Analysis
- max time kernel
97s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 10:36
Behavioral task
behavioral1
Sample
2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260930-mnfenszfqa
- SHA256 aaff974318f06afcbb430e33c5a737d9a07b9ac35fe604f69f1c180aa78fc008
- MD5 6e517e3d5c0346d445904d9a150a28ee
- SHA1 731c47de6fc2c2dc9cd44fa3a53c0dc7d1281dfa
- SHA512 f3aa70533665b0f2724b6ebc346894e76d3b80e625a6e6d384f8298379a73349954c4578db7e1a54b1744f305544c855f5c71b156dc62c363851db1a371d5e12
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTb:RPjOa1NxyYtH1b
- TLSH T1E615AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 52 IoCs
resource yara_rule behavioral1/memory/5228-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5228-7-0x0000000002130000-0x00000000021A3000-memory.dmp family_gh0strat behavioral1/files/0x000700000002478b-13.dat family_gh0strat behavioral1/memory/5472-39-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5228-37-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024791-45.dat family_gh0strat behavioral1/files/0x0007000000024795-64.dat family_gh0strat behavioral1/files/0x00070000000247a1-138.dat family_gh0strat behavioral1/files/0x00070000000247a5-161.dat family_gh0strat behavioral1/memory/2328-633-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4164-613-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2796-596-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4508-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4876-555-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2812-551-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2312-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/376-515-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4060-495-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4832-476-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4796-457-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3980-438-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/204-402-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5100-399-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5704-382-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247c9-368.dat family_gh0strat behavioral1/memory/5960-361-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247c5-345.dat family_gh0strat behavioral1/memory/5964-337-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247c1-322.dat family_gh0strat behavioral1/memory/3352-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247bd-299.dat family_gh0strat behavioral1/memory/3004-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247b9-276.dat family_gh0strat behavioral1/memory/6100-256-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247b5-253.dat family_gh0strat behavioral1/memory/5620-246-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247b1-230.dat family_gh0strat behavioral1/memory/2520-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247ad-207.dat family_gh0strat behavioral1/memory/2708-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000247a9-184.dat family_gh0strat behavioral1/memory/2580-177-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4884-153-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4980-130-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002479d-115.dat family_gh0strat behavioral1/memory/4064-107-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024799-92.dat family_gh0strat behavioral1/memory/5116-77-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5116-48-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002478c-22.dat family_gh0strat behavioral1/files/0x0007000000024e0c-6892.dat family_gh0strat behavioral1/files/0x00070000000250df-9660.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F482917-7760-4d47-8A89-3D9C3D3ABED7}\stubpath = "C:\\Windows\\system32\\inuaizlgb.exe" ingdjrovg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DDF5EA7-D41D-4136-874D-9B30F002B79C}\stubpath = "C:\\Windows\\system32\\ineotbwlw.exe" inxdmghfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7BC5807B-02BE-42ca-B874-EED94B1E2DAC}\stubpath = "C:\\Windows\\system32\\ingxztboz.exe" inazojdaz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FEB8A119-144E-466a-AFE8-5B5773CB8ED0} inivxkbyw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{906168B6-2E44-4309-8EC7-F190E1C59EBF}\stubpath = "C:\\Windows\\system32\\infacmfam.exe" incehxwfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F2FA171-A5A7-45c2-BF86-0737B21C045D} inaulrodd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53278193-238A-490e-8763-F32DE8575E3F} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B312F980-05CD-4df6-A2B3-020D8BD00AD4} inewrcnnk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60EB8596-767F-4fdd-8D18-352035C52FF8}\stubpath = "C:\\Windows\\system32\\inmkxopbr.exe" injlxlxig.