Analysis
- max time kernel
62s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 02:26
Behavioral task
behavioral1
Sample
2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260930-cxc1ssvy9p
- SHA256 cc1ccf10c0d66e5c81df59e2704771cc639770f3bf704cb768e5106181a1d12a
- MD5 426c8050a015fb0586204899471c5c80
- SHA1 20bb0f2afa44764d3bf4a01f063a2f7114a06128
- SHA512 1043f620f7122feec76986097183d407774c553026258c931a4800ef61c728e506bf67f79b98bd0d6752ae76bc4e43298a99860489f05c5906f22baefaffb208
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTy:RPjOa1NxyYtH1y
- TLSH T1B815AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 47 IoCs
resource yara_rule behavioral2/memory/4624-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c53c-21.dat family_gh0strat behavioral2/files/0x000d00000001c541-41.dat family_gh0strat behavioral2/files/0x000d00000001c545-65.dat family_gh0strat behavioral2/memory/4320-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c54a-91.dat family_gh0strat behavioral2/memory/4572-92-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4732-114-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c552-131.dat family_gh0strat behavioral2/memory/4856-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c555-154.dat family_gh0strat behavioral2/memory/4616-158-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c559-177.dat family_gh0strat behavioral2/memory/3768-202-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c56c-222.dat family_gh0strat behavioral2/files/0x000d00000001c570-248.dat family_gh0strat behavioral2/memory/6120-247-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3124-269-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c578-287.dat family_gh0strat behavioral2/files/0x000d00000001c57c-310.dat family_gh0strat behavioral2/files/0x000d00000001c580-337.dat family_gh0strat behavioral2/files/0x000d00000001c584-360.dat family_gh0strat behavioral2/memory/2556-398-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3880-415-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1604-434-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5608-471-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1344-489-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1944-507-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1608-524-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5408-562-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5108-579-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3396-543-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5440-452-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1272-378-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3480-359-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5772-336-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/708-312-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/708-293-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6084-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c574-270.dat family_gh0strat behavioral2/memory/2396-225-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c568-203.dat family_gh0strat behavioral2/memory/4604-181-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c54e-112.dat family_gh0strat behavioral2/memory/4672-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c540-31.dat family_gh0strat behavioral2/memory/4624-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5EE18B0A-B92D-47c3-8D5B-DFA53DCFE140} insnyjjgx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{737F323F-6FD8-42df-9BD5-65D6DFF5DAF7} inupkqjvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B1FA6A9-C673-4954-ABF2-4AEA530847F1}\stubpath = "C:\\Windows\\system32\\injfevnir.exe" inihodrxd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBA988A0-7B04-42d4-A57A-FEF02C90B9E5} indskelwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D389D77B-68DD-4ee7-ABE9-B68B0241FDA2} injhulmow.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBCBE00B-0570-485e-841F-97686B200B52} ineqbmfxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10BA92E5-99F6-4db2-A81E-9793B8FDC3DA} inowmiavg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47737A36-3E68-4935-AC9E-A10EFB175A2A}\stubpath = "C:\\Windows\\system32\\inmvbdomc.exe" innoddvuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA1817B9-8FC1-4de0-BBFA-BDFDCEF648F4}\stubpath = "C:\\Windows\\system32\\infnxzhjm.exe" inlgwrccv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E572ECB5-CDFE-4ddd-8917-FCCCE8C2A0EE}\stubpath = "C:\\Windows\\system32\\inphclvql.exe" inamdunku.