Analysis
- max time kernel
81s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 14:09
Behavioral task
behavioral1
Sample
2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260910-rghcxadk21
- SHA256 c3e9a5ad3efb4e058bc8488d243b424c16015d600c16b2abd8baa76b648bb73c
- MD5 88b97dcebcc68fab6f4232ff4096e104
- SHA1 85c5b0a3ce1b5e148b869e31001b7fd043d03807
- SHA512 dc0547ed05dac3a7df101881170f5f6880d98e24772c8c4999d3c1dcc0045a65aec81ebd263fa3ba17257aab3280802f90f169abf4631b26155e7a734ac7619c
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTG:RPjOa1NxyYtH1G
- TLSH T1E915AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/2340-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c48c-19.dat family_gh0strat behavioral2/memory/2340-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a0-39.dat family_gh0strat behavioral2/memory/5532-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a4-64.dat family_gh0strat behavioral2/memory/2936-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3824-98-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ac-109.dat family_gh0strat behavioral2/files/0x000d00000001c4b0-131.dat family_gh0strat behavioral2/memory/2916-246-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d7-289.dat family_gh0strat behavioral2/memory/4936-554-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1344-607-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/252-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5560-572-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5136-536-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3140-518-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4120-500-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3568-482-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1648-464-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2792-446-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5680-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2964-410-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2724-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1684-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4656-356-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e3-352.dat family_gh0strat behavioral2/memory/1480-334-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4df-330.dat family_gh0strat behavioral2/memory/6064-311-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4db-308.dat family_gh0strat behavioral2/memory/5300-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5716-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d3-264.dat family_gh0strat behavioral2/files/0x000d00000001c4cf-242.dat family_gh0strat behavioral2/memory/1232-224-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c0-220.dat family_gh0strat behavioral2/memory/4884-202-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4bc-198.dat family_gh0strat behavioral2/memory/5344-180-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b8-176.dat family_gh0strat behavioral2/memory/2780-158-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b4-154.dat family_gh0strat behavioral2/memory/2756-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5648-114-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a8-87.dat family_gh0strat behavioral2/memory/5532-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c49f-31.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BAF56DB-F55F-4722-B464-F173C42DB63B} infjxbrqx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3618CD8-DB18-4759-A1FC-3F886E1368F5} intxmhybx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C3A6BB2-D98F-41e8-A8F4-24BF192AF988}\stubpath = "C:\\Windows\\system32\\injwylczx.exe" indtfhlye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84F082C7-8EFB-4a24-857F-D104E7488752}\stubpath = "C:\\Windows\\system32\\injvkjzkm.exe" infzzbyva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1824F713-02CC-41e6-BCF5-5029957FACDB}\stubpath = "C:\\Windows\\system32\\inaikwkwh.exe" indwezqep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4147B22-10E2-47c7-8FC7-ACCA972EA0D7}\stubpath = "C:\\Windows\\system32\\inuydrpyf.exe" inbpxnjbw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7917E286-8361-409d-B699-F511320E02EF} inionprva.