyie.exe File created C:\Windows\SysWOW64\innvcvbrm.exe inmbpckft.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyteppma.exe File opened for modification C:\Windows\SysWOW64\intwamnoz.exe_lang.ini inmiqkaqr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injgmuryj.exe File opened for modification C:\Windows\SysWOW64\ineeenyiy.exe_lang.ini incvxxhec.exe File opened for modification C:\Windows\SysWOW64\inmprqjiy.exe_lang.ini infumgnyd.exe File created C:\Windows\SysWOW64\inewhnrej.exe inrtkbsie.exe File created C:\Windows\SysWOW64\inqgyjlgf.exe inlgphgbd.exe File opened for modification C:\Windows\SysWOW64\ingwzqpxx.exe_lang.ini inbqostfv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indwezqep.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpiofygs.exe File opened for modification C:\Windows\SysWOW64\inyazesml.exe_lang.ini inzrcejxv.exe File created C:\Windows\SysWOW64\inrwawibx.exe inoioprby.exe File created C:\Windows\SysWOW64\invirzkie.exe inhgwhjlo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkveoutv.exe File opened for modification C:\Windows\SysWOW64\inqmfrmyb.exe_lang.ini inhfsfaqh.exe File opened for modification C:\Windows\SysWOW64\inwmcsiky.exe_lang.ini inrgfvgik.exe File opened for modification C:\Windows\SysWOW64\intdphcld.exe_lang.ini inzebhpmt.exe File created C:\Windows\SysWOW64\inbuxzyre.exe inulkzdji.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjwysrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineqbmfxl.exe File created C:\Windows\SysWOW64\inopeewva.exe inrmslxzd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuhqyjhd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhgwhjlo.exe File created C:\Windows\SysWOW64\inngmlnpt.exe ineupaato.exe File created C:\Windows\SysWOW64\ingcowdkg.exe infrgacrf.exe File opened for modification C:\Windows\SysWOW64\insbznvcp.exe_lang.ini innsieqyf.exe File created C:\Windows\SysWOW64\indpalewk.exe inewrcnnk.exe File opened for modification C:\Windows\SysWOW64\inghxondz.exe_lang.ini injyiwuqi.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhthtec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtleici.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrfqjpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhnmoqun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inovtknpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclzteci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language initcmsrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingkycsra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlolxmlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxlrthqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inboqtdrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyaereiz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incrjzdkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzydrlkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmgmynpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innxkgbub.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insdtdypv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innfvgrkz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insaljfpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczeboin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inshvhsxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indcsegkx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuonujxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intikurgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infumgnyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhsblrqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzesqny.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqxvmprs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inngmlnpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inapnrseu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invlhtipl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inujqmuoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invatpnbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzzdxxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpleqlxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inionprva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infsuonoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmflkmos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowmiavg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwmcsiky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqswbpnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogwahsa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjudnts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegrpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbnjcuis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyodrton.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmjhdsul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuakpshs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrshhzyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injmdckxk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkveoutv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incanalcr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtosnaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhxamofz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invqlrkwy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxbftvlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insylvfcw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineqbmfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkuaczqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inopeewva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invqlwhhe.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe 3336 inpsutmlb.exe 3336 inpsutmlb.exe 4192 inxtemyti.exe 4192 inxtemyti.exe 832 inmtnbdcu.exe 832 inmtnbdcu.exe 2828 inwsdlxsh.exe 2828 inwsdlxsh.exe 3140 inaexuhtj.exe 3140 inaexuhtj.exe 3124 innfvgrkz.exe 3124 innfvgrkz.exe 472 indskelwb.exe 472 indskelwb.exe 3148 inykznpoh.exe 3148 inykznpoh.exe 1456 insohtodl.exe 1456 insohtodl.exe 1704 infumgnyd.exe 1704 infumgnyd.exe 2384 inmprqjiy.exe 2384 inmprqjiy.exe 4528 inruwvobn.exe 4528 inruwvobn.exe 6084 inzvgovkd.exe 6084 inzvgovkd.exe 464 inldtepix.exe 464 inldtepix.exe 4768 insvxwpco.exe 4768 insvxwpco.exe 4912 inxiaqxbm.exe 4912 inxiaqxbm.exe 4580 inixomukg.exe 4580 inixomukg.exe 5344 intfuikjc.exe 5344 intfuikjc.exe 2068 inixpjqgj.exe 2068 inixpjqgj.exe 4504 invuwaxma.exe 4504 invuwaxma.exe 5952 insezthji.exe 5952 insezthji.exe 3976 incgzwjvl.exe 3976 incgzwjvl.exe 1980 inortslka.exe 1980 inortslka.exe 2132 inatwyxqd.exe 2132 inatwyxqd.exe 3316 inbfyviuk.exe 3316 inbfyviuk.exe 4680 inrngsnzc.exe 4680 inrngsnzc.exe 2404 ineybxzdp.exe 2404 ineybxzdp.exe 5176 infudswxj.exe 5176 infudswxj.exe 3424 inyteppma.exe 3424 inyteppma.exe 1172 inbrulkss.exe 1172 inbrulkss.exe 244 inwhpwale.exe 244 inwhpwale.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 3336 inpsutmlb.exe Token: SeDebugPrivilege 4192 inxtemyti.exe Token: SeDebugPrivilege 832 inmtnbdcu.exe Token: SeDebugPrivilege 2828 inwsdlxsh.exe Token: SeDebugPrivilege 3140 inaexuhtj.exe Token: SeDebugPrivilege 3124 innfvgrkz.exe Token: SeDebugPrivilege 472 indskelwb.exe Token: SeDebugPrivilege 3148 inykznpoh.exe Token: SeDebugPrivilege 1456 insohtodl.exe Token: SeDebugPrivilege 1704 infumgnyd.exe Token: SeDebugPrivilege 2384 inmprqjiy.exe Token: SeDebugPrivilege 4528 inruwvobn.exe Token: SeDebugPrivilege 6084 inzvgovkd.exe Token: SeDebugPrivilege 464 inldtepix.exe Token: SeDebugPrivilege 4768 insvxwpco.exe Token: SeDebugPrivilege 4912 inxiaqxbm.exe Token: SeDebugPrivilege 4580 inixomukg.exe Token: SeDebugPrivilege 5344 intfuikjc.exe Token: SeDebugPrivilege 2068 inixpjqgj.exe Token: SeDebugPrivilege 4504 invuwaxma.exe Token: SeDebugPrivilege 5952 insezthji.exe Token: SeDebugPrivilege 3976 incgzwjvl.exe Token: SeDebugPrivilege 1980 inortslka.exe Token: SeDebugPrivilege 2132 inatwyxqd.exe Token: SeDebugPrivilege 3316 inbfyviuk.exe Token: SeDebugPrivilege 4680 inrngsnzc.exe Token: SeDebugPrivilege 2404 ineybxzdp.exe Token: SeDebugPrivilege 5176 infudswxj.exe Token: SeDebugPrivilege 3424 inyteppma.exe Token: SeDebugPrivilege 1172 inbrulkss.exe Token: SeDebugPrivilege 244 inwhpwale.exe Token: SeDebugPrivilege 940 innuocedv.exe Token: SeDebugPrivilege 5668 inbaqtkjr.exe Token: SeDebugPrivilege 1668 inxjymong.exe Token: SeDebugPrivilege 1892 inknedlyl.exe Token: SeDebugPrivilege 5200 inbqostfv.exe Token: SeDebugPrivilege 1252 ingwzqpxx.exe Token: SeDebugPrivilege 3444 inmibthrw.exe Token: SeDebugPrivilege 1512 inmnccutj.exe Token: SeDebugPrivilege 2540 inrshhzyd.exe Token: SeDebugPrivilege 5928 inulkzdji.exe Token: SeDebugPrivilege 3304 inbuxzyre.exe Token: SeDebugPrivilege 3484 infvypoww.exe Token: SeDebugPrivilege 8 infgwnmcy.exe Token: SeDebugPrivilege 1616 inrdysgih.exe Token: SeDebugPrivilege 5980 inhjvjvge.exe Token: SeDebugPrivilege 4156 inoavpdfe.exe Token: SeDebugPrivilege 3220 incvyzsfr.exe Token: SeDebugPrivilege 2788 indhxkwmb.exe Token: SeDebugPrivilege 1516 intpaiupe.exe Token: SeDebugPrivilege 6080 inyufnzuj.exe Token: SeDebugPrivilege 1952 inzkcszdo.exe Token: SeDebugPrivilege 3760 injwnoaqy.exe Token: SeDebugPrivilege 5116 inqgdzfrf.exe Token: SeDebugPrivilege 1772 inkzrlbas.exe Token: SeDebugPrivilege 5904 inuqbjvqf.exe Token: SeDebugPrivilege 980 insbquvhx.exe Token: SeDebugPrivilege 2356 ingvzmksi.exe Token: SeDebugPrivilege 5224 inbqiycju.exe Token: SeDebugPrivilege 3992 inwixlnmf.exe Token: SeDebugPrivilege 4776 inwmpgfnn.exe Token: SeDebugPrivilege 1148 inthmqkqb.exe Token: SeDebugPrivilege 2008 inocymrvp.