Analysis
- max time kernel
74s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 15:08
Behavioral task
behavioral1
Sample
2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260910-sh44qs1fje
- SHA256 32efc8217a82b4174ae75dca32ecd7d3caaea5876d1f1b0722608e4e809f1069
- MD5 76e1cb6484e0732ddc60f626c44540f0
- SHA1 9a2c7586506e634dc3e06d6206d2a967bf90602e
- SHA512 629c5b2f133885df4708e245b533de2ec9ed64f18a0db8987cc0d568c3f3632692e6be09c94991270473fa446c7eee2f923695b60888c315ca54dc4e758b7b1a
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTf:RPjOa1NxyYtH1f
- TLSH T12115AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/2688-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000f00000001c485-19.dat family_gh0strat behavioral2/memory/2688-21-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c495-31.dat family_gh0strat behavioral2/files/0x000d00000001c496-39.dat family_gh0strat behavioral2/memory/3560-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ae-63.dat family_gh0strat behavioral2/memory/2656-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b2-86.dat family_gh0strat behavioral2/files/0x000d00000001c4b7-108.dat family_gh0strat behavioral2/memory/5260-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4372-624-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2288-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6008-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4416-570-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4700-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3740-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1868-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/868-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6080-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4280-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5428-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5116-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4128-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5808-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5016-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ed-350.dat family_gh0strat behavioral2/memory/5928-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e8-328.dat family_gh0strat behavioral2/memory/4716-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e3-306.dat family_gh0strat behavioral2/memory/5792-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4df-284.dat family_gh0strat behavioral2/memory/5996-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4db-262.dat family_gh0strat behavioral2/memory/1524-243-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d7-240.dat family_gh0strat behavioral2/files/0x000d00000001c4cd-221.dat family_gh0strat behavioral2/memory/2976-220-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4488-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c8-196.dat family_gh0strat behavioral2/memory/2512-177-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c4-174.dat family_gh0strat behavioral2/files/0x000d00000001c4bf-155.dat family_gh0strat behavioral2/memory/4104-154-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5416-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4bb-130.dat family_gh0strat behavioral2/memory/3944-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5836-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{825A56E8-1E35-44c6-81BB-511C58BF5528}\stubpath = "C:\\Windows\\system32\\inwezaozq.exe" inudpxert.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E33C99E0-9D2A-4466-BE39-56494F104631} inatwyxqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C9448B9-CB53-495f-BAE9-C670A85BBCB5} intfuikjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{931F2441-4E5D-49b7-916A-D991E9FB3A4A}\stubpath = "C:\\Windows\\system32\\injsnioht.exe" indcsegkx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17AB1C6A-91CC-4b14-A3C5-A2E0EAC65ABF} inxavmale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DFDD556-5D1A-448c-B017-9718C3D46FE7} injausioy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A631D59A-AEBB-48a2-82FA-0450E1340285} inuinrlrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A103AC7-EDA0-4ff6-A5F7-5446CA064C3B}\stubpath = "C:\\Windows\\system32\\ineltpsko.exe" inwtdautu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60557B67-A72E-408a-95D7-47579DD3355B} ineltpsko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32EA00C8-6641-42b9-B156-79F2BFB55035}\stubpath = "C:\\Windows\\system32\\inyteppma.exe" inytozkkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6213F1AF-D2DA-49ed-A978-C480B54F01E3} inrnfatcb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79030E2E-2923-401a-8513-A9E8450B0E9C} inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{573A7A9A-C378-4b30-B659-01EEEE799AD1}\stubpath = "C:\\Windows\\system32\\innqsrkjz.exe" inbfyviuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BB83D52-5BB8-4f71-BA09-BD0FB335C40B} inwmpgfnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C941EF91-BB37-49cf-B532-4E971EE6DBE6} ingvzmksi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E24EC7B-2B29-48de-800A-71C45E73F850}\stubpath = "C:\\Windows\\system32\\inewrcnnk.exe" inwgusogd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29917DE5-5FB9-4016-B20A-B87E2A4F67FA} inbbkvfva.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3AAC6DF-116A-494a-B135-9AC530BAB1E3} inruwvobn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CDDC689D-0984-4147-85C2-3791FF4BA758} inxitdtqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F78297ED-3FB4-4e4e-8D73-19DE2B1E3C8B}\stubpath = "C:\\Windows\\system32\\incgzwjvl.exe" inqgdzfrf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FD872B5-1935-4f5a-AF00-C048379E0CEB} inldtepix.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C987BE27-21AD-4b88-9124-C2380F72D69D} inbqostfv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A418F282-8C9F-4640-96FE-6D409DFC732C}\stubpath = "C:\\Windows\\system32\\indskelwb.exe" inhiypoew.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1111667-95D8-47a9-841F-D0D1E7AAD760} inuhqyjhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3BF1D67-182B-4c41-810C-57A587EAEE3A}\stubpath = "C:\\Windows\\system32\\inasgqvzt.exe" inuwftrhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F52073DF-4A15-4ef0-A2F1-C226F8A30E1F}\stubpath = "C:\\Windows\\system32\\inzydrlkr.exe" inkietvme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{38395BD4-A5A3-45ba-9E12-0DA68A6FA1A2}\stubpath = "C:\\Windows\\system32\\indrmgdxz.exe" intxmhybx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79030E2E-2923-401a-8513-A9E8450B0E9C}\stubpath = "C:\\Windows\\system32\\inatwyxqd.exe" inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C941EF91-BB37-49cf-B532-4E971EE6DBE6}\stubpath = "C:\\Windows\\system32\\innlypqcs.exe" ingvzmksi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E952971-C809-43c1-9FAC-46E2F1FA0C07} injrhdzvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10B0147E-ECDF-4a18-8FB1-3D99F0F7CF18}\stubpath = "C:\\Windows\\system32\\inumafjdj.exe" ineeenyiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{444C69BE-C6CC-4de0-BB05-BD77971AFCFD} inisucehe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA38307D-6EF5-4a13-B914-4D39E7823830} inipelkjl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96D395C4-0146-48a4-9892-659B7C7D2F38} inbjdjvkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{855B16D9-23E3-4938-93B2-6D342E646E76} innikicxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E3EAA5E-060B-4734-A95D-0A29D5E31EE9} inbjudnts.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66503906-70A5-4da6-849E-CDC2A2B641BD} inlcfvhzy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0710235-AC9E-4369-9ED1-166D26EFEA12} innjrlbrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A3E90F2-8B9E-47e7-9D25-125E9205C088}\stubpath = "C:\\Windows\\system32\\invzzdxxz.exe" inyluacnl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5B07A1C-FB6C-4144-B72B-DD4388368DD8} inrcscxou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{353B890B-E3BD-4c73-B4DF-85DBE9E7C2AC}\stubpath = "C:\\Windows\\system32\\iniqzgcyz.exe" inclwgwbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{935EFA8A-7EF6-4ceb-8862-A011A5759DF9} indrzpldy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE2ABCC0-FB1D-4699-B4A1-5581B0D84298} inupalliz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C89E65D-C05C-4025-AF08-23848F2B9EF4} indeulkya.