Analysis
- max time kernel
127s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 14:09
Behavioral task
behavioral1
Sample
2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260910-rghcxadk21
- SHA256 c3e9a5ad3efb4e058bc8488d243b424c16015d600c16b2abd8baa76b648bb73c
- MD5 88b97dcebcc68fab6f4232ff4096e104
- SHA1 85c5b0a3ce1b5e148b869e31001b7fd043d03807
- SHA512 dc0547ed05dac3a7df101881170f5f6880d98e24772c8c4999d3c1dcc0045a65aec81ebd263fa3ba17257aab3280802f90f169abf4631b26155e7a734ac7619c
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTG:RPjOa1NxyYtH1G
- TLSH T1E915AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 52 IoCs
resource yara_rule behavioral1/memory/4952-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000a0000000244e6-15.dat family_gh0strat behavioral1/files/0x00070000000245bd-22.dat family_gh0strat behavioral1/memory/3168-39-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2560-48-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245c6-69.dat family_gh0strat behavioral1/memory/1736-131-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245d6-161.dat family_gh0strat behavioral1/memory/2316-647-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3336-631-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1976-612-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3408-593-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4676-555-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2028-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1048-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3780-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3272-496-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2768-472-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3272-468-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1820-459-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1476-422-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/640-418-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2640-401-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4296-381-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245fa-368.dat family_gh0strat behavioral1/memory/752-360-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245f6-345.dat family_gh0strat behavioral1/memory/968-338-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245f2-322.dat family_gh0strat behavioral1/memory/3300-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245ee-299.dat family_gh0strat behavioral1/memory/4252-291-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245ea-276.dat family_gh0strat behavioral1/memory/3776-270-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245e6-253.dat family_gh0strat behavioral1/memory/3844-246-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245e2-230.dat family_gh0strat behavioral1/memory/3808-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245de-207.dat family_gh0strat behavioral1/memory/468-201-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245da-184.dat family_gh0strat behavioral1/memory/2472-177-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2880-153-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245d2-138.dat family_gh0strat behavioral1/files/0x00070000000245ce-115.dat family_gh0strat behavioral1/memory/4776-108-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245ca-92.dat family_gh0strat behavioral1/memory/2560-84-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245c2-46.dat family_gh0strat behavioral1/memory/4952-37-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000255d2-16867.dat family_gh0strat behavioral1/files/0x00070000000261ba-29171.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6A696FD-3E32-44a0-ACF0-98F4A7733934} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A0166BA-3238-4ff3-9B71-580CA7C7A31C}\stubpath = "C:\\Windows\\system32\\inwbpkebv.exe" incbzwztd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53C43160-AE5D-47ff-8B7C-CC49934C3E94}\stubpath = "C:\\Windows\\system32\\inpfkwncn.exe" inndiulal.