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C8EBC9B-20A4-4700-B24A-25256580449C}\stubpath = "C:\\Windows\\system32\\inpbwqegf.exe" ineugyxhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E0CD3BE-63DB-4698-B86D-54513EC4D1C4}\stubpath = "C:\\Windows\\system32\\inimthpzj.exe" inhbuwzwg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12A90D5A-216E-4a04-800B-E39308A3808B} infxiosfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9FD2B93-3186-475d-8C19-28789E516547} inqnbrgit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB193904-29B2-4a0f-B77A-9162151A19C7} inthmqkqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EEE2BFF5-69CB-48f6-BA23-66AAD01D4822} inulkzdji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FF16D12-0B4F-4e3e-864B-AAF933159706}\stubpath = "C:\\Windows\\system32\\innptoush.exe" inwtdautu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6855039E-B14B-4db3-9652-B5A7D69E7C9A} indxawycz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15717634-1E1E-47c1-ABAD-D07C095A2427} intikurgv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{328CD90F-BD21-4991-AA39-B0C7CC3F224B} inyodrton.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AB5A7F5-F7F4-4795-8911-2B306AE2E1BB}\stubpath = "C:\\Windows\\system32\\inooxsntm.exe" infsuonoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06E8F5B0-2F15-4577-A7C2-0717A8BC1387} inqjpgzht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09696FC2-5C82-4ad7-B10B-80D5E9FF7A6F}\stubpath = "C:\\Windows\\system32\\inkivmnpx.exe" inxrqyyst.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FF16D12-0B4F-4e3e-864B-AAF933159706} inwtdautu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70AAC3B3-E614-4f8e-9035-6D546CB3AB17} inocokdvj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFA5F834-0D11-4571-B91A-50236460145C}\stubpath = "C:\\Windows\\system32\\inxshctsn.exe" inuizasnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69976E68-5A21-4582-9DD5-BF1BCBF99BB4} inxitdtqe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12568361-DCCE-455a-B528-7A105619E4CD} indscwrxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7DFF648-47B2-46ac-84FF-67188E7D8198} invlhtipl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2DBD761-15A8-4bfd-9203-96FD721151A9} inyegtexf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40F454F4-7178-4634-80D2-52BBC088704B} indtkzjxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{880F062F-36EE-40a6-89FF-7995E9F1CB9E} inxnqhgoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{917A3EFA-9A2C-472b-9D1F-7B053AE950A4}\stubpath = "C:\\Windows\\system32\\inwyoarng.exe" injfzedyv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{326E8111-B6DD-4bd5-936F-E91D27D62424}\stubpath = "C:\\Windows\\system32\\invzzdxxz.exe" inrkqhiua.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F58FEE6E-0113-43d9-B386-527C4CE3CABB}\stubpath = "C:\\Windows\\system32\\inaivxrqr.exe" inknedlyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D398A0B7-8AA7-4aa5-A275-CAEB43B693A2} infmbihgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F310303-E685-4623-92E3-A4DB55B20A72}\stubpath = "C:\\Windows\\system32\\incsnrmiw.exe" inktbmkag.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90CD54B5-7297-46ce-A92B-C9A4CD235D1C} inrbrocsh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74710571-0889-4a00-AF35-488B6F4790B0}\stubpath = "C:\\Windows\\system32\\innswqwhw.exe" incldxuje.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BB3E4F6-6F8A-4ac2-9CCB-6D560777A2C2}\stubpath = "C:\\Windows\\system32\\inxrycagn.exe" inyoeaukm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A956ED4-8E1A-45c4-BD58-ABB47B2F5649}\stubpath = "C:\\Windows\\system32\\indlvgkyq.exe" inniucjdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B545B05-F19F-460e-A83E-15180EA9A928} inhvtxxbv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51C4FAEA-0829-4df6-9289-04C0902DA652} inzjwmbpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD205EC1-923A-4347-BC6D-B328F0F56D60} injfevnir.