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{67B5D38F-ADE8-4140-9231-BAADB7C30BCC} indeoeuxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18357190-4BBE-41e3-AA98-2740388ECE70}\stubpath = "C:\\Windows\\system32\\innhouwkt.exe" inxqcxpkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E39FA6AF-47A8-4fb6-8F18-F28FE14ECC95} inwtyvsvp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1B31B12-68F9-4f72-B76A-1E6A460E33C7}\stubpath = "C:\\Windows\\system32\\inaivxrqr.exe" infgwnmcy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C270CA56-C267-4eeb-B227-7C83F996B555} inwmcsiky.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDFE220E-FF85-4d0a-82CC-5CE2A97673E2} insbznvcp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97B9EDBE-3F5A-499b-A62F-6C4E67C8F299} inkvbdqbu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F3C033B-C4CA-40d3-B468-4749D8ED08EC}\stubpath = "C:\\Windows\\system32\\inijzqpfx.exe" inwuyycww.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FE83422-9D60-4f62-BA97-F5608DC6071E}\stubpath = "C:\\Windows\\system32\\indtfhlye.exe" inpprolqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C6F8CA8-5CBF-4cf5-99A9-7DE88D0748E0}\stubpath = "C:\\Windows\\system32\\inkhtihxi.exe" inhuwzjax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C241C153-E7F9-4cff-A195-52593A42E3D7}\stubpath = "C:\\Windows\\system32\\insacfcod.exe" inrkqhiua.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C696486-843F-44d8-8D55-BE849CA795B7} innoqupvt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE98FEFB-266D-4256-8A10-3DC13F892DBF}\stubpath = "C:\\Windows\\system32\\injidfpid.exe" inyvsxuru.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{805BA5F5-B80D-4847-94EE-718E7D102612} inhoksmcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5C422FF-D527-413b-B5D5-7B6D176E7BE0} inltanpsp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A96C4E5E-C46B-44f4-B9C6-E1DA150B86B5} ineyhbpzk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E583008-1A15-4b4c-9AE7-40D38C5982E9}\stubpath = "C:\\Windows\\system32\\inuqbjvqf.exe" inkzrlbas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A31067B-90AF-4db0-A1E2-EB166B53D479}\stubpath = "C:\\Windows\\system32\\inldtepix.exe" ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{909B35FC-2CBB-4924-89D5-1E6D90AAB0A6} inalzlawr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{418DB854-FE8D-49ac-916D-18F0BB768AD9} inxtemyti.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000016b3a-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3560 inetlfmxc.exe 2656 inlsmacbt.exe 5836 inqcxrfhg.exe 3944 inhwoipfi.exe 5416 inmtnbdcu.exe 4104 inxtemyti.exe 2512 injyqkarh.exe 4488 inogwahsa.exe 2976 infdqdofu.exe 1524 inkbaivic.exe 5996 inoavpdfe.exe 5792 inbuxzyre.exe 4716 inykznpoh.exe 5928 inpsutmlb.exe 5016 inqgdzfrf.exe 5808 incgzwjvl.exe 4128 insohtodl.exe 5116 inugvjlkd.exe 5260 inzloqpih.exe 5428 inqtvunam.exe 4280 ingvnhoze.exe 6080 inldtepix.exe 868 insvxwpco.exe 1868 inaexuhtj.exe 3740 inmeufqjy.exe 4700 incrjzdkv.exe 4416 inxjymong.exe 6008 inortslka.exe 2288 inatwyxqd.exe 4372 inbfyviuk.exe 1776 innqsrkjz.exe 2012 inwsdlxsh.exe 488 inxiaqxbm.exe 5088 inwmpgfnn.exe 1704 intfuikjc.exe 1488 inaikwkwh.exe 5232 injwnoaqy.exe 5332 infumgnyd.exe 3240 inkzrlbas.exe 4688 inuqbjvqf.exe 3208 ingvzmksi.exe 3876 innlypqcs.exe 2484 inhfsfaqh.exe 5784 indhxkwmb.exe 3484 invuwaxma.exe 52 inbrulkss.exe 5664 inzkcszdo.exe 3344 inyorihpp.exe 1520 inbqostfv.exe 1452 inyjbrycn.exe 608 inpbwqegf.exe 2808 inpfzcyeq.exe 1072 ingtgabri.exe 2380 inpleqlxa.exe 4760 incwvxbyn.exe 2096 inwgusogd.exe 2548 inewrcnnk.exe 5856 inbqiycju.exe 5600 inyufnzuj.exe 1480 inhwfuyzl.exe 5004 innuocedv.exe 4616 inrcangym.exe 5804 infvypoww.exe 1508 inknedlyl.exe - Loads dropped DLL 64 IoCs
pid Process 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe 3560 inetlfmxc.exe 3560 inetlfmxc.exe 2656 inlsmacbt.exe 2656 inlsmacbt.exe 5836 inqcxrfhg.exe 5836 inqcxrfhg.exe 3944 inhwoipfi.exe 3944 inhwoipfi.exe 5416 inmtnbdcu.exe 5416 inmtnbdcu.exe 4104 inxtemyti.exe 4104 inxtemyti.exe 2512 injyqkarh.exe 2512 injyqkarh.exe 4488 inogwahsa.exe 4488 inogwahsa.exe 2976 infdqdofu.exe 2976 infdqdofu.exe 1524 inkbaivic.exe 1524 inkbaivic.exe 5996 inoavpdfe.exe 5996 inoavpdfe.exe 5792 inbuxzyre.exe 5792 inbuxzyre.exe 4716 inykznpoh.exe 4716 inykznpoh.exe 5928 inpsutmlb.exe 5928 inpsutmlb.exe 5016 inqgdzfrf.exe 5016 inqgdzfrf.exe 5808 incgzwjvl.exe 5808 incgzwjvl.exe 4128 insohtodl.exe 4128 insohtodl.exe 5116 inugvjlkd.exe 5116 inugvjlkd.exe 5260 inzloqpih.exe 5260 inzloqpih.exe 5428 inqtvunam.exe 5428 inqtvunam.exe 4280 ingvnhoze.exe 4280 ingvnhoze.exe 6080 inldtepix.exe 6080 inldtepix.exe 868 insvxwpco.exe 868 insvxwpco.exe 1868 inaexuhtj.exe 1868 inaexuhtj.exe 3740 inmeufqjy.exe 3740 inmeufqjy.exe 4700 incrjzdkv.exe 4700 incrjzdkv.exe 4416 inxjymong.exe 4416 inxjymong.exe 6008 inortslka.exe 6008 inortslka.exe 2288 inatwyxqd.exe 2288 inatwyxqd.exe 4372 inbfyviuk.exe 4372 inbfyviuk.exe 1776 innqsrkjz.exe 1776 innqsrkjz.