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D26D6B82-97AA-42be-A81B-18EB6509EDC0} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86D4D0B6-2AC3-49f4-B307-E9D70E0F03C2}\stubpath = "C:\\Windows\\system32\\ingtkolam.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD8BFE32-7709-4e33-9754-80D72949C428}\stubpath = "C:\\Windows\\system32\\inqfeufhj.exe" inrurbsrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C351349E-54B0-4570-A7EA-E6A766F648E2}\stubpath = "C:\\Windows\\system32\\inrtkbsie.exe" inavgkgkt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A2D08E4-FCC1-424e-8063-AF47F0854621} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E207FDA-9A52-4fb9-9137-D5C60DDB1142}\stubpath = "C:\\Windows\\system32\\inycopaqa.exe" inngbnczn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3528F94-8EBA-4a66-9767-83609D5193DB} invxrmxgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D499AECE-D844-4c49-B4DE-1B8D81795ACE} inhgblcvj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1669FDC2-AE82-4423-896C-C560051DB52E}\stubpath = "C:\\Windows\\system32\\inulrjenx.exe" inboxtclv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7D45E70-3C1D-44cb-8587-18C5A114B740}\stubpath = "C:\\Windows\\system32\\infumgnyd.exe" inxitdtqe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F983002C-0FEB-4431-956C-6C1066336301} invapablb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65C946D1-DD34-4458-9486-AA9972DCBFE8}\stubpath = "C:\\Windows\\system32\\inskhcuqg.exe" innboczda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{797E5554-50DF-4417-94CC-5D4E52B4DBC6}\stubpath = "C:\\Windows\\system32\\infagiwpz.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72026D06-CDE9-465b-A0FE-416F5D119FDF}\stubpath = "C:\\Windows\\system32\\inleuzbus.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02BF2FA9-75ED-4c92-9694-C7DDB1D95AF9} inotqnqky.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F155D351-A64C-4bac-BC76-08C74B7E217D}\stubpath = "C:\\Windows\\system32\\inbsbjtei.exe" inttrrtqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F79CA635-48E7-42e6-BF32-3624B5BC0656}\stubpath = "C:\\Windows\\system32\\inyepukgs.exe" invaiaqlz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1ED84E40-C478-43a4-B88D-A254BA8A9494}\stubpath = "C:\\Windows\\system32\\inauxfdek.exe" inycykdza.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F51DFBF-4B78-4fe9-9B66-7A1D7F92F386}\stubpath = "C:\\Windows\\system32\\inlnolpwd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2768C11-9365-496d-9D51-D742FE69CD03}\stubpath = "C:\\Windows\\system32\\inrtvzsdc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F593BD0-A372-4dcc-BF2B-CF2C912083B1}\stubpath = "C:\\Windows\\system32\\inwxsplcy.exe" inqokkwdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF9C5E47-8A56-45df-A4AA-497E9B62264D}\stubpath = "C:\\Windows\\system32\\injegoang.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AF64207-5ACA-443a-899D-20652739F917}\stubpath = "C:\\Windows\\system32\\indvcumfx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2071645B-AD63-4d61-81AE-932BCBD7C8C1}\stubpath = "C:\\Windows\\system32\\inlhcvydw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24D02002-0D23-4f0f-9FC9-D4DD6204AC5A}\stubpath = "C:\\Windows\\system32\\inkmpnlpp.exe" inrhnxdft.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77059470-68D3-4be8-BE7A-DEBBC3F42C3F} ineyyaxuz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE2CF4AF-8229-4147-840B-C50860981EDF}\stubpath = "C:\\Windows\\system32\\intyrdyql.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{858D405F-8C0C-49a7-BD2F-96E94DBAA92C} inqdmufdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C2DA113-007E-4d64-B33F-989F5C21222F} inbgwtosr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DABA944B-6A66-4c45-82F7-F2E16CF8BF18}\stubpath = "C:\\Windows\\system32\\inqfmalkm.