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98DD55B5-FF25-4e5a-87F2-290996F3B956}\stubpath = "C:\\Windows\\system32\\injyiwuqi.exe" inecpcnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F32C3DC-B06A-45dc-BF8A-385C608218E4}\stubpath = "C:\\Windows\\system32\\insdtdypv.exe" intwamnoz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9FA0976-5890-42fa-B54F-BBFF4D329817} inhwnltjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30B293EA-1D41-44f3-A8DC-A5AAC5FCF3EF}\stubpath = "C:\\Windows\\system32\\inuisngbw.exe" inmrxryds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6922366C-E2F2-41da-B689-B604B92DFEFB}\stubpath = "C:\\Windows\\system32\\inxujybfr.exe" intnjpska.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23EC9929-5BAF-4756-8B2B-3970A0028E98}\stubpath = "C:\\Windows\\system32\\indvjzcoq.exe" inrcangym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E3547A-C562-4388-86B1-A9061D522A9F}\stubpath = "C:\\Windows\\system32\\inbsfowhf.exe" inertnmni.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30213744-1F89-468b-BBFE-E8DA90649F86} inbmkzbqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C1B3D24-C8BB-4ed8-B126-3A5D53EB95ED} inqrggyxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{937C3409-9E81-4def-A496-03933969AE9C} innqsrkjz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13562266-0799-410e-A248-15AC6711C457}\stubpath = "C:\\Windows\\system32\\inwixlnmf.exe" infdqdofu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F8585EA-DAEC-46e0-9444-2A35EF965B64}\stubpath = "C:\\Windows\\system32\\inesqmezb.exe" inhiypoew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E681AAA1-AAA6-44f3-BEB1-11775F967276}\stubpath = "C:\\Windows\\system32\\inxrqyyst.exe" inwyoarng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F8274E7-A366-49fc-B35F-1C0668C79F23}\stubpath = "C:\\Windows\\system32\\inzkcszdo.exe" ingiuiufd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{906ABB4C-9878-462a-BB78-0B9C3771E814} inuiybnpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E869CEBE-2A28-468b-9B8D-CF3E9A97060A}\stubpath = "C:\\Windows\\system32\\inkdbjsnc.exe" inzkzjyci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AC37686-A67E-40c9-A658-40B92EFA46F7}\stubpath = "C:\\Windows\\system32\\intnjpska.exe" inxshctsn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD8209AD-BC32-459f-B136-C44BB9A253B2}\stubpath = "C:\\Windows\\system32\\invdmeyvk.exe" inorbpnrr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F22BEBFE-8D59-48ba-B15D-546650A2DAC2}\stubpath = "C:\\Windows\\system32\\inilcbjwj.exe" indtwnmuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A9B02A4-B23A-4b04-B76C-D4927C26AA63}\stubpath = "C:\\Windows\\system32\\inopeewva.exe" inbjwysrs.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000600000001b859-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4672 inqcxrfhg.exe 4320 inxjymong.exe 4572 inortslka.exe 4732 inugvjlkd.exe 4856 inogwahsa.exe 4616 incvyzsfr.exe 4604 injyqkarh.exe 3768 inpsutmlb.exe 2396 intfuikjc.exe 6120 inlsmacbt.exe 3124 inxtemyti.exe 6084 insohtodl.exe 708 indwztgsi.exe 5772 inldtepix.exe 3480 insvxwpco.exe 1272 inykznpoh.exe 2556 inoavpdfe.exe 3880 indskelwb.exe 1604 inixpjqgj.exe 5440 innuocedv.exe 5608 inbuxzyre.exe 1344 inhwoipfi.exe 1944 inmeufqjy.exe 1608 inuqbjvqf.exe 3396 incsvmltt.exe 5408 inyjbrycn.exe 5108 inljyapnv.exe 5964 ineybxzdp.exe 3248 inaexuhtj.exe 564 innqsrkjz.exe 2936 inyorihpp.exe 5040 ingiuiufd.exe 1712 inzkcszdo.exe 2928 invuwaxma.exe 1904 insezthji.exe 4592 infhthtec.exe 4992 inmprqjiy.exe 4188 inlhzufqa.exe 6032 inatwyxqd.exe 976 ingtgabri.exe 2760 inpleqlxa.exe 5392 inqtvunam.exe 6092 inetlfmxc.exe 4908 inxiaqxbm.exe 4268 intsuvkkg.exe 4344 intpaiupe.exe 4476 inbrulkss.exe 3080 inwhpwale.exe 1796 insrzztuj.exe 2812 incrjzdkv.exe 2460 inpiofygs.exe 5840 inkzrlbas.exe 1548 injwnoaqy.exe 4220 inpfzcyeq.exe 4488 inxhvtpha.exe 5760 inigtklnv.exe 2780 inwmpgfnn.exe 1376 infdqdofu.exe 5056 inwixlnmf.exe 4568 ingvzmksi.exe 3260 inmkxopbr.exe 2984 inmnccutj.exe 4904 intcrvwiy.exe 4996 injmdckxk.exe - Loads dropped DLL 64 IoCs
