Analysis
- max time kernel
78s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 16:13
Behavioral task
behavioral1
Sample
2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260910-tpan5sdq7s
- SHA256 e4a66eeb409fc7f2cbbfc26fdbc1944468fec2d0b2fcfaed4a03101cc365104a
- MD5 61503a91b002f410dba8ac4a3a66fe9a
- SHA1 1f9e87640d561e7bda88b5763b7648a8a23c115f
- SHA512 20d1dbe4b8591e80148099b8093b295ed9430c742920ecae00c264d78d95d1ba5679ceefc0524be90269d7119fe32950f10f4df01a38f01b8a20f1b8374b7f25
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTO:RPjOa1NxyYtH1O
- TLSH T13615AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/5536-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c1-20.dat family_gh0strat behavioral2/memory/5536-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c6-30.dat family_gh0strat behavioral2/files/0x000d00000001c4c7-39.dat family_gh0strat behavioral2/memory/5996-45-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c4be-63.dat family_gh0strat behavioral2/memory/5016-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d2-86.dat family_gh0strat behavioral2/memory/4872-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d6-107.dat family_gh0strat behavioral2/memory/2332-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4df-152.dat family_gh0strat behavioral2/memory/5776-178-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2632-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f7-240.dat family_gh0strat behavioral2/memory/3752-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c503-305.dat family_gh0strat behavioral2/memory/5576-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1356-570-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3176-623-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3800-605-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/916-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4300-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4604-533-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3596-515-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1036-497-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/784-479-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4252-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4608-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5780-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5224-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6120-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2640-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50c-350.dat family_gh0strat behavioral2/memory/5176-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c508-328.dat family_gh0strat behavioral2/memory/2324-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ff-284.dat family_gh0strat behavioral2/memory/956-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4fb-262.dat family_gh0strat behavioral2/memory/3332-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3836-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f3-218.dat family_gh0strat behavioral2/files/0x000d00000001c4ee-196.dat family_gh0strat behavioral2/files/0x000d00000001c4e9-174.dat family_gh0strat behavioral2/memory/5792-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5384-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4db-130.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5A2FB00-8293-42f0-B9FD-285D5B9D9A90}\stubpath = "C:\\Windows\\system32\\invkhejgd.exe" inueaqidm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D159EFF-D57F-453d-800D-2FA5FE18F47D}\stubpath = "C:\\Windows\\system32\\inhhsffsh.exe" inxbftvlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41E63695-BB0B-4862-B54D-FADC01339501} inzkzjyci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C82EADF7-AC28-4cb0-A139-0D3457D9B337}\stubpath = "C:\\Windows\\system32\\intfuikjc.exe" inqmfrmyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A52E7086-D09D-4870-9B52-557FC9B0B51A} inmtnbdcu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1BB6D3C1-57A1-43de-855E-B149E28F0113} inbrulkss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3B6CAD7-64BF-4ed5-B0DE-B1F0B4851CA3}\stubpath = "C:\\Windows\\system32\\inxnqhgoo.exe" inaikwkwh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BFD36F5-859C-44c6-91EF-1C0B29961CD5}\stubpath = "C:\\Windows\\system32\\inndiulal.exe" invakwebu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CB8F026-3C11-46ef-ADC8-0499EE02BD12} inouyugyj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63F96B58-F402-4198-97A3-50C1F325B56A} inogwahsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41F5BAD7-88DB-494d-86AD-0D5C4D353801} inhscspdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{623FEF2D-D9EC-4515-BD62-0263D35E0526}\stubpath = "C:\\Windows\\system32\\injsnioht.exe" innbxlquo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62855497-B49A-40b0-9D71-D142B8CCF420} inkmpmynm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B57233D-EC67-49fe-B005-DF2FBBEC0966} insgwlney.