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7846C079-D699-4753-B0DC-EE6AD9823DB2} inwtdautu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F136288B-38AF-4ce1-9C58-40B509622BBC}\stubpath = "C:\\Windows\\system32\\infcpjolj.exe" inwonikuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11E72B18-0E7B-4216-85C4-AB847685BF77}\stubpath = "C:\\Windows\\system32\\inpljrdzf.exe" inxdmghfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90DD8DFF-36DE-4a4e-BCF5-9FBD5660ADAB}\stubpath = "C:\\Windows\\system32\\inuloqrtx.exe" inlubyhti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58B30859-1C1E-4160-A834-180CBF2993F1}\stubpath = "C:\\Windows\\system32\\inpdlvxfh.exe" inumafjdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACB2DAA3-62DE-4796-8002-31BD62111EFF}\stubpath = "C:\\Windows\\system32\\inkvbdqbu.exe" inckscbjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E88D4CFD-F484-407c-BD9F-C83CF2FF60C2} inrxixhwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1F71EA3-8ABB-4089-B291-2D9356A27F87} inlgwrccv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24761455-4767-4671-A7CA-70F44F63498C}\stubpath = "C:\\Windows\\system32\\inzjwmbpr.exe" inyctgpxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85E85DDF-3F35-486e-B05F-F3FF30EF64C8}\stubpath = "C:\\Windows\\system32\\inxiaqxbm.exe" inwsdlxsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75BA29FC-92C4-4465-9ECB-CA1931F8D3D2}\stubpath = "C:\\Windows\\system32\\injkrqgyq.exe" inertnmni.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2C99706-0842-4c39-A825-96E1D1D946B1} intekobge.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26227E6C-B706-40d4-B5E0-0AD920885B27} inhuwzjax.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15C8785C-6D31-460a-8ADB-8C7D245BC047} inrnisxfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03F93CBB-756A-403e-94C9-4D0B58C5CD53}\stubpath = "C:\\Windows\\system32\\inaexuhtj.exe" inetlfmxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97C283CE-AEF2-4c1e-A814-A85290653EE5}\stubpath = "C:\\Windows\\system32\\inwtyvsvp.exe" initcmsrt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0447081-A6AC-42cd-B8B2-4663C8DEEDFE} inhfbqsjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EBC1C7E-C565-4fd7-A3DC-7F9503103324}\stubpath = "C:\\Windows\\system32\\inbohznex.exe" inbnjcuis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DAEB302-EFA4-4650-B432-69F05C6F0161}\stubpath = "C:\\Windows\\system32\\insdtdypv.exe" inztkqidm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58FA4721-B002-4400-B7FC-1C6AEE2B54DF} invzesqzg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EEF439D6-CD28-4b12-A5AC-19CF8B189148} inixomukg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F36124DA-1030-4921-8720-1E066510A5FD}\stubpath = "C:\\Windows\\system32\\inlmnyysj.exe" insywlfel.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44D52A51-FA9F-4f5a-90C5-BFA1A1C1565D} inrvkfwvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24CFE407-6A1D-481f-B1FA-BFEFE27A8B63}\stubpath = "C:\\Windows\\system32\\inxqlnlfy.exe" intwamnoz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D72E0EE-C34D-414b-AB22-52B504F9DE45} invqmdynu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E329C07E-67A7-41a3-840D-66C0A9D4B60D}\stubpath = "C:\\Windows\\system32\\incldxuje.exe" invtfsnjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DBF7F48-E2A6-4d61-9934-862554054772} inboqtdrp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77181DC1-FBAA-4399-B3E3-DEDD364CFF0F}\stubpath = "C:\\Windows\\system32\\inbjwysrs.exe" inhwnltjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01BC7600-CF6D-46d9-9667-9234E3142115} inbrulkss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{755E3259-B967-4bfd-A718-BE4769353D90} ingatvyvf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{782A0419-47C4-433e-80CD-6E1493CECB2A} incxuerhz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD0200E9-6FF7-4545-A0E3-5D2AE7855723} inmwmixdn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78B9285B-B8AA-4a81-A300-DC9DE085F073}\stubpath = "C:\\Windows\\system32\\inipelkjl.exe" inmwepkwe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77181DC1-FBAA-4399-B3E3-DEDD364CFF0F} inhwnltjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45F9C773-D10C-4f64-A4EB-837F5F681860} insrzztuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B44FCCA-A280-458e-906A-52E18CA493A6} inboqtqar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C86D5E3-7DC9-456d-8E9D-3618D966E59A}\stubpath = "C:\\Windows\\system32\\ingcmtril.exe" iniizepdz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D1FFDDA-6DDC-493c-AA21-6F993CC446B7} inktojpiu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBE6BAFA-BB14-4ab8-AA5D-C4E9088DB5E7}\stubpath = "C:\\Windows\\system32\\inxnewqnc.exe" iniqgcwmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54C2E141-8F4F-401b-9F0D-0636108C39ED}\stubpath = "C:\\Windows\\system32\\inxujybfr.exe" injavkrnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B7F0A95-2B29-4ac5-B043-9892F15CEA83} inmqlrpew.