pid Process 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe 4672 inqcxrfhg.exe 4672 inqcxrfhg.exe 4320 inxjymong.exe 4320 inxjymong.exe 4572 inortslka.exe 4572 inortslka.exe 4732 inugvjlkd.exe 4732 inugvjlkd.exe 4856 inogwahsa.exe 4856 inogwahsa.exe 4616 incvyzsfr.exe 4616 incvyzsfr.exe 4604 injyqkarh.exe 4604 injyqkarh.exe 3768 inpsutmlb.exe 3768 inpsutmlb.exe 2396 intfuikjc.exe 2396 intfuikjc.exe 6120 inlsmacbt.exe 6120 inlsmacbt.exe 3124 inxtemyti.exe 3124 inxtemyti.exe 6084 insohtodl.exe 6084 insohtodl.exe 708 indwztgsi.exe 708 indwztgsi.exe 5772 inldtepix.exe 5772 inldtepix.exe 3480 insvxwpco.exe 3480 insvxwpco.exe 1272 inykznpoh.exe 1272 inykznpoh.exe 2556 inoavpdfe.exe 2556 inoavpdfe.exe 3880 indskelwb.exe 3880 indskelwb.exe 1604 inixpjqgj.exe 1604 inixpjqgj.exe 5440 innuocedv.exe 5440 innuocedv.exe 5608 inbuxzyre.exe 5608 inbuxzyre.exe 1344 inhwoipfi.exe 1344 inhwoipfi.exe 1944 inmeufqjy.exe 1944 inmeufqjy.exe 1608 inuqbjvqf.exe 1608 inuqbjvqf.exe 3396 incsvmltt.exe 3396 incsvmltt.exe 5408 inyjbrycn.exe 5408 inyjbrycn.exe 5108 inljyapnv.exe 5108 inljyapnv.exe 5964 ineybxzdp.exe 5964 ineybxzdp.exe 3248 inaexuhtj.exe 3248 inaexuhtj.exe 564 innqsrkjz.exe 564 innqsrkjz.exe 2936 inyorihpp.exe 2936 inyorihpp.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inmsevrki.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqnbrgit.exe File created C:\Windows\SysWOW64\inscqyokc.exe inmtnbdcu.exe File created C:\Windows\SysWOW64\infslrijv.exe inlvjosms.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infslrijv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injsnioht.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inimbeutc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhfnbzwf.exe File created C:\Windows\SysWOW64\iniszdhvx.exe inxlrthqk.exe File opened for modification C:\Windows\SysWOW64\inrngsnzc.exe_lang.ini iniqzgcyz.exe File opened for modification C:\Windows\SysWOW64\inbnjcuis.exe_lang.ini inniombtb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbohznex.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbmmjnwc.exe File opened for modification C:\Windows\SysWOW64\incixldvq.exe_lang.ini inmkoozmm.exe File opened for modification C:\Windows\SysWOW64\inqqspmro.exe_lang.ini inawcknai.exe File created C:\Windows\SysWOW64\inqcxrfhg.exe 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe File created C:\Windows\SysWOW64\ingoxeawx.exe inadbobmd.exe File created C:\Windows\SysWOW64\inthmqkqb.exe inzhuwqpq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indryibnm.exe File created C:\Windows\SysWOW64\inaikwkwh.exe inopeewva.exe File created C:\Windows\SysWOW64\injyixbhg.exe inupalliz.exe File opened for modification C:\Windows\SysWOW64\infnxzhjm.exe_lang.ini inlgwrccv.exe File opened for modification C:\Windows\SysWOW64\innptoush.exe_lang.ini inwtdautu.exe File opened for modification C:\Windows\SysWOW64\inwtyvsvp.exe_lang.ini innxkgbub.exe File created C:\Windows\SysWOW64\inqtvunam.exe inpleqlxa.exe File created C:\Windows\SysWOW64\infdqdofu.exe inwmpgfnn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineqbmfxl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzjwmbpr.exe File opened for modification C:\Windows\SysWOW64\intndtuwg.exe_lang.ini insaljfpw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaqceivb.exe File opened for modification C:\Windows\SysWOW64\inqpqfsux.exe_lang.ini inqqspmro.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlubyhti.exe File opened for modification C:\Windows\SysWOW64\infmbpvbz.exe_lang.ini infnxzhjm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfevnir.exe File opened for modification C:\Windows\SysWOW64\inwikshbc.exe_lang.ini indbxwxmz.exe File created C:\Windows\SysWOW64\inldtepix.exe indwztgsi.exe File opened for modification C:\Windows\SysWOW64\inuiybnpg.exe_lang.ini inazpsjiq.exe File opened for modification C:\Windows\SysWOW64\inqklaasr.exe_lang.ini inumafjdj.exe File created C:\Windows\SysWOW64\inxnqhgoo.exe inmayveeq.exe File opened for modification C:\Windows\SysWOW64\injfzedyv.exe_lang.ini inxnqhgoo.exe File created C:\Windows\SysWOW64\ingyagyjp.exe ingvfeugi.exe File created C:\Windows\SysWOW64\inoropope.exe inxujybfr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insohtodl.exe File opened for modification C:\Windows\SysWOW64\invqmdynu.exe_lang.ini inkveoutv.exe File created C:\Windows\SysWOW64\inqxvmprs.exe inacgtgkr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzfhvydh.exe File created C:\Windows\SysWOW64\inbwxiybi.exe inuhmcksg.exe File created C:\Windows\SysWOW64\inkjzlnrk.exe incehxwfd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indvjzcoq.exe File created C:\Windows\SysWOW64\inyxynpgc.exe inpbwqegf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infsuonoj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inooxsntm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incrjzdkv.exe File opened for modification C:\Windows\SysWOW64\inkzrlbas.exe_lang.ini inpiofygs.exe File opened for modification C:\Windows\SysWOW64\inhzpfbvl.exe_lang.ini inlubyhti.exe File created C:\Windows\SysWOW64\intuwvzao.exe inuinrlrc.exe File created C:\Windows\SysWOW64\intbosajb.exe infzzbyva.