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A6F9FE9-807F-421b-BD3E-A37A94B70DE2} inipelkjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{840627CB-2CA5-464d-AF52-B05EB82563BD}\stubpath = "C:\\Windows\\system32\\incsdfhkz.exe" inltanpsp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50E5B45A-38CF-4601-8BC2-AC8FC8801409} intvpbgyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{580677F5-F5E1-4508-923B-13EF626BC2B2} inqbcmcsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FD168B6-F2A5-4ba2-AD6F-939D5888F911} inhtbrjcd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2DC89F3-58F0-4afb-BB29-2597BAC02299} inzavthnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91E202D3-5802-4fd4-A500-393ADDA29333}\stubpath = "C:\\Windows\\system32\\ineuxonvv.exe" incsvmltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3D362A9-3A34-4ce0-B424-CC7CDEE1B613} injwnoaqy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2306ED5-388A-4894-8AE1-8DDB6A259A81} inxnewqnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42B63CEE-57D9-462e-A05B-DAE3657FDA02} inhrtbdgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD82B124-4690-4500-95CF-E3111B9F1607} inynjbljk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A2B55EC-E657-414f-8500-0C80C70BE019}\stubpath = "C:\\Windows\\system32\\intujfhfg.exe" inltdlhks.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D806D0EF-1BAD-423c-A8E1-4E10C63E7629} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2BEA92E-0583-4069-AB32-CEDF298ECDFC} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00655319-377E-418c-B526-1DF852E6EFFC} inoavpdfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86556965-8F36-4fac-AF8A-ED71DF5DCB4C} inhgncqwc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51FAE4E1-8784-42f8-B0B2-AF33B528AA8A} inmwcesvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D88EF326-46A9-4d4f-8A7E-6AB836D04E4C} inhnmoqun.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7576CE44-C2F9-41af-B58E-975B3937BF18} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8669C8F8-76B5-4459-A926-49CE775AD171}\stubpath = "C:\\Windows\\system32\\inxjbsmyi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93053F53-62CB-4402-9088-41A48FB25747}\stubpath = "C:\\Windows\\system32\\inrumczhz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8471706E-3794-4662-83CC-A48EDD89E167} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21B8EAAD-D38D-4d76-AE23-7A923955AA9E} inhjvjvge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0DBD63E7-530C-4a25-9341-45576E039713}\stubpath = "C:\\Windows\\system32\\indbxwxmz.exe" inuvkxzmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE572043-A424-4117-9B5A-693FBC9F2EB0} inzpesupo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3A00285-2F1E-456d-BFF8-82C2726163DB} inwezaozq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0363D4D9-DCC5-47e2-8535-B18392DF5D41} invpovkyk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84BC630A-E66B-4097-86B0-9C51C71302D3}\stubpath = "C:\\Windows\\system32\\inqgyjlgf.exe" inhpdyhbh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C17E62B-6A6D-4e86-8C17-79C3D8E2C53E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FE55CE4-8ADB-49ff-B589-FFCB1F85FE51} infvypoww.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9D1DF3A-FE28-418d-B524-5C6DB74864D5} inxuxrboe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{57AD33AB-9B7B-4fe6-8AB0-3367588E4C60} inqtkjrrl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{716693FD-F48C-4ab6-923C-F96BC5BCD5E1} inilftocs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FB9E3C7-B531-4498-89F8-C2C2EF300961} innljnnyl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C75B17DA-023A-4233-B6A7-AE612E6069D4}\stubpath = "C:\\Windows\\system32\\injojwqin.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB525761-FDB4-47ef-A874-BD372A04D1FE}\stubpath = "C:\\Windows\\system32\\inxndtjlz.exe" invnbgkek.