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FEEC00FF-C667-4c10-8B0D-889D9ACC11B1} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2768C11-9365-496d-9D51-D742FE69CD03} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{586D8B18-FC92-4ec7-82BC-96923020C8E0}\stubpath = "C:\\Windows\\system32\\inbuxzyre.exe" inomzqrdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A41B59EF-A161-4d88-8D88-18E360450FD6}\stubpath = "C:\\Windows\\system32\\inmvbdomc.exe" ineeenyiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40E46254-69A6-4f62-82A7-219DBD1AE5BF} inqnbrgit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F217F8B-385B-4623-A66E-EF1EBE968424}\stubpath = "C:\\Windows\\system32\\incxuerhz.exe" inxavmale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6372C1E0-C6F8-4d58-9E41-2F7542BC5CA9}\stubpath = "C:\\Windows\\system32\\inyrzjrbh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90BF48DA-BEB6-4eee-B1D6-52DD3F9735C9}\stubpath = "C:\\Windows\\system32\\intxmhybx.exe" inymcufhc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F97F247F-30D9-438a-9013-1D22CD079CFF} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51B21530-9FF7-4dc0-AA39-3479057F121C} inauxfdek.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6961091-DC7E-40ac-9F24-046D82084BE0} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BA2EF2B-759E-465f-91EB-8511DB19DB76}\stubpath = "C:\\Windows\\system32\\inivrjnnh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B8D8A1E-07E4-4967-94CC-82AAE24EDD12}\stubpath = "C:\\Windows\\system32\\inpurorlz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B24D847-BEA5-4be1-9E21-DEED6F86F5E9} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5DCB278-8A72-4cbc-BE92-D813F91943E8}\stubpath = "C:\\Windows\\system32\\inaqjxenk.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4701C40-5B91-4197-AC3E-56A09D63B351} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28962567-308B-4aff-926C-3499964F69E5} inrlmbbts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18198A67-9054-42f4-A85C-C5E7141EC2E3}\stubpath = "C:\\Windows\\system32\\inlrrkalf.exe" inlusoohx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DE73661-B707-48bb-B2CE-5E710A5B7A9D} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72E49861-C235-4415-9980-C86A9AE857A3} inomlwaho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF635C5C-62B3-4abe-B2AC-DE8760F63E0B}\stubpath = "C:\\Windows\\system32\\inklzrrui.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD888302-9E4A-4241-A11C-71416A80F474}\stubpath = "C:\\Windows\\system32\\inbobfwma.exe" inkivmnpx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{706894C3-D5C3-42e6-93DA-42B76104B095}\stubpath = "C:\\Windows\\system32\\inptshptt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F841C1D-7EBC-474d-BB20-6AD41E14B217}\stubpath = "C:\\Windows\\system32\\incajnuiq.exe" infrfqjpo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEDAADEA-C854-4fe2-B522-3C39A11492F3} injwbpnkv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE0D9EF9-440C-485a-9049-353392F80D77} inzvlkiyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{875A8C8B-C4EA-4823-A578-631CAA45FB53}\stubpath = "C:\\Windows\\system32\\insxoqkwb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B9D756A-FFC2-4cb1-912B-A5026359EAF6}\stubpath = "C:\\Windows\\system32\\innxkgbub.exe" inxoqaroc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6F9D318-BB72-4834-8687-0512B8AB5BE7} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BC4A2C6-C866-4fac-8A55-8D2E9B0FCE33}\stubpath = "C:\\Windows\\system32\\inxcfnkrc.exe" inwezaozq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55015D95-3325-47b2-BDD6-837418F47577} Process not Found - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0019000000024453-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3168 inlsmacbt.exe 2560 insohtodl.exe 4776 incrjzdkv.exe 1736 inxtemyti.exe 2880 inwhpwale.exe 2472 inyjbrycn.exe 468 inmeufqjy.exe 3808 injwnoaqy.exe 3844 inadbobmd.exe 3776 inetlfmxc.exe 4252 inzvgovkd.exe 3300 injyqkarh.exe 968 inldtepix.exe 752 inrngsnzc.exe 4296 inuqbjvqf.exe 2640 insvxwpco.exe 1476 incvyzsfr.exe 640 inwixlnmf.exe 1820 inykznpoh.exe 2768 