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C16F6F3-7568-4dfd-B526-FA269F630AC1} inscqyokc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC8CE342-03D7-4ab6-87AD-9D1DF2BE4316} inhscspdt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61A664E3-ABA3-4f38-A914-26D3121F2735} inrurbsrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7846C079-D699-4753-B0DC-EE6AD9823DB2}\stubpath = "C:\\Windows\\system32\\inisglpjp.exe" inwtdautu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F71CF755-A574-466b-955A-F82F02CCF111} inxgaoyjn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A6375BD-62FD-4502-8867-3C5D117B4B82} inlmnyysj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61D5781F-CBB4-4734-98E7-37D8ACF6A3FA} inbaqbdfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF272AFF-776D-4f34-8D35-C394957D9581} innhouwkt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{205D8A21-A5F1-4665-BE9D-972F4D343DF5}\stubpath = "C:\\Windows\\system32\\inknedlyl.exe" inbfyviuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B641069B-F39C-4a30-817B-9CAD5BAD6096}\stubpath = "C:\\Windows\\system32\\ingfvhjng.exe" inuhqyjhd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4AACE336-69B0-4688-A2D4-6A613C570E14} injqftzfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61D5781F-CBB4-4734-98E7-37D8ACF6A3FA}\stubpath = "C:\\Windows\\system32\\indvgidcn.exe" inbaqbdfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8284D3CB-A61D-422e-A082-F1B845D9D88F}\stubpath = "C:\\Windows\\system32\\inpcoeybx.exe" inhbwuioq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEEA2688-C34C-4c23-8706-803568BAB48D}\stubpath = "C:\\Windows\\system32\\inkivmnpx.exe" indvjzcoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8ED5368B-63E6-4d72-9D44-B0E09BF00DEB} inacgtgkr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCA6263A-AF4E-4eeb-B466-2961A6F979B1}\stubpath = "C:\\Windows\\system32\\indzleble.exe" inkxncqsn.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000019ca4-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3824 inyufnzuj.exe 5532 inzkcszdo.exe 2936 inaphxbit.exe 5648 indwztgsi.exe 2756 inpleqlxa.exe 2780 incrjzdkv.exe 5344 inhwoipfi.exe 4884 innqsrkjz.exe 1232 inrdysgih.exe 2916 inwixlnmf.exe 5716 intsuvkkg.exe 5300 insvxwpco.exe 6064 inwhpwale.exe 1480 inqmfrmyb.exe 4656 invrckwrg.exe 1684 ingtgabri.exe 2724 inmeufqjy.exe 2964 inadbobmd.exe 5680 inxhvtpha.exe 2792 inldtepix.exe 1648 inazpsjiq.exe 3568 ineuxonvv.exe 4120 inrfpuysy.exe 3140 inomzqrdt.exe 5136 inixpjqgj.exe 4936 inhwnltjf.exe 5560 inbjwysrs.exe 252 intcrvwiy.exe 1344 inxsdoolp.exe 5408 inscqyokc.exe 1584 ineeenyiy.exe 6124 inmtnbdcu.exe 5368 inqklaasr.exe 4512 inpqffxwb.exe 1196 inpsutmlb.exe 4384 intfuikjc.exe 4564 inahuhbcs.exe 4452 innuocedv.exe 5512 insezthji.exe 4216 inxjymong.exe 780 inortslka.exe 4404 inatwyxqd.exe 3340 inykznpoh.exe 5696 invuwaxma.exe 1972 inbuxzyre.exe 3876 inhwfuyzl.exe 5128 inbmkzbqa.exe 5124 invhwkmle.exe 4280 inigtklnv.exe 1992 inxitdtqe.exe 5508 inbfyviuk.exe 2648 inknedlyl.exe 4556 inhzrfkoi.exe 4844 ingvnhoze.exe 2324 inlsmacbt.exe 5068 intpaiupe.exe 3236 inqgdzfrf.exe 5856 injyiwuqi.exe 3536 inyegrpfl.exe 3452 inruwvobn.exe 2024 indtwnmuu.exe 3508 inmprqjiy.exe 4660 indxawycz.exe 2720 infhthtec.exe - Loads dropped DLL 64 IoCs