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injkrqgyq.exe File opened for modification C:\Windows\SysWOW64\inqjpgzht.exe_lang.ini inesqmezb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaphxbit.exe File created C:\Windows\SysWOW64\ingfvhjng.exe inqxvmprs.exe File created C:\Windows\SysWOW64\inupalliz.exe inyccnaan.exe File opened for modification C:\Windows\SysWOW64\inrbrocsh.exe_lang.ini inqrgtvyi.exe File opened for modification C:\Windows\SysWOW64\inwuyycww.exe_lang.ini inimbeutc.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfqeotx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqnbrgit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineeenyiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisucehe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intlkfhrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebdvara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhthtec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqfeufhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmhxsddw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnxzhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwuyycww.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwbuqoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkwblfyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrlmbbts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtiwity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktbmkag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrfqjpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incldxuje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbdhuahl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhqlgymf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwoipfi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkjzlnrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inncprues.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewhnrej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infsilnih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invmsakfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insacfcod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyorihpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrtwgusw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwmpgfnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infdqdofu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inltanpsp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyvsxuru.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innbxlquo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogwahsa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhzufqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmayveeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtfhlye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyaereiz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indpalewk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indqsmlmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuzcxoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpdimgmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaaajueu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvdypdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrfpuysy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmvbdomc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbrdfjw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyiwuqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inawcknai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innuocedv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inulkzdji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indkgfezw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbskfog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhvtxxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inphclvql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqiycju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbihgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktojpiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuisngbw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe 4672 inqcxrfhg.exe 4672 inqcxrfhg.exe 4320 inxjymong.exe 4320 inxjymong.exe 4572 inortslka.exe 4572 inortslka.exe 4732 inugvjlkd.exe 4732 inugvjlkd.exe 4856 inogwahsa.exe 4856 inogwahsa.exe 4616 incvyzsfr.exe 4616 incvyzsfr.exe 4604 injyqkarh.exe 4604 injyqkarh.exe 3768 inpsutmlb.exe 3768 inpsutmlb.exe 2396 intfuikjc.exe 2396 intfuikjc.exe 6120 inlsmacbt.exe 6120 inlsmacbt.exe 3124 inxtemyti.exe 3124 inxtemyti.exe 6084 insohtodl.exe 6084 insohtodl.exe 708 indwztgsi.exe 708 indwztgsi.exe 5772 inldtepix.exe 5772 inldtepix.exe 3480 insvxwpco.exe 3480 insvxwpco.exe 1272 inykznpoh.exe 1272 inykznpoh.exe 2556 inoavpdfe.exe 2556 inoavpdfe.exe 3880 indskelwb.exe 3880 indskelwb.exe 1604 inixpjqgj.exe 1604 inixpjqgj.exe 5440 innuocedv.exe 5440 innuocedv.exe 5608 inbuxzyre.exe 5608 inbuxzyre.exe 1344 inhwoipfi.exe 1344 inhwoipfi.exe 1944 inmeufqjy.exe 1944 inmeufqjy.exe 1608 inuqbjvqf.exe 1608 inuqbjvqf.exe 3396 incsvmltt.exe 3396 incsvmltt.exe 5408 inyjbrycn.exe 5408 inyjbrycn.exe 5108 inljyapnv.exe 5108 inljyapnv.exe 5964 ineybxzdp.exe 5964 ineybxzdp.exe 3248 inaexuhtj.exe 3248 inaexuhtj.exe 564 innqsrkjz.exe 564 innqsrkjz.exe 2936 inyorihpp.exe 2936 inyorihpp.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 4672 inqcxrfhg.exe Token: SeDebugPrivilege 4320 inxjymong.exe Token: SeDebugPrivilege 4572 inortslka.exe Token: SeDebugPrivilege 4732 inugvjlkd.exe Token: SeDebugPrivilege 4856 inogwahsa.exe Token: SeDebugPrivilege 4616 incvyzsfr.exe Token: SeDebugPrivilege 4604 injyqkarh.exe Token: SeDebugPrivilege 3768 inpsutmlb.exe Token: SeDebugPrivilege 2396 intfuikjc.exe Token: SeDebugPrivilege 6120 inlsmacbt.exe Token: SeDebugPrivilege 3124 inxtemyti.exe Token: SeDebugPrivilege 6084 insohtodl.exe Token: SeDebugPrivilege 708 indwztgsi.exe Token: SeDebugPrivilege 5772 inldtepix.exe Token: SeDebugPrivilege 3480 insvxwpco.exe Token: SeDebugPrivilege 1272 inykznpoh.exe Token: SeDebugPrivilege 2556 inoavpdfe.exe Token: SeDebugPrivilege 3880 indskelwb.exe Token: SeDebugPrivilege 1604 inixpjqgj.exe Token: SeDebugPrivilege 5440 innuocedv.exe Token: SeDebugPrivilege 5608 inbuxzyre.exe Token: SeDebugPrivilege 1344 inhwoipfi.exe Token: SeDebugPrivilege 1944 inmeufqjy.exe Token: SeDebugPrivilege 1608 inuqbjvqf.exe Token: SeDebugPrivilege 3396 incsvmltt.exe Token: SeDebugPrivilege 5408 inyjbrycn.exe Token: SeDebugPrivilege 5108 inljyapnv.exe Token: SeDebugPrivilege 5964 ineybxzdp.exe Token: SeDebugPrivilege 3248 inaexuhtj.exe Token: SeDebugPrivilege 564 innqsrkjz.exe Token: SeDebugPrivilege 2936 inyorihpp.exe Token: SeDebugPrivilege 5040 ingiuiufd.exe Token: SeDebugPrivilege 1712 inzkcszdo.exe Token: SeDebugPrivilege 2928 invuwaxma.exe Token: SeDebugPrivilege 1904 insezthji.exe Token: SeDebugPrivilege 4592 infhthtec.exe Token: SeDebugPrivilege 4992 inmprqjiy.exe Token: SeDebugPrivilege 4188 inlhzufqa.exe Token: SeDebugPrivilege 6032 inatwyxqd.exe Token: SeDebugPrivilege 976 ingtgabri.exe Token: SeDebugPrivilege 2760 inpleqlxa.exe Token: SeDebugPrivilege 5392 inqtvunam.exe Token: SeDebugPrivilege 6092 inetlfmxc.exe Token: SeDebugPrivilege 4908 inxiaqxbm.exe Token: SeDebugPrivilege 4268 intsuvkkg.exe Token: SeDebugPrivilege 4344 intpaiupe.exe Token: SeDebugPrivilege 4476 inbrulkss.exe Token: SeDebugPrivilege 3080 inwhpwale.exe Token: SeDebugPrivilege 1796 insrzztuj.exe Token: SeDebugPrivilege 2812 incrjzdkv.exe Token: SeDebugPrivilege 2460 inpiofygs.exe Token: SeDebugPrivilege 5840 inkzrlbas.exe Token: SeDebugPrivilege 1548 injwnoaqy.exe Token: SeDebugPrivilege 4220 inpfzcyeq.exe Token: SeDebugPrivilege 4488 inxhvtpha.exe Token: SeDebugPrivilege 5760 inigtklnv.exe Token: SeDebugPrivilege 2780 inwmpgfnn.exe Token: SeDebugPrivilege 1376 infdqdofu.exe Token: SeDebugPrivilege 5056 inwixlnmf.exe Token: SeDebugPrivilege 4568 ingvzmksi.exe Token: SeDebugPrivilege 3260 inmkxopbr.exe Token: SeDebugPrivilege 2984 inmnccutj.exe Token: SeDebugPrivilege 4904 intcrvwiy.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe 4672 inqcxrfhg.exe 4320 inxjymong.exe 4572 inortslka.exe 4732 inugvjlkd.exe 4856 inogwahsa.exe 4616 incvyzsfr.exe 4604 injyqkarh.exe 3768 inpsutmlb.exe 2396 intfuikjc.exe 6120 inlsmacbt.exe 3124 inxtemyti.exe 6084 insohtodl.exe 708 indwztgsi.exe 5772 inldtepix.exe 3480 insvxwpco.exe 1272 inykznpoh.exe 2556 inoavpdfe.exe 3880 indskelwb.exe 1604 inixpjqgj.exe 5440 innuocedv.exe 5608 inbuxzyre.exe 1344 inhwoipfi.exe 1944 inmeufqjy.exe 1608 inuqbjvqf.exe 3396 incsvmltt.exe 5408 inyjbrycn.exe 5108 inljyapnv.