injmdckxk.exe 3272 inoavpdfe.exe 3780 ineybxzdp.exe 1048 intfuikjc.exe 4676 invhwkmle.exe 2028 ingwzqpxx.exe 3408 inefvmlzb.exe 1976 innuocedv.exe 3336 inqcxrfhg.exe 2244 insezthji.exe 2316 indtwnmuu.exe 4304 inhwoipfi.exe 4172 inkzrlbas.exe 4884 inmtnbdcu.exe 4488 inpbwqegf.exe 3940 inscqyokc.exe 3864 infdqdofu.exe 3396 ingtgabri.exe 2268 ingvetxyk.exe 4932 ingvzmksi.exe 1232 inogwahsa.exe 2484 innlypqcs.exe 4668 inwsdlxsh.exe 4280 inhegsgsd.exe 1968 inaexuhtj.exe 2444 inrshhzyd.exe 4744 innqsrkjz.exe 892 inpsutmlb.exe 1240 indpalewk.exe 4972 inbrulkss.exe 4424 inopeewva.exe 1188 inocymrvp.exe 1840 inxtleici.exe 4092 inlofemzm.exe 4492 inaphxbit.exe 1556 inxitdtqe.exe 5156 infumgnyd.exe 5248 intcrvwiy.exe 5344 iniqzgcyz.exe 5432 inhwnltjf.exe 5528 inljyapnv.exe 5616 inrdysgih.exe 5712 inugvjlkd.exe 5800 ineuxonvv.exe 5892 inzloqpih.exe - Loads dropped DLL 64 IoCs
pid Process 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 3168 inlsmacbt.exe 3168 inlsmacbt.exe 2560 insohtodl.exe 2560 insohtodl.exe 4776 incrjzdkv.exe 4776 incrjzdkv.exe 1736 inxtemyti.exe 1736 inxtemyti.exe 2880 inwhpwale.exe 2880 inwhpwale.exe 2472 inyjbrycn.exe 2472 inyjbrycn.exe 468 inmeufqjy.exe 468 inmeufqjy.exe 3808 injwnoaqy.exe 3808 injwnoaqy.exe 3844 inadbobmd.exe 3844 inadbobmd.exe 3776 inetlfmxc.exe 3776 inetlfmxc.exe 4252 inzvgovkd.exe 4252 inzvgovkd.exe 3300 injyqkarh.exe 3300 injyqkarh.exe 968 inldtepix.exe 968 inldtepix.exe 752 inrngsnzc.exe 752 inrngsnzc.exe 4296 inuqbjvqf.exe 4296 inuqbjvqf.exe 2640 insvxwpco.exe 2640 insvxwpco.exe 1476 incvyzsfr.exe 1476 incvyzsfr.exe 640 inwixlnmf.exe 640 inwixlnmf.exe 1820 inykznpoh.exe 1820 inykznpoh.exe 2768 injmdckxk.exe 2768 injmdckxk.exe 3272 inoavpdfe.exe 3272 inoavpdfe.exe 3780 ineybxzdp.exe 3780 ineybxzdp.exe 1048 intfuikjc.exe 1048 intfuikjc.exe 4676 invhwkmle.exe 4676 invhwkmle.exe 2028 ingwzqpxx.exe 2028 ingwzqpxx.exe 3408 inefvmlzb.exe 3408 inefvmlzb.exe 1976 innuocedv.exe 1976 innuocedv.exe 3336 inqcxrfhg.exe 3336 inqcxrfhg.exe 2244 insezthji.exe 2244 insezthji.exe 2316 indtwnmuu.exe 2316 indtwnmuu.exe 4304 inhwoipfi.exe 4304 inhwoipfi.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inckscbjk.exe inljhllwj.exe File opened for modification C:\Windows\SysWOW64\inmfnxnjy.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inbqostfv.exe invrckwrg.exe File opened for modification C:\Windows\SysWOW64\inlgphgbd.exe_lang.ini inqrgtvyi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incibocxs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infacmfam.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzewkdpr.exe File created C:\Windows\SysWOW64\inatwyxqd.exe inruwvobn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjwysrs.exe File created C:\Windows\SysWOW64\incajnuiq.exe infrfqjpo.exe File opened for modification C:\Windows\SysWOW64\inueaqidm.exe_lang.ini innajnacf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqgyjlgf.exe File created C:\Windows\SysWOW64\incixldvq.exe inivlaoql.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inaspaeae.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inknedlyl.exe File opened for modification C:\Windows\SysWOW64\inzoidhik.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inkswwwod.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inxnqhgoo.exe File created C:\Windows\SysWOW64\innwfcplb.exe inzjrnqyi.exe File created C:\Windows\SysWOW64\injwlifkh.exe ingxqnxqy.exe File opened for modification C:\Windows\SysWOW64\inboxtclv.exe_lang.ini injfiqaer.exe File created C:\Windows\SysWOW64\inpmytiuc.exe inenfezbl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat infdqdofu.exe File opened for modification C:\Windows\SysWOW64\inxxjwerl.exe_lang.ini injtmubua.exe File created C:\Windows\SysWOW64\injbpispm.exe Process not Found File opened for modification C:\Windows\SysWOW64\innmevplr.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\indpzjglj.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\infatgojx.