pid Process 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 3824 inyufnzuj.exe 3824 inyufnzuj.exe 5532 inzkcszdo.exe 5532 inzkcszdo.exe 2936 inaphxbit.exe 2936 inaphxbit.exe 5648 indwztgsi.exe 5648 indwztgsi.exe 2756 inpleqlxa.exe 2756 inpleqlxa.exe 2780 incrjzdkv.exe 2780 incrjzdkv.exe 5344 inhwoipfi.exe 5344 inhwoipfi.exe 4884 innqsrkjz.exe 4884 innqsrkjz.exe 1232 inrdysgih.exe 1232 inrdysgih.exe 2916 inwixlnmf.exe 2916 inwixlnmf.exe 5716 intsuvkkg.exe 5716 intsuvkkg.exe 5300 insvxwpco.exe 5300 insvxwpco.exe 6064 inwhpwale.exe 6064 inwhpwale.exe 1480 inqmfrmyb.exe 1480 inqmfrmyb.exe 4656 invrckwrg.exe 4656 invrckwrg.exe 1684 ingtgabri.exe 1684 ingtgabri.exe 2724 inmeufqjy.exe 2724 inmeufqjy.exe 2964 inadbobmd.exe 2964 inadbobmd.exe 5680 inxhvtpha.exe 5680 inxhvtpha.exe 2792 inldtepix.exe 2792 inldtepix.exe 1648 inazpsjiq.exe 1648 inazpsjiq.exe 3568 ineuxonvv.exe 3568 ineuxonvv.exe 4120 inrfpuysy.exe 4120 inrfpuysy.exe 3140 inomzqrdt.exe 3140 inomzqrdt.exe 5136 inixpjqgj.exe 5136 inixpjqgj.exe 4936 inhwnltjf.exe 4936 inhwnltjf.exe 5560 inbjwysrs.exe 5560 inbjwysrs.exe 252 intcrvwiy.exe 252 intcrvwiy.exe 1344 inxsdoolp.exe 1344 inxsdoolp.exe 5408 inscqyokc.exe 5408 inscqyokc.exe 1584 ineeenyiy.exe 1584 ineeenyiy.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inucxmxol.exe File opened for modification C:\Windows\SysWOW64\inogwahsa.exe_lang.ini injyqkarh.exe File opened for modification C:\Windows\SysWOW64\infjxbrqx.exe_lang.ini inqfeufhj.exe File opened for modification C:\Windows\SysWOW64\inbkyszdb.exe_lang.ini inpkfxleq.exe File opened for modification C:\Windows\SysWOW64\inxbftvlo.exe_lang.ini inxavmale.exe File created C:\Windows\SysWOW64\inkbytnkt.exe innvcvbrm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injflluak.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlmosntr.exe File created C:\Windows\SysWOW64\inrcangym.exe inyteppma.exe File opened for modification C:\Windows\SysWOW64\inudpxert.exe_lang.ini inepndjtb.exe File opened for modification C:\Windows\SysWOW64\inxrqyyst.exe_lang.ini inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\inquussur.exe_lang.ini innnpmjol.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inadbobmd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkzrlbas.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmkimmxk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invhauplr.exe File created C:\Windows\SysWOW64\inmtnbdcu.exe ineeenyiy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innkietvm.exe File created C:\Windows\SysWOW64\inckscbjk.exe inhrtbdgd.exe File opened for modification C:\Windows\SysWOW64\inucxmxol.exe_lang.ini inyegtexf.exe File opened for modification C:\Windows\SysWOW64\inddmxhxc.exe_lang.ini infsuonoj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmkxopbr.exe File opened for modification C:\Windows\SysWOW64\inniucjdf.exe_lang.ini inrgfvgik.exe File created C:\Windows\SysWOW64\inmflkmos.exe injfqeotx.exe File opened for modification C:\Windows\SysWOW64\inqfeufhj.exe_lang.ini injqftzfq.exe File created C:\Windows\SysWOW64\inoioprby.exe inwbpkebv.exe File opened for modification C:\Windows\SysWOW64\invrckwrg.exe_lang.ini inqmfrmyb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indvjzcoq.exe File opened for modification C:\Windows\SysWOW64\inwemzvcu.exe_lang.ini indbxwxmz.exe File created C:\Windows\SysWOW64\inacgtgkr.exe ingyagyjp.exe File created C:\Windows\SysWOW64\inlnqnzon.exe inxqlnlfy.exe File opened for modification C:\Windows\SysWOW64\intxmhybx.exe_lang.ini ingvfeugi.exe File opened for modification C:\Windows\SysWOW64\inceohcod.exe_lang.ini indlvgkyq.exe File created C:\Windows\SysWOW64\inngmlnpt.exe indtosnaj.exe File created C:\Windows\SysWOW64\inupalliz.exe innusjmop.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innvcvbrm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insqkrbxb.exe File opened for modification C:\Windows\SysWOW64\inyxgeiit.exe_lang.ini inwjfatav.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyufnzuj.exe File opened for modification C:\Windows\SysWOW64\inyoeaukm.exe_lang.ini inngmlnpt.exe File opened for modification C:\Windows\SysWOW64\innptoush.exe_lang.ini inshvhsxn.exe File created C:\Windows\SysWOW64\inebdvara.exe inykxcqol.exe File opened for modification C:\Windows\SysWOW64\insahbdsg.exe_lang.ini inngbnczn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infsuonoj.exe File opened for modification C:\Windows\SysWOW64\invnbgkek.exe_lang.ini infslrijv.exe File opened for modification C:\Windows\SysWOW64\insofpwae.exe_lang.ini inxtleici.exe File created C:\Windows\SysWOW64\invqlrkwy.exe inzavthnp.exe File created C:\Windows\SysWOW64\inttrrtqn.exe intbpxrhx.exe File opened for modification C:\Windows\SysWOW64\inwldhtuf.exe_lang.ini infvqbbup.