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 4672 4624 2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 4672 wrote to memory of 4320 4672 inqcxrfhg.exe 90 PID 4320 wrote to memory of 4572 4320 inxjymong.exe 91 PID 4572 wrote to memory of 4732 4572 inortslka.exe 92 PID 4732 wrote to memory of 4856 4732 inugvjlkd.exe 93 PID 4856 wrote to memory of 4616 4856 inogwahsa.exe 94 PID 4616 wrote to memory of 4604 4616 incvyzsfr.exe 95 PID 4604 wrote to memory of 3768 4604 injyqkarh.exe 96 PID 3768 wrote to memory of 2396 3768 inpsutmlb.exe 97 PID 2396 wrote to memory of 6120 2396 intfuikjc.exe 98 PID 6120 wrote to memory of 3124 6120 inlsmacbt.exe 99 PID 3124 wrote to memory of 6084 3124 inxtemyti.exe 100 PID 6084 wrote to memory of 708 6084 insohtodl.exe 101 PID 708 wrote to memory of 5772 708 indwztgsi.exe 102 PID 5772 wrote to memory of 3480 5772 inldtepix.exe 103 PID 3480 wrote to memory of 1272 3480 insvxwpco.exe 104 PID 1272 wrote to memory of 2556 1272 inykznpoh.exe 105 PID 2556 wrote to memory of 3880 2556 inoavpdfe.exe 106 PID 3880 wrote to memory of 1604 3880 indskelwb.exe 107 PID 1604 wrote to memory of 5440 1604 inixpjqgj.exe 108 PID 5440 wrote to memory of 5608 5440 innuocedv.exe 109 PID 5608 wrote to memory of 1344 5608 inbuxzyre.exe 110 PID 1344 wrote to memory of 1944 1344 inhwoipfi.exe 111 PID 1944 wrote to memory of 1608 1944 inmeufqjy.exe 112 PID 1608 wrote to memory of 3396 1608 inuqbjvqf.exe 113 PID 3396 wrote to memory of 5408 3396 incsvmltt.exe 114 PID 5408 wrote to memory of 5108 5408 inyjbrycn.exe 115 PID 5108 wrote to memory of 5964 5108 inljyapnv.exe 116 PID 5964 wrote to memory of 3248 5964 ineybxzdp.exe 117 PID 3248 wrote to memory of 564 3248 inaexuhtj.exe 118 PID 564 wrote to memory of 2936 564 innqsrkjz.exe 119 PID 2936 wrote to memory of 5040 2936 inyorihpp.exe 120 PID 5040 wrote to memory of 1712 5040 ingiuiufd.exe 121 PID 1712 wrote to memory of 2928 1712 inzkcszdo.exe 122 PID 2928 wrote to memory of 1904 2928 invuwaxma.exe 123 PID 1904 wrote to memory of 4592 1904 insezthji.exe 124 PID 4592 wrote to memory of 4992 4592 infhthtec.exe 125 PID 4992 wrote to memory of 4188 4992 inmprqjiy.exe 126 PID 4188 wrote to memory of 6032 4188 inlhzufqa.exe 127 PID 6032 wrote to memory of 976 6032 inatwyxqd.exe 128 PID 976 wrote to memory of 2760 976 ingtgabri.exe 129 PID 2760 wrote to memory of 5392 2760 inpleqlxa.exe 130 PID 5392 wrote to memory of 6092 5392 inqtvunam.exe 131 PID 6092 wrote to memory of 4908 6092 inetlfmxc.exe 132 PID 4908 wrote to memory of 4268 4908 inxiaqxbm.exe 133 PID 4268 wrote to memory of 4344 4268 intsuvkkg.exe 134 PID 4344 wrote to memory of 4476 4344 intpaiupe.exe 135 PID 4476 wrote to memory of 3080 4476 inbrulkss.exe 136 PID 3080 wrote to memory of 1796 3080 inwhpwale.exe 137 PID 1796 wrote to memory of 2812 1796 insrzztuj.exe 138 PID 2812 wrote to memory of 2460 2812 incrjzdkv.exe 139 PID 2460 wrote to memory of 5840 2460 inpiofygs.exe 140 PID 5840 wrote to memory of 1548 5840 inkzrlbas.exe 141 PID 1548 wrote to memory of 4220 1548 injwnoaqy.exe 142 PID 4220 wrote to memory of 4488 4220 inpfzcyeq.exe 143 PID 4488 wrote to memory of 5760 4488 inxhvtpha.exe 144 PID 5760 wrote to memory of 2780 5760 inigtklnv.exe 145 PID 2780 wrote to memory of 1376 2780 inwmpgfnn.exe 146 PID 1376 wrote to memory of 5056 1376 infdqdofu.exe 147 PID 5056 wrote to memory of 4568 5056 inwixlnmf.exe 148 PID 4568 wrote to memory of 3260 4568 ingvzmksi.exe 149 PID 3260 wrote to memory of 2984 3260 inmkxopbr.exe 150 PID 2984 wrote to memory of 4904 2984 inmnccutj.exe 151 PID 4904 wrote to memory of 4996 4904 intcrvwiy.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_426c8050a015fb0586204899471c5c80_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe31⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe59⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe65⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe66⤵PID:1164
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe67⤵
- Drops file in System32 directory
PID:1992 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe68⤵PID:2160