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inszagnjs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inoavpdfe.exe File opened for modification C:\Windows\SysWOW64\inyherndc.exe_lang.ini invapablb.exe File opened for modification C:\Windows\SysWOW64\injtmubua.exe_lang.ini inmroafou.exe File created C:\Windows\SysWOW64\indvxhyav.exe Process not Found File opened for modification C:\Windows\SysWOW64\inoqzdzoj.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inthmqkqb.exe File opened for modification C:\Windows\SysWOW64\injyiwuqi.exe_lang.ini inaeepccp.exe File opened for modification C:\Windows\SysWOW64\injfqeotx.exe_lang.ini inlhpjpqs.exe File opened for modification C:\Windows\SysWOW64\indtyatrn.exe_lang.ini inbqzdbaf.exe File created C:\Windows\SysWOW64\inemavgzz.exe Process not Found File created C:\Windows\SysWOW64\inragwryq.exe Process not Found File opened for modification C:\Windows\SysWOW64\inddmxhxc.exe_lang.ini inthmqkqb.exe File created C:\Windows\SysWOW64\inkuaczqt.exe insjarhdx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inofbieyd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuwftrhn.exe File opened for modification C:\Windows\SysWOW64\invqrynpv.exe_lang.ini indtyatrn.exe File created C:\Windows\SysWOW64\intxedkzb.exe ingjdrmaq.exe File opened for modification C:\Windows\SysWOW64\inbjmhcqx.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inuqhjkhl.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\incgzwjvl.exe insnyjjgx.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini inclzteci.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlhzufqa.exe File opened for modification C:\Windows\SysWOW64\indkopbrp.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\ineoqcqwe.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inomaugiq.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inpleqlxa.exe incgzwjvl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injvkjzkm.exe File created C:\Windows\SysWOW64\infxsuasm.exe inwhxahtz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innbpvwku.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indvgidcn.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkzjyci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebmvqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inunzyumh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intfcjrzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language instzcdzl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzwrvbus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhqlgymf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrzweovz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuxuebv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoqadam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbkvfva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intndtuwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuzcxoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innusjmop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthxflas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infuxbnop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incldxuje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intpaiupe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innxqyiqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrtwgusw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incybtpgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inivlaoql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inugvjlkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmhgrmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inypsuvxw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzfdmqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbhrywnq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhgncqwc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 3168 inlsmacbt.exe 3168 inlsmacbt.exe 2560 insohtodl.exe 2560 insohtodl.exe 4776 incrjzdkv.exe 4776 incrjzdkv.exe 1736 inxtemyti.exe 1736 inxtemyti.exe 2880 inwhpwale.exe 2880 inwhpwale.exe 2472 inyjbrycn.exe 