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingkycsra.exe File opened for modification C:\Windows\SysWOW64\ingjdrmaq.exe_lang.ini inkdlvlhw.exe File created C:\Windows\SysWOW64\inetlfmxc.exe inwmpgfnn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indrzpldy.exe File created C:\Windows\SysWOW64\inshvhsxn.exe invgvfzue.exe File created C:\Windows\SysWOW64\insanriau.exe inwizvaom.exe File created C:\Windows\SysWOW64\inixomukg.exe inaexuhtj.exe File opened for modification C:\Windows\SysWOW64\intetdxsy.exe_lang.ini inkhtihxi.exe File opened for modification C:\Windows\SysWOW64\inlaxcmgz.exe_lang.ini inbuzcxoc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inncprues.exe File created C:\Windows\SysWOW64\ingtvpopk.exe inhqlgymf.exe File opened for modification C:\Windows\SysWOW64\inapytoun.exe_lang.ini inxuxrboe.exe File opened for modification C:\Windows\SysWOW64\ineeenyiy.exe_lang.ini inscqyokc.exe File created C:\Windows\SysWOW64\inhjvjvge.exe inpfzcyeq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inthxpach.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirmhzng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniujiyjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intlkfhrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegtexf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlynkhmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsvnris.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inetlfmxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingerepgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmeufqjy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inixpjqgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injsnioht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invkhejgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgisalg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invecggre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indkntxkp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbaqbdfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqjpgzht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inujqmuoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykxcqol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgispe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incxuerhz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innpclapa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebmvqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inivlaoql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrggyxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuytzxmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtvpopk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmwmixdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwjfatav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqjvuqid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomzqrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsfowhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupalliz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invspsmvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineybxzdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invirzkie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkimmxk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invuwaxma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyvkzcgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innqsrkjz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuxzyre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inihodrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmwepkwe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insqkrbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykznpoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfyviuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyixbhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwgusogd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inotztfuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniszaxor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infbnvcjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intcrvwiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inruwvobn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingoxeawx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkivmnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbaqtkjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdmufdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatwyxqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inujlcwuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inesqmezb.