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\innqsrkjz.exe_lang.ini inbfyviuk.exe File created C:\Windows\SysWOW64\inooxsntm.exe incsdfhkz.exe File created C:\Windows\SysWOW64\indrmgdxz.exe intxmhybx.exe File opened for modification C:\Windows\SysWOW64\inarenvge.exe_lang.ini injsnioht.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqgyjlgf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrvvttvs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoxdfqoe.exe File created C:\Windows\SysWOW64\innezahdx.exe inertnmni.exe File opened for modification C:\Windows\SysWOW64\inkxmjgli.exe_lang.ini inpzchsnz.exe File opened for modification C:\Windows\SysWOW64\iniszdhvx.exe_lang.ini inyctgpxi.exe File created C:\Windows\SysWOW64\inkmpnlpp.exe invkhejgd.exe File opened for modification C:\Windows\SysWOW64\intfwsljg.exe_lang.ini inueaqidm.exe File opened for modification C:\Windows\SysWOW64\injrhdzvq.exe_lang.ini incraptug.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inixpjqgj.exe File created C:\Windows\SysWOW64\inaeepccp.exe invqmdynu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innqmfdal.exe File opened for modification C:\Windows\SysWOW64\inspmpjxs.exe_lang.ini inntygqax.exe File created C:\Windows\SysWOW64\innjrlbrs.exe inspmpjxs.exe File created C:\Windows\SysWOW64\inyodrton.exe ineamubie.exe File opened for modification C:\Windows\SysWOW64\inzloqpih.exe_lang.ini inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjwysrs.exe File opened for modification C:\Windows\SysWOW64\inykznpoh.exe_lang.ini inbuxzyre.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injlxlxig.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwanaevl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxrycagn.exe File opened for modification C:\Windows\SysWOW64\ineyyaxuz.exe_lang.ini inedyzakd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmayveeq.exe File created C:\Windows\SysWOW64\inivxkbyw.exe inotjfrzg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqklaasr.exe File opened for modification C:\Windows\SysWOW64\injfdlthy.exe_lang.ini invudbffq.exe File created C:\Windows\SysWOW64\inbzddobb.exe inpiqqmhr.exe File opened for modification C:\Windows\SysWOW64\insrzztuj.exe_lang.ini indtwnmuu.exe File opened for modification C:\Windows\SysWOW64\inrshhzyd.exe_lang.ini inthmqkqb.exe File created C:\Windows\SysWOW64\invmdukgq.exe inhjvjvge.exe File opened for modification C:\Windows\SysWOW64\inphclvql.exe_lang.ini innfajbav.exe File created C:\Windows\SysWOW64\indzyzoqh.exe inulkzdji.exe File created C:\Windows\SysWOW64\ineuxonvv.exe inckxztas.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indcsegkx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzhpyfbx.exe File opened for modification C:\Windows\SysWOW64\inyegtexf.exe_lang.ini inupeyqpk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpdlvxfh.exe File created C:\Windows\SysWOW64\intnjpska.exe inltanpsp.exe File opened for modification C:\Windows\SysWOW64\inhegsgsd.exe_lang.ini incanalcr.exe File created C:\Windows\SysWOW64\inbobfwma.exe iniizepdz.exe File opened for modification C:\Windows\SysWOW64\inikbvtjp.exe_lang.ini inwikohfo.exe File created C:\Windows\SysWOW64\inzkzjyci.exe inlnqnzon.exe File opened for modification C:\Windows\SysWOW64\inztjzmib.exe_lang.ini inwanaevl.exe File created C:\Windows\SysWOW64\inkmhgrmq.exe insuhmxsm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwpkmkez.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhztqfaz.exe File created C:\Windows\SysWOW64\invuwaxma.exe indhxkwmb.exe File created C:\Windows\SysWOW64\ingfvhjng.exe inftrnfcc.exe File opened for modification C:\Windows\SysWOW64\inyegrpfl.exe_lang.ini indbkovjr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inczeboin.exe File opened for modification C:\Windows\SysWOW64\inxbftvlo.exe_lang.ini ingyagyjp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infzicqlp.exe File created C:\Windows\SysWOW64\inoyifzki.exe inuprpjqa.exe File opened for modification C:\Windows\SysWOW64\inougxtmk.exe_lang.ini inoyifzki.