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe 3336 inpsutmlb.exe 4192 inxtemyti.exe 832 inmtnbdcu.exe 2828 inwsdlxsh.exe 3140 inaexuhtj.exe 3124 innfvgrkz.exe 472 indskelwb.exe 3148 inykznpoh.exe 1456 insohtodl.exe 1704 infumgnyd.exe 2384 inmprqjiy.exe 4528 inruwvobn.exe 6084 inzvgovkd.exe 464 inldtepix.exe 4768 insvxwpco.exe 4912 inxiaqxbm.exe 4580 inixomukg.exe 5344 intfuikjc.exe 2068 inixpjqgj.exe 4504 invuwaxma.exe 5952 insezthji.exe 3976 incgzwjvl.exe 1980 inortslka.exe 2132 inatwyxqd.exe 3316 inbfyviuk.exe 4680 inrngsnzc.exe 2404 ineybxzdp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 3336 1680 2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 3336 wrote to memory of 4192 3336 inpsutmlb.exe 90 PID 4192 wrote to memory of 832 4192 inxtemyti.exe 91 PID 832 wrote to memory of 2828 832 inmtnbdcu.exe 92 PID 2828 wrote to memory of 3140 2828 inwsdlxsh.exe 93 PID 3140 wrote to memory of 3124 3140 inaexuhtj.exe 94 PID 3124 wrote to memory of 472 3124 innfvgrkz.exe 95 PID 472 wrote to memory of 3148 472 indskelwb.exe 96 PID 3148 wrote to memory of 1456 3148 inykznpoh.exe 97 PID 1456 wrote to memory of 1704 1456 insohtodl.exe 98 PID 1704 wrote to memory of 2384 1704 infumgnyd.exe 99 PID 2384 wrote to memory of 4528 2384 inmprqjiy.exe 100 PID 4528 wrote to memory of 6084 4528 inruwvobn.exe 101 PID 6084 wrote to memory of 464 6084 inzvgovkd.exe 102 PID 464 wrote to memory of 4768 464 inldtepix.exe 103 PID 4768 wrote to memory of 4912 4768 insvxwpco.exe 104 PID 4912 wrote to memory of 4580 4912 inxiaqxbm.exe 105 PID 4580 wrote to memory of 5344 4580 inixomukg.exe 106 PID 5344 wrote to memory of 2068 5344 intfuikjc.exe 107 PID 2068 wrote to memory of 4504 2068 inixpjqgj.exe 108 PID 4504 wrote to memory of 5952 4504 invuwaxma.exe 109 PID 5952 wrote to memory of 3976 5952 insezthji.exe 110 PID 3976 wrote to memory of 1980 3976 incgzwjvl.exe 111 PID 1980 wrote to memory of 2132 1980 inortslka.exe 112 PID 2132 wrote to memory of 3316 2132 inatwyxqd.exe 113 PID 3316 wrote to memory of 4680 3316 inbfyviuk.exe 114 PID 4680 wrote to memory of 2404 4680 inrngsnzc.exe 115 PID 2404 wrote to memory of 5176 2404 ineybxzdp.exe 116 PID 5176 wrote to memory of 3424 5176 infudswxj.exe 117 PID 3424 wrote to memory of 1172 3424 inyteppma.exe 118 PID 1172 wrote to memory of 244 1172 inbrulkss.exe 119 PID 244 wrote to memory of 940 244 inwhpwale.exe 120 PID 940 wrote to memory of 5668 940 innuocedv.exe 121 PID 5668 wrote to memory of 1668 5668 inbaqtkjr.exe 122 PID 1668 wrote to memory of 1892 1668 inxjymong.exe 123 PID 1892 wrote to memory of 5200 1892 inknedlyl.exe 124 PID 5200 wrote to memory of 1252 5200 inbqostfv.exe 125 PID 1252 wrote to memory of 3444 1252 ingwzqpxx.exe 126 PID 3444 wrote to memory of 1512 3444 inmibthrw.exe 127 PID 1512 wrote to memory of 2540 1512 inmnccutj.exe 128 PID 2540 wrote to memory of 5928 2540 inrshhzyd.exe 129 PID 5928 wrote to memory of 3304 5928 inulkzdji.exe 130 PID 3304 wrote to memory of 3484 3304 inbuxzyre.exe 131 PID 3484 wrote to memory of 8 3484 infvypoww.exe 132 PID 8 wrote to memory of 1616 8 infgwnmcy.exe 133 PID 1616 wrote to memory of 5980 1616 inrdysgih.exe 134 PID 5980 wrote to memory of 4156 5980 inhjvjvge.exe 135 PID 4156 wrote to memory of 3220 4156 inoavpdfe.exe 136 PID 3220 wrote to memory of 2788 3220 incvyzsfr.exe 137 PID 2788 wrote to memory of 1516 2788 indhxkwmb.exe 138 PID 1516 wrote to memory of 6080 1516 intpaiupe.exe 139 PID 6080 wrote to memory of 1952 6080 inyufnzuj.exe 140 PID 1952 wrote to memory of 3760 1952 inzkcszdo.exe 141 PID 3760 wrote to memory of 5116 3760 injwnoaqy.exe 142 PID 5116 wrote to memory of 1772 5116 inqgdzfrf.exe 143 PID 1772 wrote to memory of 5904 1772 inkzrlbas.exe 144 PID 5904 wrote to memory of 980 5904 inuqbjvqf.exe 145 PID 980 wrote to memory of 2356 980 insbquvhx.exe 146 PID 2356 wrote to memory of 5224 2356 ingvzmksi.exe 147 PID 5224 wrote to memory of 3992 5224 inbqiycju.exe 148 PID 3992 wrote to memory of 4776 3992 inwixlnmf.exe 149 PID 4776 wrote to memory of 1148 4776 inwmpgfnn.exe 150 PID 1148 wrote to memory of 2008 1148 inthmqkqb.exe 151 PID 2008 wrote to memory of 2140 2008 inocymrvp.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_d75154c9d44103bd1f72d66a78fd4b05_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\system32\inyteppma.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe34⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe35⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe60⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe65⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