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 3824 inyufnzuj.exe 3824 inyufnzuj.exe 5532 inzkcszdo.exe 5532 inzkcszdo.exe 2936 inaphxbit.exe 2936 inaphxbit.exe 5648 indwztgsi.exe 5648 indwztgsi.exe 2756 inpleqlxa.exe 2756 inpleqlxa.exe 2780 incrjzdkv.exe 2780 incrjzdkv.exe 5344 inhwoipfi.exe 5344 inhwoipfi.exe 4884 innqsrkjz.exe 4884 innqsrkjz.exe 1232 inrdysgih.exe 1232 inrdysgih.exe 2916 inwixlnmf.exe 2916 inwixlnmf.exe 5716 intsuvkkg.exe 5716 intsuvkkg.exe 5300 insvxwpco.exe 5300 insvxwpco.exe 6064 inwhpwale.exe 6064 inwhpwale.exe 1480 inqmfrmyb.exe 1480 inqmfrmyb.exe 4656 invrckwrg.exe 4656 invrckwrg.exe 1684 ingtgabri.exe 1684 ingtgabri.exe 2724 inmeufqjy.exe 2724 inmeufqjy.exe 2964 inadbobmd.exe 2964 inadbobmd.exe 5680 inxhvtpha.exe 5680 inxhvtpha.exe 2792 inldtepix.exe 2792 inldtepix.exe 1648 inazpsjiq.exe 1648 inazpsjiq.exe 3568 ineuxonvv.exe 3568 ineuxonvv.exe 4120 inrfpuysy.exe 4120 inrfpuysy.exe 3140 inomzqrdt.exe 3140 inomzqrdt.exe 5136 inixpjqgj.exe 5136 inixpjqgj.exe 4936 inhwnltjf.exe 4936 inhwnltjf.exe 5560 inbjwysrs.exe 5560 inbjwysrs.exe 252 intcrvwiy.exe 252 intcrvwiy.exe 1344 inxsdoolp.exe 1344 inxsdoolp.exe 5408 inscqyokc.exe 5408 inscqyokc.exe 1584 ineeenyiy.exe 1584 ineeenyiy.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 3824 inyufnzuj.exe Token: SeDebugPrivilege 5532 inzkcszdo.exe Token: SeDebugPrivilege 2936 inaphxbit.exe Token: SeDebugPrivilege 5648 indwztgsi.exe Token: SeDebugPrivilege 2756 inpleqlxa.exe Token: SeDebugPrivilege 2780 incrjzdkv.exe Token: SeDebugPrivilege 5344 inhwoipfi.exe Token: SeDebugPrivilege 4884 innqsrkjz.exe Token: SeDebugPrivilege 1232 inrdysgih.exe Token: SeDebugPrivilege 2916 inwixlnmf.exe Token: SeDebugPrivilege 5716 intsuvkkg.exe Token: SeDebugPrivilege 5300 insvxwpco.exe Token: SeDebugPrivilege 6064 inwhpwale.exe Token: SeDebugPrivilege 1480 inqmfrmyb.exe Token: SeDebugPrivilege 4656 invrckwrg.exe Token: SeDebugPrivilege 1684 ingtgabri.exe Token: SeDebugPrivilege 2724 inmeufqjy.exe Token: SeDebugPrivilege 2964 inadbobmd.exe Token: SeDebugPrivilege 5680 inxhvtpha.exe Token: SeDebugPrivilege 2792 inldtepix.exe Token: SeDebugPrivilege 1648 inazpsjiq.exe Token: SeDebugPrivilege 3568 ineuxonvv.exe Token: SeDebugPrivilege 4120 inrfpuysy.exe Token: SeDebugPrivilege 3140 inomzqrdt.exe Token: SeDebugPrivilege 5136 inixpjqgj.exe Token: SeDebugPrivilege 4936 inhwnltjf.exe Token: SeDebugPrivilege 5560 inbjwysrs.exe Token: SeDebugPrivilege 252 intcrvwiy.exe Token: SeDebugPrivilege 1344 inxsdoolp.exe Token: SeDebugPrivilege 5408 inscqyokc.exe Token: SeDebugPrivilege 1584 ineeenyiy.exe Token: SeDebugPrivilege 6124 inmtnbdcu.exe Token: SeDebugPrivilege 5368 inqklaasr.exe Token: SeDebugPrivilege 4512 inpqffxwb.exe Token: SeDebugPrivilege 1196 inpsutmlb.exe Token: SeDebugPrivilege 4384 intfuikjc.exe Token: SeDebugPrivilege 4564 inahuhbcs.exe Token: SeDebugPrivilege 4452 innuocedv.exe Token: SeDebugPrivilege 5512 insezthji.exe Token: SeDebugPrivilege 4216 inxjymong.exe Token: SeDebugPrivilege 780 inortslka.exe Token: SeDebugPrivilege 4404 inatwyxqd.exe Token: SeDebugPrivilege 3340 inykznpoh.exe Token: SeDebugPrivilege 5696 invuwaxma.exe Token: SeDebugPrivilege 1972 inbuxzyre.exe Token: SeDebugPrivilege 3876 inhwfuyzl.exe Token: SeDebugPrivilege 5128 inbmkzbqa.exe Token: SeDebugPrivilege 5124 invhwkmle.exe Token: SeDebugPrivilege 4280 inigtklnv.exe Token: SeDebugPrivilege 1992 inxitdtqe.exe Token: SeDebugPrivilege 5508 inbfyviuk.exe Token: SeDebugPrivilege 2648 inknedlyl.exe Token: SeDebugPrivilege 4556 inhzrfkoi.exe Token: SeDebugPrivilege 4844 ingvnhoze.exe Token: SeDebugPrivilege 2324 inlsmacbt.exe Token: SeDebugPrivilege 5068 intpaiupe.exe Token: SeDebugPrivilege 3236 inqgdzfrf.exe Token: SeDebugPrivilege 5856 injyiwuqi.exe Token: SeDebugPrivilege 3536 inyegrpfl.exe Token: SeDebugPrivilege 3452 inruwvobn.exe Token: SeDebugPrivilege 2024 indtwnmuu.exe Token: SeDebugPrivilege 3508 inmprqjiy.exe Token: SeDebugPrivilege 4660 indxawycz.