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inejnhnnw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infxsuasm.exe File opened for modification C:\Windows\SysWOW64\inhgncqwc.exe_lang.ini indlflxmo.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini inbmmjnwc.exe File opened for modification C:\Windows\SysWOW64\inxhvtpha.exe_lang.ini inatybwnb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaouaylq.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupeyqpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inboqtdrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inudpxert.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniysrzzt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwudrhvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuqbjvqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwemzvcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhoiekzn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgacrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inufqaqnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisglpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqgiwze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfbqsjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaeepccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhrtbdgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhpkypiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language instvzuyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqmfrmyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhvtxxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoyifzki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfqeotx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inimbeutc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intcrvwiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inenraymu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmosntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmgmynpz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inptcowdq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwixlnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injlxlxig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtleici.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineugyxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniyteex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczeboin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfffozj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoqupvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxndtjlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxbftvlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzjwmbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invhwkmle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injqftzfq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtiwity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbohznex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineamubie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inytozkkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhsblrqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmktaxgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhxamofz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invbdruwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invgvfzue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuxuebv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inicbilrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injmdckxk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inngmlnpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inooxsntm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indrmgdxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inltanpsp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyqkarh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewrcnnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgusiod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innajnacf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe 3560 inetlfmxc.exe 3560 inetlfmxc.exe 2656 inlsmacbt.exe 