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9B55582-99AB-4f44-B439-5B90E591044F} infjxbrqx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{414F73DA-0292-48d0-A81B-6E1064E98A5D} inkwblfyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9FE9ACC9-1813-4fa1-A7BF-B007859BC933} inuwegjgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF854A7E-F2E9-456a-B823-5D1A9921C065}\stubpath = "C:\\Windows\\system32\\infhfyusg.exe" inncprues.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46FE8B40-58B6-4553-99F1-727FF6B75BFA} innfvgrkz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3C9A1CE-C8BB-4d8d-9A59-953555FDCDB2}\stubpath = "C:\\Windows\\system32\\inixpjqgj.exe" indskelwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54C6EA54-A38F-4c02-A3D9-0C7973ACA7AF} inenraymu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1B7A658-277B-4511-A204-CC80E4CDCC41} inbohznex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B134885A-7138-453b-8CFB-C8DF3A6E6D81}\stubpath = "C:\\Windows\\system32\\inqdmufdj.exe" inqfmalkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8B0FEAC-49B2-404e-B74D-D42840AE2836}\stubpath = "C:\\Windows\\system32\\inhomdgwi.exe" incajnuiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19C0C4D1-5B32-4b3b-9F60-EB6F393C13FA}\stubpath = "C:\\Windows\\system32\\inzvgovkd.exe" innlypqcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F72D3405-261F-4955-B507-E4D66C437AFE}\stubpath = "C:\\Windows\\system32\\inewrcnnk.exe" insaljfpw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62855497-B49A-40b0-9D71-D142B8CCF420}\stubpath = "C:\\Windows\\system32\\intfwsljg.exe" inkmpmynm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{410E4EA6-B16C-4b11-A4C8-F676EC4F1CA2} inkwkupid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A576D7D8-3013-437c-8486-8E9DDBCCB103}\stubpath = "C:\\Windows\\system32\\insahbdsg.exe" inasgqvzt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D9A5F02-5428-4ae6-803B-A6B31881D4A8} inzvgovkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3811DD57-CD73-4a83-B452-7E9EADE739B4} intikurgv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CF91CCC-2E13-4bcb-A234-1489E730EE1A} inpdlvxfh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C29F9ECD-74FA-4124-B0F8-F23D9964C1D5} inniucjdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFA0244E-CE70-47ee-835B-28D479929747} inuakpshs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C13C635-A317-45b8-A0DB-BAF6BBBC3AD4}\stubpath = "C:\\Windows\\system32\\inrfpuysy.exe" ineuxonvv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8B0FEAC-49B2-404e-B74D-D42840AE2836} incajnuiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2ED60C5E-2EFD-4599-AAB1-65837B6014FF}\stubpath = "C:\\Windows\\system32\\inmgmynpz.exe" innljnnyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD479724-C7F1-4904-B914-D409937ABD94} inmgmynpz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7BD5E545-2010-4da9-ABA4-9C6191934496} insuknjca.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{623FEF2D-D9EC-4515-BD62-0263D35E0526} innbxlquo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DDF7218-B84E-4f2e-8515-F3A94FC969AF}\stubpath = "C:\\Windows\\system32\\injwylczx.exe" inhhujgdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{459A0412-B402-4aa2-9E4F-C358E4326337}\stubpath = "C:\\Windows\\system32\\innajnacf.exe" incawvwly.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47C9D5F6-1680-4b07-BB07-EB537FD82E05}\stubpath = "C:\\Windows\\system32\\inowqgwxz.exe" inedyzakd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6ACEEFC-9EEA-4ef5-B3F4-8CD70554A9C2} invnbgkek.