2472 inyjbrycn.exe 468 inmeufqjy.exe 468 inmeufqjy.exe 3808 injwnoaqy.exe 3808 injwnoaqy.exe 3844 inadbobmd.exe 3844 inadbobmd.exe 3776 inetlfmxc.exe 3776 inetlfmxc.exe 4252 inzvgovkd.exe 4252 inzvgovkd.exe 3300 injyqkarh.exe 3300 injyqkarh.exe 968 inldtepix.exe 968 inldtepix.exe 752 inrngsnzc.exe 752 inrngsnzc.exe 4296 inuqbjvqf.exe 4296 inuqbjvqf.exe 2640 insvxwpco.exe 2640 insvxwpco.exe 1476 incvyzsfr.exe 1476 incvyzsfr.exe 640 inwixlnmf.exe 640 inwixlnmf.exe 1820 inykznpoh.exe 1820 inykznpoh.exe 2768 injmdckxk.exe 2768 injmdckxk.exe 3272 inoavpdfe.exe 3272 inoavpdfe.exe 3780 ineybxzdp.exe 3780 ineybxzdp.exe 1048 intfuikjc.exe 1048 intfuikjc.exe 4676 invhwkmle.exe 4676 invhwkmle.exe 2028 ingwzqpxx.exe 2028 ingwzqpxx.exe 3408 inefvmlzb.exe 3408 inefvmlzb.exe 1976 innuocedv.exe 1976 innuocedv.exe 3336 inqcxrfhg.exe 3336 inqcxrfhg.exe 2244 insezthji.exe 2244 insezthji.exe 2316 indtwnmuu.exe 2316 indtwnmuu.exe 4304 inhwoipfi.exe 4304 inhwoipfi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 3168 inlsmacbt.exe Token: SeDebugPrivilege 2560 insohtodl.exe Token: SeDebugPrivilege 4776 incrjzdkv.exe Token: SeDebugPrivilege 1736 inxtemyti.exe Token: SeDebugPrivilege 2880 inwhpwale.exe Token: SeDebugPrivilege 2472 inyjbrycn.exe Token: SeDebugPrivilege 468 inmeufqjy.exe Token: SeDebugPrivilege 3808 injwnoaqy.exe Token: SeDebugPrivilege 3844 inadbobmd.exe Token: SeDebugPrivilege 3776 inetlfmxc.exe Token: SeDebugPrivilege 4252 inzvgovkd.exe Token: SeDebugPrivilege 3300 injyqkarh.exe Token: SeDebugPrivilege 968 inldtepix.exe Token: SeDebugPrivilege 752 inrngsnzc.exe Token: SeDebugPrivilege 4296 inuqbjvqf.exe Token: SeDebugPrivilege 2640 insvxwpco.exe Token: SeDebugPrivilege 1476 incvyzsfr.exe Token: SeDebugPrivilege 640 inwixlnmf.exe Token: SeDebugPrivilege 1820 inykznpoh.exe Token: SeDebugPrivilege 2768 injmdckxk.exe Token: SeDebugPrivilege 3272 inoavpdfe.exe Token: SeDebugPrivilege 3780 ineybxzdp.exe Token: SeDebugPrivilege 1048 intfuikjc.exe Token: SeDebugPrivilege 4676 invhwkmle.exe Token: SeDebugPrivilege 2028 ingwzqpxx.exe Token: SeDebugPrivilege 3408 inefvmlzb.exe Token: SeDebugPrivilege 1976 innuocedv.exe Token: SeDebugPrivilege 3336 inqcxrfhg.exe Token: SeDebugPrivilege 2244 insezthji.exe Token: SeDebugPrivilege 2316 indtwnmuu.exe Token: SeDebugPrivilege 4304 inhwoipfi.exe Token: SeDebugPrivilege 4172 inkzrlbas.exe Token: SeDebugPrivilege 4884 inmtnbdcu.exe Token: SeDebugPrivilege 4488 inpbwqegf.exe Token: SeDebugPrivilege 3940 inscqyokc.exe Token: SeDebugPrivilege 3864 infdqdofu.exe Token: SeDebugPrivilege 3396 ingtgabri.exe Token: SeDebugPrivilege 2268 ingvetxyk.exe Token: SeDebugPrivilege 4932 ingvzmksi.exe Token: SeDebugPrivilege 1232 inogwahsa.exe Token: SeDebugPrivilege 2484 innlypqcs.exe Token: SeDebugPrivilege 4668 inwsdlxsh.exe Token: SeDebugPrivilege 4280 inhegsgsd.exe Token: SeDebugPrivilege 1968 inaexuhtj.exe Token: SeDebugPrivilege 2444 inrshhzyd.exe Token: SeDebugPrivilege 4744 innqsrkjz.exe Token: SeDebugPrivilege 892 inpsutmlb.exe Token: SeDebugPrivilege 1240 indpalewk.exe Token: SeDebugPrivilege 4972 inbrulkss.exe Token: SeDebugPrivilege 4424 inopeewva.exe Token: SeDebugPrivilege 1188 inocymrvp.exe Token: SeDebugPrivilege 1840 inxtleici.exe Token: SeDebugPrivilege 4092 inlofemzm.exe Token: SeDebugPrivilege 4492 inaphxbit.exe Token: SeDebugPrivilege 1556 inxitdtqe.exe Token: SeDebugPrivilege 5156 infumgnyd.exe Token: SeDebugPrivilege 5248 intcrvwiy.exe Token: SeDebugPrivilege 5344 iniqzgcyz.exe Token: SeDebugPrivilege 5432 inhwnltjf.exe Token: SeDebugPrivilege 5528 inljyapnv.exe Token: SeDebugPrivilege 5616 inrdysgih.exe Token: SeDebugPrivilege 5712 inugvjlkd.exe Token: SeDebugPrivilege 5800 ineuxonvv.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 3168 inlsmacbt.exe 2560 insohtodl.exe 4776 incrjzdkv.exe 1736 inxtemyti.exe 2880 inwhpwale.exe 2472 inyjbrycn.exe 468 inmeufqjy.exe 3808 injwnoaqy.exe 3844 inadbobmd.exe 3776 inetlfmxc.exe 4252 inzvgovkd.exe 3300 injyqkarh.exe 968 inldtepix.exe 752 inrngsnzc.exe 4296 inuqbjvqf.exe 2640 insvxwpco.exe 1476 incvyzsfr.exe 640 inwixlnmf.exe 1820 inykznpoh.exe 2768 injmdckxk.exe 3272 inoavpdfe.exe 3780 ineybxzdp.exe 1048 intfuikjc.exe 4676 invhwkmle.exe 2028 ingwzqpxx.exe 3408 inefvmlzb.exe 1976 innuocedv.