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 3824 inyufnzuj.exe 5532 inzkcszdo.exe 2936 inaphxbit.exe 5648 indwztgsi.exe 2756 inpleqlxa.exe 2780 incrjzdkv.exe 5344 inhwoipfi.exe 4884 innqsrkjz.exe 1232 inrdysgih.exe 2916 inwixlnmf.exe 5716 intsuvkkg.exe 5300 insvxwpco.exe 6064 inwhpwale.exe 1480 inqmfrmyb.exe 4656 invrckwrg.exe 1684 ingtgabri.exe 2724 inmeufqjy.exe 2964 inadbobmd.exe 5680 inxhvtpha.exe 2792 inldtepix.exe 1648 inazpsjiq.exe 3568 ineuxonvv.exe 4120 inrfpuysy.exe 3140 inomzqrdt.exe 5136 inixpjqgj.exe 4936 inhwnltjf.exe 5560 inbjwysrs.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 3824 2340 2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 3824 wrote to memory of 5532 3824 inyufnzuj.exe 90 PID 5532 wrote to memory of 2936 5532 inzkcszdo.exe 91 PID 2936 wrote to memory of 5648 2936 inaphxbit.exe 92 PID 5648 wrote to memory of 2756 5648 indwztgsi.exe 93 PID 2756 wrote to memory of 2780 2756 inpleqlxa.exe 94 PID 2780 wrote to memory of 5344 2780 incrjzdkv.exe 95 PID 5344 wrote to memory of 4884 5344 inhwoipfi.exe 96 PID 4884 wrote to memory of 1232 4884 innqsrkjz.exe 97 PID 1232 wrote to memory of 2916 1232 inrdysgih.exe 98 PID 2916 wrote to memory of 5716 2916 inwixlnmf.exe 99 PID 5716 wrote to memory of 5300 5716 intsuvkkg.exe 100 PID 5300 wrote to memory of 6064 5300 insvxwpco.exe 101 PID 6064 wrote to memory of 1480 6064 inwhpwale.exe 102 PID 1480 wrote to memory of 4656 1480 inqmfrmyb.exe 103 PID 4656 wrote to memory of 1684 4656 invrckwrg.exe 104 PID 1684 wrote to memory of 2724 1684 ingtgabri.exe 105 PID 2724 wrote to memory of 2964 2724 inmeufqjy.exe 106 PID 2964 wrote to memory of 5680 2964 inadbobmd.exe 107 PID 5680 wrote to memory of 2792 5680 inxhvtpha.exe 108 PID 2792 wrote to memory of 1648 2792 inldtepix.exe 109 PID 1648 wrote to memory of 3568 1648 inazpsjiq.exe 110 PID 3568 wrote to memory of 4120 3568 ineuxonvv.exe 111 PID 4120 wrote to memory of 3140 4120 inrfpuysy.exe 112 PID 3140 wrote to memory of 5136 3140 inomzqrdt.exe 113 PID 5136 wrote to memory of 4936 5136 inixpjqgj.exe 114 PID 4936 wrote to memory of 5560 4936 inhwnltjf.exe 115 PID 5560 wrote to memory of 252 5560 inbjwysrs.exe 116 PID 252 wrote to memory of 1344 252 intcrvwiy.exe 117 PID 1344 wrote to memory of 5408 1344 inxsdoolp.exe 118 PID 5408 wrote to memory of 1584 5408 inscqyokc.exe 119 PID 1584 wrote to memory of 6124 1584 ineeenyiy.exe 120 PID 6124 wrote to memory of 5368 6124 inmtnbdcu.exe 121 PID 5368 wrote to memory of 4512 5368 inqklaasr.exe 122 PID 4512 wrote to memory of 1196 4512 inpqffxwb.exe 123 PID 1196 wrote to memory of 4384 1196 inpsutmlb.exe 124 PID 4384 wrote to memory of 4564 4384 intfuikjc.exe 125 PID 4564 wrote to memory of 4452 4564 inahuhbcs.exe 126 PID 4452 wrote to memory of 5512 4452 innuocedv.exe 127 PID 5512 wrote to memory of 4216 5512 insezthji.exe 128 PID 4216 wrote to memory of 780 4216 inxjymong.exe 129 PID 780 wrote to memory of 4404 780 inortslka.exe 130 PID 4404 wrote to memory of 3340 4404 inatwyxqd.exe 131 PID 3340 wrote to memory of 5696 3340 inykznpoh.exe 132 PID 5696 wrote to memory of 1972 5696 invuwaxma.exe 133 PID 1972 wrote to memory of 3876 1972 inbuxzyre.exe 134 PID 3876 wrote to memory of 5128 3876 inhwfuyzl.exe 135 PID 5128 wrote to memory of 5124 5128 inbmkzbqa.exe 136 PID 5124 wrote to memory of 4280 5124 invhwkmle.exe 137 PID 4280 wrote to memory of 1992 4280 inigtklnv.exe 138 PID 1992 wrote to memory of 5508 1992 inxitdtqe.exe 139 PID 5508 wrote to memory of 2648 5508 inbfyviuk.exe 140 PID 2648 wrote to memory of 4556 2648 inknedlyl.exe 141 PID 4556 wrote to memory of 4844 4556 inhzrfkoi.exe 142 PID 4844 wrote to memory of 2324 4844 ingvnhoze.exe 143 PID 2324 wrote to memory of 5068 2324 inlsmacbt.exe 144 PID 5068 wrote to memory of 3236 5068 intpaiupe.exe 145 PID 3236 wrote to memory of 5856 3236 inqgdzfrf.exe 146 PID 5856 wrote to memory of 3536 5856 injyiwuqi.exe 147 PID 3536 wrote to memory of 3452 3536 inyegrpfl.exe 148 PID 3452 wrote to memory of 2024 3452 inruwvobn.exe 149 PID 2024 wrote to memory of 3508 2024 indtwnmuu.exe 150 PID 3508 wrote to memory of 4660 3508 inmprqjiy.exe 151 PID 4660 wrote to memory of 2720 4660 indxawycz.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_88b97dcebcc68fab6f4232ff4096e104_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe27⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe31⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe52⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\injyiwuqi.exeC:\Windows\system32\injyiwuqi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe65⤵