2656 inlsmacbt.exe 5836 inqcxrfhg.exe 5836 inqcxrfhg.exe 3944 inhwoipfi.exe 3944 inhwoipfi.exe 5416 inmtnbdcu.exe 5416 inmtnbdcu.exe 4104 inxtemyti.exe 4104 inxtemyti.exe 2512 injyqkarh.exe 2512 injyqkarh.exe 4488 inogwahsa.exe 4488 inogwahsa.exe 2976 infdqdofu.exe 2976 infdqdofu.exe 1524 inkbaivic.exe 1524 inkbaivic.exe 5996 inoavpdfe.exe 5996 inoavpdfe.exe 5792 inbuxzyre.exe 5792 inbuxzyre.exe 4716 inykznpoh.exe 4716 inykznpoh.exe 5928 inpsutmlb.exe 5928 inpsutmlb.exe 5016 inqgdzfrf.exe 5016 inqgdzfrf.exe 5808 incgzwjvl.exe 5808 incgzwjvl.exe 4128 insohtodl.exe 4128 insohtodl.exe 5116 inugvjlkd.exe 5116 inugvjlkd.exe 5260 inzloqpih.exe 5260 inzloqpih.exe 5428 inqtvunam.exe 5428 inqtvunam.exe 4280 ingvnhoze.exe 4280 ingvnhoze.exe 6080 inldtepix.exe 6080 inldtepix.exe 868 insvxwpco.exe 868 insvxwpco.exe 1868 inaexuhtj.exe 1868 inaexuhtj.exe 3740 inmeufqjy.exe 3740 inmeufqjy.exe 4700 incrjzdkv.exe 4700 incrjzdkv.exe 4416 inxjymong.exe 4416 inxjymong.exe 6008 inortslka.exe 6008 inortslka.exe 2288 inatwyxqd.exe 2288 inatwyxqd.exe 4372 inbfyviuk.exe 4372 inbfyviuk.exe 1776 innqsrkjz.exe 1776 innqsrkjz.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 3560 inetlfmxc.exe Token: SeDebugPrivilege 2656 inlsmacbt.exe Token: SeDebugPrivilege 5836 inqcxrfhg.exe Token: SeDebugPrivilege 3944 inhwoipfi.exe Token: SeDebugPrivilege 5416 inmtnbdcu.exe Token: SeDebugPrivilege 4104 inxtemyti.exe Token: SeDebugPrivilege 2512 injyqkarh.exe Token: SeDebugPrivilege 4488 inogwahsa.exe Token: SeDebugPrivilege 2976 infdqdofu.exe Token: SeDebugPrivilege 1524 inkbaivic.exe Token: SeDebugPrivilege 5996 inoavpdfe.exe Token: SeDebugPrivilege 5792 inbuxzyre.exe Token: SeDebugPrivilege 4716 inykznpoh.exe Token: SeDebugPrivilege 5928 inpsutmlb.exe Token: SeDebugPrivilege 5016 inqgdzfrf.exe Token: SeDebugPrivilege 5808 incgzwjvl.exe Token: SeDebugPrivilege 4128 insohtodl.exe Token: SeDebugPrivilege 5116 inugvjlkd.exe Token: SeDebugPrivilege 5260 inzloqpih.exe Token: SeDebugPrivilege 5428 inqtvunam.exe Token: SeDebugPrivilege 4280 ingvnhoze.exe Token: SeDebugPrivilege 6080 inldtepix.exe Token: SeDebugPrivilege 868 insvxwpco.exe Token: SeDebugPrivilege 1868 inaexuhtj.exe Token: SeDebugPrivilege 3740 inmeufqjy.exe Token: SeDebugPrivilege 4700 incrjzdkv.exe Token: SeDebugPrivilege 4416 inxjymong.exe Token: SeDebugPrivilege 6008 inortslka.exe Token: SeDebugPrivilege 2288 inatwyxqd.exe Token: SeDebugPrivilege 4372 inbfyviuk.exe Token: SeDebugPrivilege 1776 innqsrkjz.exe Token: SeDebugPrivilege 2012 inwsdlxsh.exe Token: SeDebugPrivilege 488 inxiaqxbm.exe Token: SeDebugPrivilege 5088 inwmpgfnn.exe Token: SeDebugPrivilege 1704 intfuikjc.exe Token: SeDebugPrivilege 1488 inaikwkwh.exe Token: SeDebugPrivilege 5232 injwnoaqy.exe Token: SeDebugPrivilege 5332 infumgnyd.exe Token: SeDebugPrivilege 3240 inkzrlbas.exe Token: SeDebugPrivilege 4688 inuqbjvqf.exe Token: SeDebugPrivilege 3208 ingvzmksi.exe Token: SeDebugPrivilege 3876 innlypqcs.exe Token: SeDebugPrivilege 2484 inhfsfaqh.exe Token: SeDebugPrivilege 5784 indhxkwmb.exe Token: SeDebugPrivilege 3484 invuwaxma.exe Token: SeDebugPrivilege 52 inbrulkss.exe Token: SeDebugPrivilege 5664 inzkcszdo.exe Token: SeDebugPrivilege 3344 inyorihpp.exe Token: SeDebugPrivilege 1520 inbqostfv.exe Token: SeDebugPrivilege 1452 inyjbrycn.exe Token: SeDebugPrivilege 608 inpbwqegf.exe Token: SeDebugPrivilege 2808 inpfzcyeq.exe Token: SeDebugPrivilege 1072 ingtgabri.exe Token: SeDebugPrivilege 2380 inpleqlxa.exe Token: SeDebugPrivilege 4760 incwvxbyn.exe Token: SeDebugPrivilege 2096 inwgusogd.exe Token: SeDebugPrivilege 2548 inewrcnnk.exe Token: SeDebugPrivilege 5856 inbqiycju.exe Token: SeDebugPrivilege 5600 inyufnzuj.exe Token: SeDebugPrivilege 1480 inhwfuyzl.exe Token: SeDebugPrivilege 5004 innuocedv.exe Token: SeDebugPrivilege 4616 inrcangym.exe Token: SeDebugPrivilege 5804 infvypoww.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe 3560 inetlfmxc.exe 2656 inlsmacbt.exe 5836 inqcxrfhg.exe 3944 inhwoipfi.exe 5416 inmtnbdcu.exe 4104 inxtemyti.exe 2512 injyqkarh.exe 4488 inogwahsa.exe 2976 infdqdofu.exe 1524 inkbaivic.exe 5996 inoavpdfe.exe 5792 inbuxzyre.exe 4716 inykznpoh.exe 5928 inpsutmlb.exe 5016 inqgdzfrf.exe 5808 incgzwjvl.exe 4128 insohtodl.exe 5116 inugvjlkd.exe 5260 inzloqpih.exe 5428 inqtvunam.exe 4280 ingvnhoze.exe 6080 inldtepix.exe 868 insvxwpco.exe 1868 inaexuhtj.exe 3740 inmeufqjy.exe 4700 incrjzdkv.exe 4416 inxjymong.