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 3168 4952 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 85 PID 3168 wrote to memory of 2560 3168 inlsmacbt.exe 86 PID 2560 wrote to memory of 4776 2560 insohtodl.exe 87 PID 4776 wrote to memory of 1736 4776 incrjzdkv.exe 88 PID 1736 wrote to memory of 2880 1736 inxtemyti.exe 89 PID 2880 wrote to memory of 2472 2880 inwhpwale.exe 90 PID 2472 wrote to memory of 468 2472 inyjbrycn.exe 91 PID 468 wrote to memory of 3808 468 inmeufqjy.exe 92 PID 3808 wrote to memory of 3844 3808 injwnoaqy.exe 93 PID 3844 wrote to memory of 3776 3844 inadbobmd.exe 94 PID 3776 wrote to memory of 4252 3776 inetlfmxc.exe 95 PID 4252 wrote to memory of 3300 4252 inzvgovkd.exe 96 PID 3300 wrote to memory of 968 3300 injyqkarh.exe 97 PID 968 wrote to memory of 752 968 inldtepix.exe 98 PID 752 wrote to memory of 4296 752 inrngsnzc.exe 99 PID 4296 wrote to memory of 2640 4296 inuqbjvqf.exe 100 PID 2640 wrote to memory of 1476 2640 insvxwpco.exe 101 PID 1476 wrote to memory of 640 1476 incvyzsfr.exe 102 PID 640 wrote to memory of 1820 640 inwixlnmf.exe 103 PID 1820 wrote to memory of 2768 1820 inykznpoh.exe 104 PID 2768 wrote to memory of 3272 2768 injmdckxk.exe 105 PID 3272 wrote to memory of 3780 3272 inoavpdfe.exe 106 PID 3780 wrote to memory of 1048 3780 ineybxzdp.exe 107 PID 1048 wrote to memory of 4676 1048 intfuikjc.exe 108 PID 4676 wrote to memory of 2028 4676 invhwkmle.exe 109 PID 2028 wrote to memory of 3408 2028 ingwzqpxx.exe 110 PID 3408 wrote to memory of 1976 3408 inefvmlzb.exe 111 PID 1976 wrote to memory of 3336 1976 innuocedv.exe 112 PID 3336 wrote to memory of 2244 3336 inqcxrfhg.exe 113 PID 2244 wrote to memory of 2316 2244 insezthji.exe 114 PID 2316 wrote to memory of 4304 2316 indtwnmuu.exe 115 PID 4304 wrote to memory of 4172 4304 inhwoipfi.exe 116 PID 4172 wrote to memory of 4884 4172 inkzrlbas.exe 117 PID 4884 wrote to memory of 4488 4884 inmtnbdcu.exe 118 PID 4488 wrote to memory of 3940 4488 inpbwqegf.exe 119 PID 3940 wrote to memory of 3864 3940 inscqyokc.exe 120 PID 3864 wrote to memory of 3396 3864 infdqdofu.exe 121 PID 3396 wrote to memory of 2268 3396 ingtgabri.exe 122 PID 2268 wrote to memory of 4932 2268 ingvetxyk.exe 123 PID 4932 wrote to memory of 1232 4932 ingvzmksi.exe 124 PID 1232 wrote to memory of 2484 1232 inogwahsa.exe 125 PID 2484 wrote to memory of 4668 2484 innlypqcs.exe 126 PID 4668 wrote to memory of 4280 4668 inwsdlxsh.exe 127 PID 4280 wrote to memory of 1968 4280 inhegsgsd.exe 128 PID 1968 wrote to memory of 2444 1968 inaexuhtj.exe 129 PID 2444 wrote to memory of 4744 2444 inrshhzyd.exe 130 PID 4744 wrote to memory of 892 4744 innqsrkjz.exe 131 PID 892 wrote to memory of 1240 892 inpsutmlb.exe 132 PID 1240 wrote to memory of 4972 1240 indpalewk.exe 133 PID 4972 wrote to memory of 4424 4972 inbrulkss.exe 134 PID 4424 wrote to memory of 1188 4424 inopeewva.exe 135 PID 1188 wrote to memory of 1840 1188 inocymrvp.exe 136 PID 1840 wrote to memory of 4092 1840 inxtleici.exe 137 PID 4092 wrote to memory of 4492 4092 inlofemzm.exe 138 PID 4492 wrote to memory of 1556 4492 inaphxbit.exe 139 PID 1556 wrote to memory of 5156 1556 inxitdtqe.exe 140 PID 5156 wrote to memory of 5248 5156 infumgnyd.exe 141 PID 5248 wrote to memory of 5344 5248 intcrvwiy.exe 142 PID 5344 wrote to memory of 5432 5344 iniqzgcyz.exe 143 PID 5432 wrote to memory of 5528 5432 inhwnltjf.exe 144 PID 5528 wrote to memory of 5616 5528 inljyapnv.exe 145 PID 5616 wrote to memory of 5712 5616 inrdysgih.exe 146 PID 5712 wrote to memory of 5800 5712 inugvjlkd.exe 147 PID 5800 wrote to memory of 5892 5800 ineuxonvv.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe56⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe65⤵
- Executes dropped EXE
PID:5892 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe66⤵