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{434D2F92-1E8A-43d7-B59B-52A641D57D69} inoxlbteg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C7A2659-539E-416d-ACCF-85E8D968FCE0}\stubpath = "C:\\Windows\\system32\\injyqkarh.exe" inruwvobn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48B3BA3F-B617-454e-8F07-4FE9ACD9CDF4}\stubpath = "C:\\Windows\\system32\\inqxbfmkb.exe" inxhvtpha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0EC9EE4B-E21B-4381-B0BF-E84411673DEA}\stubpath = "C:\\Windows\\system32\\inupkqjvx.exe" invgvfzue.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32F28992-9364-41b7-A917-1045DC0AC66A} ingtjmoji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E4AD38F-1F97-4122-AA75-C25A9657C226}\stubpath = "C:\\Windows\\system32\\inkdlvlhw.exe" inttrrtqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E701E34-72E5-42f2-A495-66674F1A3B88} injyqkarh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93DA8C28-9B36-4602-8D30-72DA955A7D09} indtkzjxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9A6F51E-B238-43d3-B210-6DCDA16342A3} inuydrpyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55F379E0-C738-46f5-A21E-9D67F996CBA5} inckxztas.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C23CE4E-EAF5-43a9-AC68-48A50A5D2EB3} inwikohfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0ECEF20-B635-422d-B203-379DECF053B8}\stubpath = "C:\\Windows\\system32\\inokiqcye.exe" inrurbsrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78D7CAB8-9FEC-49d6-94BA-47F50F14F17A}\stubpath = "C:\\Windows\\system32\\inlgwrccv.exe" infcwfnxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA4AD57D-29EB-4a45-88EE-F32DB6EA7EF7}\stubpath = "C:\\Windows\\system32\\inouyugyj.exe" inndiulal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABF3D7E4-F8A7-4945-9C82-C7A2F8DB2F87}\stubpath = "C:\\Windows\\system32\\inmprqjiy.exe" inbuxzyre.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B5D4016-BA99-4b56-94B6-2F4768F1966D}\stubpath = "C:\\Windows\\system32\\infauwnfj.exe" inthmqkqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E511C06F-DE84-46a5-A0FC-3F6A3EF456AC} inczogbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3542D2CD-0B98-4106-ABAA-01D803952BB7}\stubpath = "C:\\Windows\\system32\\inyjbrycn.exe" inxtemyti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF3C52E-36D5-42be-93E9-E9885B0F71A6}\stubpath = "C:\\Windows\\system32\\inscqyokc.exe" invuwaxma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFCF81A6-832E-4f29-80E9-2EF2DEDB6758}\stubpath = "C:\\Windows\\system32\\inyorihpp.exe" insulctjf.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e00000001b1d0-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5996 inaphxbit.exe 5016 inxjymong.exe 4872 indhxkwmb.exe 2332 invhwkmle.exe 5384 inlsmacbt.exe 5792 inbmkzbqa.exe 5776 indtwnmuu.exe 2632 inkzrlbas.exe 3836 insohtodl.exe 3332 inogwahsa.exe 956 inwsdlxsh.exe 3752 inxiaqxbm.exe 2324 innfvgrkz.exe 5176 indskelwb.exe 2640 inixpjqgj.exe 5576 inmeufqjy.exe 6120 inxtemyti.exe 5224 inyjbrycn.exe 5780 injwnoaqy.exe 4608 inbqostfv.exe 4252 inbfyviuk.exe 784 inuqbjvqf.exe 1036 inwixlnmf.exe 3596 inqmfrmyb.exe 4604 intfuikjc.exe 4300 inykznpoh.exe 1356 ingtvpopk.exe 916 inbuxzyre.exe 3800 inmprqjiy.exe 3176 inruwvobn.exe 5496 injyqkarh.exe 436 innlypqcs.exe 5716 inzvgovkd.exe 2328 injhulmow.exe 4068 inecpcnet.exe 5060 indwztgsi.exe 4800 inmtnbdcu.exe 3852 inrdysgih.exe 4580 insbquvhx.exe 2456 inldtepix.exe 2524 inazpsjiq.exe 1876 infnwdvwr.exe 3236 injlxlxig.exe 5472 inpsutmlb.exe 3704 inbrulkss.exe 5916 inahuhbcs.exe 3672 innuocedv.exe 4932 inqgdzfrf.exe 296 incgzwjvl.exe 4712 inpbwqegf.exe 4772 inetlfmxc.exe 1328 inkbaivic.exe 2752 inqtvunam.exe 4928 inmxiifwj.exe 5136 ingvzmksi.exe 3068 insvxwpco.exe 5048 inaexuhtj.exe 3084 inhwnltjf.exe 1428 incrjzdkv.exe 4864 inhwoipfi.exe 4236 infvqbbup.exe 3764 infdqdofu.exe 3844 inzloqpih.exe 5768 inbqiycju.exe - Loads dropped DLL 64 IoCs