- Executes dropped EXE
PID:2720 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe66⤵PID:3300
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe67⤵PID:5848
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe68⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3940 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe69⤵PID:3276
-
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe70⤵PID:4648
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe71⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe72⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe73⤵PID:248
-
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe74⤵PID:3284
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe75⤵PID:5868
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe76⤵PID:4664
-
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe77⤵
- Drops file in System32 directory
PID:5576 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe78⤵PID:5140
-
C:\Windows\SysWOW64\injyixbhg.exeC:\Windows\system32\injyixbhg.exe79⤵
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe80⤵PID:1300
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe81⤵PID:1168
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe82⤵PID:1528
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe83⤵PID:3816
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe84⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe85⤵PID:3212
-
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe86⤵PID:2272
-
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe87⤵PID:3752
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe88⤵PID:4852
-
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe89⤵PID:3996
-
C:\Windows\SysWOW64\inyaereiz.exeC:\Windows\system32\inyaereiz.exe90⤵PID:2404
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe91⤵PID:3476
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe92⤵
- Drops file in System32 directory
PID:5824 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe93⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe94⤵
- Drops file in System32 directory
PID:3032 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe95⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2996 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe96⤵PID:4344
-
C:\Windows\SysWOW64\inbfffozj.exeC:\Windows\system32\inbfffozj.exe97⤵PID:4816
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe98⤵PID:260
-
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe99⤵PID:2396
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe100⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5504 -
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe101⤵PID:2816
-
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe102⤵PID:3024
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe103⤵
- Drops file in System32 directory
PID:2732 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe104⤵PID:1940
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe105⤵PID:2060
-
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe106⤵PID:4904
-
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\system32\inyteppma.exe107⤵
- Drops file in System32 directory
PID:2300 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe108⤵PID:5500
-
C:\Windows\SysWOW64\inbmmjnwc.exeC:\Windows\system32\inbmmjnwc.exe109⤵PID:1944
-
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe110⤵PID:1176
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe111⤵PID:2444
-
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe112⤵PID:5724
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe113⤵PID:5152
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe114⤵PID:6104
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe115⤵PID:1916
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe116⤵PID:4984
-
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe117⤵PID:3092
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe118⤵PID:5072
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe119⤵PID:2584
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe120⤵PID:3308
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe121⤵PID:576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-