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 3560 2688 2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe 90 PID 3560 wrote to memory of 2656 3560 inetlfmxc.exe 91 PID 2656 wrote to memory of 5836 2656 inlsmacbt.exe 92 PID 5836 wrote to memory of 3944 5836 inqcxrfhg.exe 93 PID 3944 wrote to memory of 5416 3944 inhwoipfi.exe 94 PID 5416 wrote to memory of 4104 5416 inmtnbdcu.exe 95 PID 4104 wrote to memory of 2512 4104 inxtemyti.exe 96 PID 2512 wrote to memory of 4488 2512 injyqkarh.exe 97 PID 4488 wrote to memory of 2976 4488 inogwahsa.exe 98 PID 2976 wrote to memory of 1524 2976 infdqdofu.exe 99 PID 1524 wrote to memory of 5996 1524 inkbaivic.exe 100 PID 5996 wrote to memory of 5792 5996 inoavpdfe.exe 101 PID 5792 wrote to memory of 4716 5792 inbuxzyre.exe 102 PID 4716 wrote to memory of 5928 4716 inykznpoh.exe 103 PID 5928 wrote to memory of 5016 5928 inpsutmlb.exe 104 PID 5016 wrote to memory of 5808 5016 inqgdzfrf.exe 105 PID 5808 wrote to memory of 4128 5808 incgzwjvl.exe 106 PID 4128 wrote to memory of 5116 4128 insohtodl.exe 107 PID 5116 wrote to memory of 5260 5116 inugvjlkd.exe 108 PID 5260 wrote to memory of 5428 5260 inzloqpih.exe 109 PID 5428 wrote to memory of 4280 5428 inqtvunam.exe 110 PID 4280 wrote to memory of 6080 4280 ingvnhoze.exe 111 PID 6080 wrote to memory of 868 6080 inldtepix.exe 112 PID 868 wrote to memory of 1868 868 insvxwpco.exe 113 PID 1868 wrote to memory of 3740 1868 inaexuhtj.exe 114 PID 3740 wrote to memory of 4700 3740 inmeufqjy.exe 115 PID 4700 wrote to memory of 4416 4700 incrjzdkv.exe 116 PID 4416 wrote to memory of 6008 4416 inxjymong.exe 117 PID 6008 wrote to memory of 2288 6008 inortslka.exe 118 PID 2288 wrote to memory of 4372 2288 inatwyxqd.exe 119 PID 4372 wrote to memory of 1776 4372 inbfyviuk.exe 120 PID 1776 wrote to memory of 2012 1776 innqsrkjz.exe 121 PID 2012 wrote to memory of 488 2012 inwsdlxsh.exe 122 PID 488 wrote to memory of 5088 488 inxiaqxbm.exe 123 PID 5088 wrote to memory of 1704 5088 inwmpgfnn.exe 124 PID 1704 wrote to memory of 1488 1704 intfuikjc.exe 125 PID 1488 wrote to memory of 5232 1488 inaikwkwh.exe 126 PID 5232 wrote to memory of 5332 5232 injwnoaqy.exe 127 PID 5332 wrote to memory of 3240 5332 infumgnyd.exe 128 PID 3240 wrote to memory of 4688 3240 inkzrlbas.exe 129 PID 4688 wrote to memory of 3208 4688 inuqbjvqf.exe 130 PID 3208 wrote to memory of 3876 3208 ingvzmksi.exe 131 PID 3876 wrote to memory of 2484 3876 innlypqcs.exe 132 PID 2484 wrote to memory of 5784 2484 inhfsfaqh.exe 133 PID 5784 wrote to memory of 3484 5784 indhxkwmb.exe 134 PID 3484 wrote to memory of 52 3484 invuwaxma.exe 135 PID 52 wrote to memory of 5664 52 inbrulkss.exe 136 PID 5664 wrote to memory of 3344 5664 inzkcszdo.exe 137 PID 3344 wrote to memory of 1520 3344 inyorihpp.exe 138 PID 1520 wrote to memory of 1452 1520 inbqostfv.exe 139 PID 1452 wrote to memory of 608 1452 inyjbrycn.exe 140 PID 608 wrote to memory of 2808 608 inpbwqegf.exe 141 PID 2808 wrote to memory of 1072 2808 inpfzcyeq.exe 142 PID 1072 wrote to memory of 2380 1072 ingtgabri.exe 143 PID 2380 wrote to memory of 4760 2380 inpleqlxa.exe 144 PID 4760 wrote to memory of 2096 4760 incwvxbyn.exe 145 PID 2096 wrote to memory of 2548 2096 inwgusogd.exe 146 PID 2548 wrote to memory of 5856 2548 inewrcnnk.exe 147 PID 5856 wrote to memory of 5600 5856 inbqiycju.exe 148 PID 5600 wrote to memory of 1480 5600 inyufnzuj.exe 149 PID 1480 wrote to memory of 5004 1480 inhwfuyzl.exe 150 PID 5004 wrote to memory of 4616 5004 innuocedv.exe 151 PID 4616 wrote to memory of 5804 4616 inrcangym.exe 152 PID 5804 wrote to memory of 1508 5804 infvypoww.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_76e1cb6484e0732ddc60f626c44540f0_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe16⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe22⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe23⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe30⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe31⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe35⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe36⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe40⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe42⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe50⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe57⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe65⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe66⤵PID:1732