PID:2140 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe66⤵PID:5608
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe67⤵PID:4592
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe68⤵PID:5156
-
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe69⤵PID:3064
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe70⤵PID:2796
-
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe71⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\Windows\SysWOW64\inqzaupvo.exeC:\Windows\system32\inqzaupvo.exe72⤵PID:4128
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe73⤵PID:1076
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe74⤵
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe75⤵PID:2488
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe76⤵PID:4916
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe77⤵PID:1028
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe78⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2988 -
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe79⤵PID:1800
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe80⤵PID:4944
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe81⤵PID:2852
-
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe82⤵PID:5716
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe83⤵PID:5624
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe84⤵PID:1768
-
C:\Windows\SysWOW64\invgvfzue.exeC:\Windows\system32\invgvfzue.exe85⤵PID:1684
-
C:\Windows\SysWOW64\inykmqjhq.exeC:\Windows\system32\inykmqjhq.exe86⤵PID:556
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe87⤵PID:5460
-
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe88⤵PID:3044
-
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe89⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1716 -
C:\Windows\SysWOW64\inqrggyxc.exeC:\Windows\system32\inqrggyxc.exe90⤵PID:792
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe91⤵PID:5512
-
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe92⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4372 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe93⤵
- System Location Discovery: System Language Discovery
PID:3280 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe94⤵PID:5700
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe95⤵PID:1928
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe96⤵PID:5276
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe97⤵
- Drops file in System32 directory
PID:4448 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe98⤵PID:4608
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe99⤵PID:2924
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe100⤵
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe101⤵PID:4272
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe102⤵
- Drops file in System32 directory
PID:1776 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe103⤵
- Drops file in System32 directory
PID:2124 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe104⤵PID:1108
-
C:\Windows\SysWOW64\inzhpyfbx.exeC:\Windows\system32\inzhpyfbx.exe105⤵PID:4416
-
C:\Windows\SysWOW64\inqzfhsqg.exeC:\Windows\system32\inqzfhsqg.exe106⤵PID:2740
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe107⤵PID:2840
-
C:\Windows\SysWOW64\indtfhlye.exeC:\Windows\system32\indtfhlye.exe108⤵PID:1956
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe109⤵PID:1472
-
C:\Windows\SysWOW64\inftrnfcc.exeC:\Windows\system32\inftrnfcc.exe110⤵PID:4268
-
C:\Windows\SysWOW64\inrxixhwa.exeC:\Windows\system32\inrxixhwa.exe111⤵PID:3152
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe112⤵PID:420
-
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe113⤵PID:4484
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe114⤵PID:5444
-
C:\Windows\SysWOW64\inacgtgkr.exeC:\Windows\system32\inacgtgkr.exe115⤵PID:6072
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe116⤵PID:5856
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe117⤵PID:5380
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe118⤵PID:4344
-
C:\Windows\SysWOW64\inudpxert.exeC:\Windows\system32\inudpxert.exe119⤵PID:1004
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe120⤵PID:1484
-
C:\Windows\SysWOW64\ingfvhjng.exeC:\Windows\system32\ingfvhjng.exe121⤵PID:6076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-