pid Process 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe 5996 inaphxbit.exe 5996 inaphxbit.exe 5016 inxjymong.exe 5016 inxjymong.exe 4872 indhxkwmb.exe 4872 indhxkwmb.exe 2332 invhwkmle.exe 2332 invhwkmle.exe 5384 inlsmacbt.exe 5384 inlsmacbt.exe 5792 inbmkzbqa.exe 5792 inbmkzbqa.exe 5776 indtwnmuu.exe 5776 indtwnmuu.exe 2632 inkzrlbas.exe 2632 inkzrlbas.exe 3836 insohtodl.exe 3836 insohtodl.exe 3332 inogwahsa.exe 3332 inogwahsa.exe 956 inwsdlxsh.exe 956 inwsdlxsh.exe 3752 inxiaqxbm.exe 3752 inxiaqxbm.exe 2324 innfvgrkz.exe 2324 innfvgrkz.exe 5176 indskelwb.exe 5176 indskelwb.exe 2640 inixpjqgj.exe 2640 inixpjqgj.exe 5576 inmeufqjy.exe 5576 inmeufqjy.exe 6120 inxtemyti.exe 6120 inxtemyti.exe 5224 inyjbrycn.exe 5224 inyjbrycn.exe 5780 injwnoaqy.exe 5780 injwnoaqy.exe 4608 inbqostfv.exe 4608 inbqostfv.exe 4252 inbfyviuk.exe 4252 inbfyviuk.exe 784 inuqbjvqf.exe 784 inuqbjvqf.exe 1036 inwixlnmf.exe 1036 inwixlnmf.exe 3596 inqmfrmyb.exe 3596 inqmfrmyb.exe 4604 intfuikjc.exe 4604 intfuikjc.exe 4300 inykznpoh.exe 4300 inykznpoh.exe 1356 ingtvpopk.exe 1356 ingtvpopk.exe 916 inbuxzyre.exe 916 inbuxzyre.exe 3800 inmprqjiy.exe 3800 inmprqjiy.exe 3176 inruwvobn.exe 3176 inruwvobn.exe 5496 injyqkarh.exe 5496 injyqkarh.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\injlxlxig.exe_lang.ini infnwdvwr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmkxopbr.exe File opened for modification C:\Windows\SysWOW64\inpqffxwb.exe_lang.ini incvdypdo.exe File created C:\Windows\SysWOW64\iniaooxbd.exe inhwfuyzl.exe File opened for modification C:\Windows\SysWOW64\inowqgwxz.exe_lang.ini inedyzakd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyvsxuru.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingvnhoze.exe File created C:\Windows\SysWOW64\inugvjlkd.exe inijzqpfx.exe File opened for modification C:\Windows\SysWOW64\inmawkptn.exe_lang.ini inkmpnlpp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inotjfrzg.exe File opened for modification C:\Windows\SysWOW64\intetdxsy.exe_lang.ini innusjmop.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingerepgv.exe File opened for modification C:\Windows\SysWOW64\inxjymong.exe_lang.ini inaphxbit.exe File opened for modification C:\Windows\SysWOW64\inilftocs.exe_lang.ini inowqgwxz.exe File opened for modification C:\Windows\SysWOW64\inpnehxjk.exe_lang.ini inzkcszdo.exe File created C:\Windows\SysWOW64\inpdlvxfh.exe inumafjdj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxbftvlo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfdlthy.exe File opened for modification C:\Windows\SysWOW64\inlgphgbd.exe_lang.ini inbkobdgw.exe File opened for modification C:\Windows\SysWOW64\inxbmijsh.exe_lang.ini inpsjiqqk.exe File opened for modification C:\Windows\SysWOW64\invhwkmle.exe_lang.ini indhxkwmb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrcangym.exe File opened for modification C:\Windows\SysWOW64\iniqzgcyz.exe_lang.ini indlyubtu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwskdhbh.exe File created C:\Windows\SysWOW64\inutvwllh.exe inkwkupid.exe File opened for modification C:\Windows\SysWOW64\incgncjih.exe_lang.ini inckxztas.exe File opened for modification C:\Windows\SysWOW64\inddqfcew.exe_lang.ini inlubyhti.exe File created C:\Windows\SysWOW64\inuprejup.exe inspmpjxs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insohtodl.exe File created C:\Windows\SysWOW64\inmibthrw.exe inrjcgagg.exe File created C:\Windows\SysWOW64\invhyunli.exe inqhyroyr.exe File opened for modification C:\Windows\SysWOW64\inqgdzfrf.exe_lang.ini innuocedv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwhxahtz.exe File created C:\Windows\SysWOW64\inhomdgwi.exe incajnuiq.exe File opened for modification C:\Windows\SysWOW64\insezthji.exe_lang.ini indtosnaj.exe File created C:\Windows\SysWOW64\inarenvge.exe inqxbfmkb.exe File opened for modification C:\Windows\SysWOW64\inesiwrli.exe_lang.ini indjvakex.exe File created C:\Windows\SysWOW64\iniizepdz.exe inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\inczogbkc.exe_lang.ini inpkuzhdr.exe File created C:\Windows\SysWOW64\inwldhtuf.exe injausioy.exe File created C:\Windows\SysWOW64\inuinrlrc.exe insahbdsg.exe File created C:\Windows\SysWOW64\inamdunku.exe inqlzpgys.exe File created C:\Windows\SysWOW64\inymcufhc.exe indlvgkyq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incvyzsfr.exe File opened for modification C:\Windows\SysWOW64\inlhpjpqs.exe_lang.ini insofpwae.exe File created C:\Windows\SysWOW64\inhpdyhbh.exe inqrggyxc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inokbwlsa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhbuwzwg.exe File opened for modification C:\Windows\SysWOW64\intxmhybx.exe_lang.ini injfdlthy.exe File created C:\Windows\SysWOW64\inkesnbrx.exe inuaizlgb.exe File opened for modification C:\Windows\SysWOW64\inclzteci.exe_lang.ini inopeewva.