- Drops file in System32 directory
PID:5976 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe67⤵PID:6080
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe68⤵PID:3740
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe69⤵PID:4416
-
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe70⤵PID:3248
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe71⤵PID:5008
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe72⤵PID:4708
-
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe73⤵PID:5436
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe74⤵PID:1140
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe75⤵PID:5684
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe76⤵PID:1704
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe77⤵PID:1560
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe78⤵PID:2168
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe79⤵PID:3500
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe80⤵PID:4360
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe81⤵
- Drops file in System32 directory
PID:1656 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe82⤵PID:4256
-
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe83⤵
- Drops file in System32 directory
PID:952 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe84⤵
- Drops file in System32 directory
PID:5164 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe85⤵PID:5264
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe86⤵PID:5352
-
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe87⤵
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe88⤵PID:5508
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe89⤵PID:5604
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe90⤵
- System Location Discovery: System Language Discovery
PID:5676 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe91⤵PID:5768
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe92⤵PID:5852
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe93⤵PID:5956
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe94⤵PID:6040
-
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe95⤵PID:6140
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe96⤵PID:732
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe97⤵PID:2412
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe98⤵PID:4452
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe99⤵PID:868
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe100⤵PID:1740
-
C:\Windows\SysWOW64\inbuzcxoc.exeC:\Windows\system32\inbuzcxoc.exe101⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe102⤵
- Drops file in System32 directory
PID:4680 -
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe103⤵PID:5524
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe104⤵PID:4396
-
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe105⤵PID:2068
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe106⤵PID:1608
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe107⤵
- Drops file in System32 directory
PID:956 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe108⤵PID:2400
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe109⤵PID:4572
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe110⤵PID:3848
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe111⤵PID:4604
-
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe112⤵PID:60
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe113⤵PID:1768
-
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe114⤵PID:5180
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe115⤵
- Drops file in System32 directory
PID:5284 -
C:\Windows\SysWOW64\inujlcwuk.exeC:\Windows\system32\inujlcwuk.exe116⤵PID:4848
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe117⤵
- System Location Discovery: System Language Discovery
PID:5620 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe118⤵PID:5496
-
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe119⤵PID:5580
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe120⤵PID:5652
-
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-