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe69⤵
- System Location Discovery: System Language Discovery
PID:5960 -
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe70⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\system32\ineqbmfxl.exe71⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4788 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe72⤵PID:1600
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe73⤵
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Windows\SysWOW64\inrhnxdft.exeC:\Windows\system32\inrhnxdft.exe74⤵
- System Location Discovery: System Language Discovery
PID:952 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe75⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe76⤵PID:3020
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe77⤵PID:4936
-
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe78⤵PID:5432
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe79⤵
- Drops file in System32 directory
PID:5452 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe80⤵PID:1016
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe81⤵PID:5460
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe82⤵PID:3212
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe83⤵PID:4348
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe84⤵PID:5028
-
C:\Windows\SysWOW64\inwyzbftn.exeC:\Windows\system32\inwyzbftn.exe85⤵PID:1304
-
C:\Windows\SysWOW64\incvdypdo.exeC:\Windows\system32\incvdypdo.exe86⤵
- System Location Discovery: System Language Discovery
PID:4384 -
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe87⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe88⤵PID:1728
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe89⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3160 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe90⤵
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe91⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3452 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe92⤵PID:3312
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe93⤵
- System Location Discovery: System Language Discovery
PID:1644 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe94⤵PID:3752
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe95⤵PID:4120
-
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe96⤵PID:800
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe97⤵PID:4180
-
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe98⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5936 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe99⤵PID:4184
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe100⤵PID:5308
-
C:\Windows\SysWOW64\inhnmoqun.exeC:\Windows\system32\inhnmoqun.exe101⤵PID:5104
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe102⤵PID:4912
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe103⤵PID:5912
-
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe104⤵PID:5544
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe105⤵PID:1516
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe106⤵PID:5124
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe107⤵PID:4104
-
C:\Windows\SysWOW64\inzhuwqpq.exeC:\Windows\system32\inzhuwqpq.exe108⤵
- Drops file in System32 directory
PID:5956 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe109⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1556 -
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe110⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4728 -
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe111⤵PID:4832
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe112⤵PID:4724
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe113⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5680 -
C:\Windows\SysWOW64\indvjzcoq.exeC:\Windows\system32\indvjzcoq.exe114⤵
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe115⤵
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe116⤵PID:3952
-
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe117⤵PID:6132
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe118⤵
- Drops file in System32 directory
PID:2980 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe119⤵PID:52
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe120⤵PID:2900
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe121⤵PID:4648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-