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incwvxbyn.exe File opened for modification C:\Windows\SysWOW64\innljnnyl.exe_lang.ini inltjfxsd.exe File opened for modification C:\Windows\SysWOW64\ingxqnxqy.exe_lang.ini innqmfdal.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvgovkd.exe File opened for modification C:\Windows\SysWOW64\inwtdautu.exe_lang.ini infauwnfj.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini inertnmni.exe File created C:\Windows\SysWOW64\ingtvpopk.exe inykznpoh.exe File opened for modification C:\Windows\SysWOW64\infrfqjpo.exe_lang.ini intglbjrf.exe File created C:\Windows\SysWOW64\injkrqgyq.exe invlhtipl.exe File opened for modification C:\Windows\SysWOW64\inhuwzjax.exe_lang.ini infbnevol.exe File opened for modification C:\Windows\SysWOW64\infcpjolj.exe_lang.ini inddmxhxc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inejnhnnw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indrmgdxz.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhyqlaum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indhxkwmb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqtvunam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insacfcod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzfhvydh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injkrqgyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyluacnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxitdtqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdlvlhw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdmufdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaaajueu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intqwjtdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkveoutv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyfydwsq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwftrhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrfpuysy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilftocs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyvsxuru.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwikohfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlisltat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisucehe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfsfaqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incwvxbyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inigtklnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infumgnyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqgiwze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhqyjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvqbbup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingcowdkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indqsmlmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlolxmlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innjrlbrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwfuyzl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpmynm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invatpnbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invqlrkwy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingkycsra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invbdruwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmayveeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfevnir.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incmrujul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intcrvwiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzyhfjju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inortslka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzpesupo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmnyysj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzesqzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inttrrtqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inofbieyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intsuvkkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invgvfzue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrgtvyi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwuyycww.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmbpckft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injidfpid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuakpshs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwgusogd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhscspdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowmiavg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe 5996 inaphxbit.exe 5996 inaphxbit.exe 5016 inxjymong.exe 5016 inxjymong.exe 4872 indhxkwmb.exe 4872 indhxkwmb.exe 2332 invhwkmle.exe 2332 invhwkmle.exe 5384 inlsmacbt.exe 5384 inlsmacbt.exe 5792 inbmkzbqa.exe 5792 inbmkzbqa.exe 5776 indtwnmuu.exe 5776 indtwnmuu.exe 2632 inkzrlbas.exe 2632 inkzrlbas.exe 3836 insohtodl.exe 3836 insohtodl.exe 3332 inogwahsa.exe 3332 inogwahsa.exe 956 inwsdlxsh.exe 956 inwsdlxsh.exe 3752 inxiaqxbm.exe 3752 inxiaqxbm.exe 2324 innfvgrkz.exe 2324 innfvgrkz.exe 5176 indskelwb.exe 5176 indskelwb.exe 2640 inixpjqgj.exe 2640 inixpjqgj.exe 5576 inmeufqjy.exe 5576 inmeufqjy.exe 6120 inxtemyti.exe 6120 inxtemyti.exe 5224 inyjbrycn.exe 5224 inyjbrycn.exe 5780 injwnoaqy.exe 5780 injwnoaqy.exe 4608 inbqostfv.exe 4608 inbqostfv.exe 4252 inbfyviuk.exe 4252 inbfyviuk.exe 784 inuqbjvqf.exe 784 inuqbjvqf.exe 1036 inwixlnmf.exe 1036 inwixlnmf.exe 3596 inqmfrmyb.exe 3596 inqmfrmyb.exe 4604 intfuikjc.exe 4604 intfuikjc.exe 4300 inykznpoh.exe 4300 inykznpoh.exe 1356 ingtvpopk.exe 1356 ingtvpopk.exe 916 inbuxzyre.exe 916 inbuxzyre.exe 3800 inmprqjiy.exe 3800 inmprqjiy.exe 3176 inruwvobn.exe 3176 inruwvobn.exe 5496 injyqkarh.exe 5496 injyqkarh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 5996 inaphxbit.exe Token: SeDebugPrivilege 5016 inxjymong.exe Token: SeDebugPrivilege 4872 indhxkwmb.exe Token: SeDebugPrivilege 2332 invhwkmle.exe Token: SeDebugPrivilege 5384 inlsmacbt.exe Token: SeDebugPrivilege 5792 inbmkzbqa.exe Token: SeDebugPrivilege 5776 indtwnmuu.exe Token: SeDebugPrivilege 2632 inkzrlbas.exe Token: SeDebugPrivilege 3836 insohtodl.exe Token: SeDebugPrivilege 3332 inogwahsa.exe Token: SeDebugPrivilege 956 inwsdlxsh.exe Token: SeDebugPrivilege 3752 inxiaqxbm.exe Token: SeDebugPrivilege 2324 innfvgrkz.exe Token: SeDebugPrivilege 5176 indskelwb.exe Token: SeDebugPrivilege 2640 inixpjqgj.exe Token: SeDebugPrivilege 5576 inmeufqjy.exe Token: SeDebugPrivilege 6120 inxtemyti.exe Token: SeDebugPrivilege 5224 inyjbrycn.exe Token: SeDebugPrivilege 5780 injwnoaqy.exe Token: SeDebugPrivilege 4608 inbqostfv.exe Token: SeDebugPrivilege 4252 inbfyviuk.exe Token: SeDebugPrivilege 784 inuqbjvqf.exe Token: SeDebugPrivilege 1036 inwixlnmf.exe Token: SeDebugPrivilege 3596 inqmfrmyb.exe Token: SeDebugPrivilege 4604 intfuikjc.exe Token: SeDebugPrivilege 4300 inykznpoh.exe Token: SeDebugPrivilege 1356 ingtvpopk.exe Token: SeDebugPrivilege 916 inbuxzyre.exe Token: SeDebugPrivilege 3800 inmprqjiy.exe Token: SeDebugPrivilege 3176 inruwvobn.exe Token: SeDebugPrivilege 5496 injyqkarh.exe Token: SeDebugPrivilege 436 innlypqcs.exe Token: SeDebugPrivilege 5716 inzvgovkd.exe Token: SeDebugPrivilege 2328 injhulmow.exe Token: SeDebugPrivilege 4068 inecpcnet.exe Token: SeDebugPrivilege 5060 indwztgsi.exe Token: SeDebugPrivilege 4800 inmtnbdcu.exe Token: SeDebugPrivilege 3852 inrdysgih.exe Token: SeDebugPrivilege 4580 insbquvhx.exe Token: SeDebugPrivilege 2456 inldtepix.exe Token: SeDebugPrivilege 2524 inazpsjiq.exe Token: SeDebugPrivilege 1876 infnwdvwr.exe Token: SeDebugPrivilege 3236 injlxlxig.exe Token: SeDebugPrivilege 5472 inpsutmlb.exe Token: SeDebugPrivilege 3704 inbrulkss.exe Token: SeDebugPrivilege 5916 inahuhbcs.exe Token: SeDebugPrivilege 3672 innuocedv.exe Token: SeDebugPrivilege 4932 inqgdzfrf.exe Token: SeDebugPrivilege 296 incgzwjvl.exe Token: SeDebugPrivilege 4712 inpbwqegf.exe Token: SeDebugPrivilege 4772 inetlfmxc.exe Token: SeDebugPrivilege 1328 inkbaivic.exe Token: SeDebugPrivilege 2752 inqtvunam.exe Token: SeDebugPrivilege 4928 inmxiifwj.exe Token: SeDebugPrivilege 5136 ingvzmksi.exe Token: SeDebugPrivilege 3068 insvxwpco.exe Token: SeDebugPrivilege 5048 inaexuhtj.exe Token: SeDebugPrivilege 3084 inhwnltjf.exe Token: SeDebugPrivilege 1428 incrjzdkv.exe Token: SeDebugPrivilege 4864 inhwoipfi.exe Token: SeDebugPrivilege 4236 infvqbbup.exe Token: SeDebugPrivilege 3764 infdqdofu.exe Token: SeDebugPrivilege 3844 inzloqpih.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe 5996 inaphxbit.exe 5016 inxjymong.exe 4872 indhxkwmb.exe 2332 invhwkmle.exe 5384 inlsmacbt.exe 5792 inbmkzbqa.exe 5776 indtwnmuu.exe 2632 inkzrlbas.exe 3836 insohtodl.exe 3332 inogwahsa.exe 956 inwsdlxsh.exe 3752 inxiaqxbm.exe 2324 innfvgrkz.exe 5176 indskelwb.exe 2640 inixpjqgj.exe 5576 inmeufqjy.exe 6120 inxtemyti.exe 5224 inyjbrycn.exe 5780 injwnoaqy.exe 4608 inbqostfv.exe 4252 inbfyviuk.exe 784 inuqbjvqf.exe 1036 inwixlnmf.exe 3596 inqmfrmyb.exe 4604 intfuikjc.exe 4300 inykznpoh.exe 1356 ingtvpopk.