-
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe67⤵PID:5496
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe68⤵PID:4632
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe69⤵
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe70⤵PID:2520
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe71⤵PID:4712
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe72⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4380 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe73⤵PID:1076
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe74⤵PID:4432
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe75⤵PID:6020
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe76⤵PID:832
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe77⤵PID:4968
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe78⤵PID:3856
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe79⤵PID:5740
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe80⤵PID:1844
-
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe81⤵
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5172 -
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe83⤵PID:1088
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe84⤵PID:1492
-
C:\Windows\SysWOW64\inpkfxleq.exeC:\Windows\system32\inpkfxleq.exe85⤵PID:1312
-
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe86⤵PID:5604
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe87⤵PID:5460
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe88⤵
- System Location Discovery: System Language Discovery
PID:252 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe89⤵
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe90⤵
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe91⤵PID:4620
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe92⤵PID:2920
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe93⤵PID:4756
-
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\system32\ineqbmfxl.exe94⤵PID:5092
-
C:\Windows\SysWOW64\insjarhdx.exeC:\Windows\system32\insjarhdx.exe95⤵PID:3476
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe96⤵PID:3244
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
PID:6052 -
C:\Windows\SysWOW64\innpclapa.exeC:\Windows\system32\innpclapa.exe98⤵PID:4332
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe99⤵PID:5356
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe100⤵
- Drops file in System32 directory
PID:2032 -
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe101⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1180 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe102⤵PID:1928
-
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe103⤵
- Drops file in System32 directory
PID:1412 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe104⤵PID:3032
-
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe105⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4460 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe106⤵PID:2164
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe107⤵PID:3116
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe108⤵PID:2436
-
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe109⤵PID:1232
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe110⤵PID:2864
-
C:\Windows\SysWOW64\inrmslxzd.exeC:\Windows\system32\inrmslxzd.exe111⤵PID:3360
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe112⤵PID:248
-
C:\Windows\SysWOW64\inbmmjnwc.exeC:\Windows\system32\inbmmjnwc.exe113⤵
- Drops file in System32 directory
PID:2596 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe114⤵PID:2568
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe115⤵PID:3924
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe116⤵PID:4696
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe117⤵PID:4356
-
C:\Windows\SysWOW64\insgwlney.exeC:\Windows\system32\insgwlney.exe118⤵PID:4592
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe119⤵
- Drops file in System32 directory
PID:3784 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe120⤵
- Drops file in System32 directory
PID:1888 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe121⤵PID:3204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-