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5536 wrote to memory of 5996 5536 2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 5996 wrote to memory of 5016 5996 inaphxbit.exe 90 PID 5016 wrote to memory of 4872 5016 inxjymong.exe 91 PID 4872 wrote to memory of 2332 4872 indhxkwmb.exe 92 PID 2332 wrote to memory of 5384 2332 invhwkmle.exe 93 PID 5384 wrote to memory of 5792 5384 inlsmacbt.exe 94 PID 5792 wrote to memory of 5776 5792 inbmkzbqa.exe 95 PID 5776 wrote to memory of 2632 5776 indtwnmuu.exe 96 PID 2632 wrote to memory of 3836 2632 inkzrlbas.exe 97 PID 3836 wrote to memory of 3332 3836 insohtodl.exe 98 PID 3332 wrote to memory of 956 3332 inogwahsa.exe 99 PID 956 wrote to memory of 3752 956 inwsdlxsh.exe 100 PID 3752 wrote to memory of 2324 3752 inxiaqxbm.exe 101 PID 2324 wrote to memory of 5176 2324 innfvgrkz.exe 102 PID 5176 wrote to memory of 2640 5176 indskelwb.exe 103 PID 2640 wrote to memory of 5576 2640 inixpjqgj.exe 104 PID 5576 wrote to memory of 6120 5576 inmeufqjy.exe 105 PID 6120 wrote to memory of 5224 6120 inxtemyti.exe 106 PID 5224 wrote to memory of 5780 5224 inyjbrycn.exe 107 PID 5780 wrote to memory of 4608 5780 injwnoaqy.exe 108 PID 4608 wrote to memory of 4252 4608 inbqostfv.exe 109 PID 4252 wrote to memory of 784 4252 inbfyviuk.exe 110 PID 784 wrote to memory of 1036 784 inuqbjvqf.exe 111 PID 1036 wrote to memory of 3596 1036 inwixlnmf.exe 112 PID 3596 wrote to memory of 4604 3596 inqmfrmyb.exe 113 PID 4604 wrote to memory of 4300 4604 intfuikjc.exe 114 PID 4300 wrote to memory of 1356 4300 inykznpoh.exe 115 PID 1356 wrote to memory of 916 1356 ingtvpopk.exe 116 PID 916 wrote to memory of 3800 916 inbuxzyre.exe 117 PID 3800 wrote to memory of 3176 3800 inmprqjiy.exe 118 PID 3176 wrote to memory of 5496 3176 inruwvobn.exe 119 PID 5496 wrote to memory of 436 5496 injyqkarh.exe 120 PID 436 wrote to memory of 5716 436 innlypqcs.exe 121 PID 5716 wrote to memory of 2328 5716 inzvgovkd.exe 122 PID 2328 wrote to memory of 4068 2328 injhulmow.exe 123 PID 4068 wrote to memory of 5060 4068 inecpcnet.exe 124 PID 5060 wrote to memory of 4800 5060 indwztgsi.exe 125 PID 4800 wrote to memory of 3852 4800 inmtnbdcu.exe 126 PID 3852 wrote to memory of 4580 3852 inrdysgih.exe 127 PID 4580 wrote to memory of 2456 4580 insbquvhx.exe 128 PID 2456 wrote to memory of 2524 2456 inldtepix.exe 129 PID 2524 wrote to memory of 1876 2524 inazpsjiq.exe 130 PID 1876 wrote to memory of 3236 1876 infnwdvwr.exe 131 PID 3236 wrote to memory of 5472 3236 injlxlxig.exe 132 PID 5472 wrote to memory of 3704 5472 inpsutmlb.exe 133 PID 3704 wrote to memory of 5916 3704 inbrulkss.exe 134 PID 5916 wrote to memory of 3672 5916 inahuhbcs.exe 135 PID 3672 wrote to memory of 4932 3672 innuocedv.exe 136 PID 4932 wrote to memory of 296 4932 inqgdzfrf.exe 137 PID 296 wrote to memory of 4712 296 incgzwjvl.exe 138 PID 4712 wrote to memory of 4772 4712 inpbwqegf.exe 139 PID 4772 wrote to memory of 1328 4772 inetlfmxc.exe 140 PID 1328 wrote to memory of 2752 1328 inkbaivic.exe 141 PID 2752 wrote to memory of 4928 2752 inqtvunam.exe 142 PID 4928 wrote to memory of 5136 4928 inmxiifwj.exe 143 PID 5136 wrote to memory of 3068 5136 ingvzmksi.exe 144 PID 3068 wrote to memory of 5048 3068 insvxwpco.exe 145 PID 5048 wrote to memory of 3084 5048 inaexuhtj.exe 146 PID 3084 wrote to memory of 1428 3084 inhwnltjf.exe 147 PID 1428 wrote to memory of 4864 1428 incrjzdkv.exe 148 PID 4864 wrote to memory of 4236 4864 inhwoipfi.exe 149 PID 4236 wrote to memory of 3764 4236 infvqbbup.exe 150 PID 3764 wrote to memory of 3844 3764 infdqdofu.exe 151 PID 3844 wrote to memory of 5768 3844 inzloqpih.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_61503a91b002f410dba8ac4a3a66fe9a_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe15⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe25⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe31⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe32⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe34⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe38⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe46⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe65⤵
- Executes dropped EXE
PID:5768 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe66⤵
- Drops file in System32 directory
PID:5432 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe67⤵PID:3904
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe68⤵PID:5460
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe69⤵PID:5020
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe70⤵
- Drops file in System32 directory
PID:3396 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe71⤵PID:2140
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe72⤵PID:5332
-
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe73⤵PID:5748
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe74⤵PID:876
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe75⤵PID:3696
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe76⤵PID:2988
-
C:\Windows\SysWOW64\insaljfpw.exeC:\Windows\system32\insaljfpw.exe77⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3452 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe78⤵PID:4744
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe79⤵PID:2248
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe80⤵
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe81⤵PID:3376
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe82⤵
- Drops file in System32 directory
PID:4612 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe83⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2972 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe84⤵PID:972
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe85⤵PID:5436
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe86⤵PID:2348
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe87⤵PID:3056
-
C:\Windows\SysWOW64\inuloqrtx.exeC:\Windows\system32\inuloqrtx.exe88⤵PID:4568
-
C:\Windows\SysWOW64\inkuaczqt.exeC:\Windows\system32\inkuaczqt.exe89⤵PID:1088
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe90⤵PID:2848
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe91⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe92⤵
- Drops file in System32 directory
PID:4328 -
C:\Windows\SysWOW64\inpnehxjk.exeC:\Windows\system32\inpnehxjk.exe93⤵PID:4636
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe94⤵PID:4620
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe95⤵PID:4084
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe96⤵PID:1208
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe97⤵PID:3184
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe98⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1776 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe99⤵PID:5908
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe100⤵
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\intmsjkwc.exeC:\Windows\system32\intmsjkwc.exe101⤵PID:3920
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe102⤵PID:2724
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe103⤵PID:2772
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe104⤵PID:3232
-
C:\Windows\SysWOW64\inmqlrpew.exeC:\Windows\system32\inmqlrpew.exe105⤵PID:3112
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe106⤵PID:5584
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe107⤵PID:1900
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe108⤵PID:1268
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe109⤵
- Drops file in System32 directory
PID:4796 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe110⤵PID:2804
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe111⤵PID:1432
-
C:\Windows\SysWOW64\insywlfel.exeC:\Windows\system32\insywlfel.exe112⤵PID:5032
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe113⤵PID:3588
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe114⤵PID:2792
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe115⤵
- System Location Discovery: System Language Discovery
PID:4092 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe116⤵PID:3436
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe117⤵PID:1644
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe118⤵
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe119⤵PID:2604
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe120⤵PID:2700
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe121⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-