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00F5E014-8818-430c-97C0-7E7854AFF960} inckxztas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3D23FB2-3668-4f7e-B33C-F8296E2388EB}\stubpath = "C:\\Windows\\system32\\inkesnbrx.exe" indryibnm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9BDB4DA-021B-40d9-8AD3-304112548CC0} inmzdngio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EA6BC3F-7A37-4d49-B839-4037148E4A9A}\stubpath = "C:\\Windows\\system32\\insrmwnuj.exe" inmroafou.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E228F212-E7E1-418c-953F-55FAA1A4D4F1} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{902B5AAF-4985-46b4-8735-E620CECF227D} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E8C53B3-2F2F-4fec-8D05-305616598C7A} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8965DD3-2521-4672-9506-0746AEA692D8}\stubpath = "C:\\Windows\\system32\\inzewkdpr.exe" infbnevol.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45F39409-8800-4d69-A650-9B902E63EBA7} inytomigo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3EA6BC3F-7A37-4d49-B839-4037148E4A9A} inmroafou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BAE5D5CD-51FC-45ee-9B0D-A128B92F9A7A}\stubpath = "C:\\Windows\\system32\\inirwtfkt.exe" inhjrgabu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5ED7919C-7DAC-45f4-8295-89113E210F82} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5229ED-8BDE-4f72-BE0E-CDC60025A4D0} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11826725-0A7C-4eb9-B3CB-CE538F4FFE23}\stubpath = "C:\\Windows\\system32\\incsnrmiw.exe" iniqzgcyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BE67103-A43C-4fb9-B445-227B704720E6} inbbkvfva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33671BA9-C5D7-4972-8AEA-6D51AD92DF80}\stubpath = "C:\\Windows\\system32\\inqjwwyse.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1379E39-A3B2-4464-8C0B-8B28797D83EB}\stubpath = "C:\\Windows\\system32\\inbqiycju.exe" innfvgrkz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3852F97A-56A6-4814-A266-DCED4A8497AF}\stubpath = "C:\\Windows\\system32\\inrxixhwa.exe" inahuhbcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D73C6991-77DF-4719-B946-09D01A1F5E86}\stubpath = "C:\\Windows\\system32\\inbbmmbxa.exe" inqfeufhj.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0009000000022acb-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5472 inortslka.exe 5116 inugvjlkd.exe 4064 inbfyviuk.exe 4980 innqsrkjz.exe 4884 inqtvunam.exe 2580 inwsdlxsh.exe 2708 inwixlnmf.exe 2520 inykznpoh.exe 5620 intsuvkkg.exe 6100 intpaiupe.exe 3004 indskelwb.exe 3352 ingvnhoze.exe 5964 inixpjqgj.exe 5960 inlsmacbt.exe 5704 inpsutmlb.exe 204 inruwvobn.exe 5100 inxtemyti.exe 3980 inwhpwale.exe 4796 inyjbrycn.exe 4832 inmeufqjy.exe 4060 inogwahsa.exe 376 incrjzdkv.exe 2312 incsvmltt.exe 4876 ineuxonvv.exe 2812 inzloqpih.exe 2796 inrfpuysy.exe 4508 inuqbjvqf.exe 4164 insvxwpco.exe 5724 inxiaqxbm.exe 3380 inldtepix.exe 1628 innfvgrkz.exe 5456 inbqiycju.exe 6084 intfuikjc.exe 3504 invhwkmle.exe 2428 ingwzqpxx.exe 5888 inmprqjiy.exe 2564 insohtodl.exe 3424 invrckwrg.exe 4752 inbqostfv.exe 4392 inhwoipfi.exe 1208 inkzrlbas.exe 3244 inutvwllh.exe 612 innlypqcs.exe 5976 indlyubtu.exe 3880 ingtgabri.exe 3528 inpleqlxa.exe 5208 inoavpdfe.exe 2576 inrdysgih.exe 3676 inbrulkss.exe 3492 inaexuhtj.exe 4308 ingvzmksi.exe 1440 invuwaxma.exe 408 inomzqrdt.exe 5664 inhfsfaqh.exe 1768 inrshhzyd.exe 5676 insrzztuj.exe 2452 inmibthrw.exe 6120 inbjwysrs.exe 2560 infumgnyd.exe 4888 inxjymong.exe 3632 inigtklnv.exe 3956 inljyapnv.exe 2760 inazpsjiq.exe 1988 indwztgsi.exe - Loads dropped DLL 64 IoCs
pid Process 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5472 inortslka.exe 5472 inortslka.exe 5116 inugvjlkd.exe 5116 inugvjlkd.exe 4064 inbfyviuk.exe 4064 inbfyviuk.exe 4980 innqsrkjz.exe 4980 innqsrkjz.exe 4884 inqtvunam.exe 4884 inqtvunam.exe 2580 inwsdlxsh.exe 2580 inwsdlxsh.exe 2708 inwixlnmf.exe 2708 inwixlnmf.exe 2520 inykznpoh.exe 2520 inykznpoh.exe 5620 intsuvkkg.exe 5620 intsuvkkg.exe 6100 intpaiupe.exe 6100 intpaiupe.exe 3004 indskelwb.exe 3004 indskelwb.exe 3352 ingvnhoze.exe 3352 ingvnhoze.exe 5964 inixpjqgj.exe 5964 inixpjqgj.exe 5960 inlsmacbt.exe 5960 inlsmacbt.exe 5704 inpsutmlb.exe 5704 inpsutmlb.exe 204 inruwvobn.exe 204 inruwvobn.exe 5100 inxtemyti.exe 5100 inxtemyti.exe 3980 inwhpwale.exe 3980 inwhpwale.exe 4796 inyjbrycn.exe 4796 inyjbrycn.exe 4832 inmeufqjy.exe 4832 inmeufqjy.exe 4060 inogwahsa.exe 4060 inogwahsa.exe 376 incrjzdkv.exe 376 incrjzdkv.exe 2312 incsvmltt.exe 2312 incsvmltt.exe 4876 ineuxonvv.exe 4876 ineuxonvv.exe 2812 inzloqpih.exe 2812 inzloqpih.exe 2796 inrfpuysy.exe 2796 inrfpuysy.exe 4508 inuqbjvqf.exe 4508 inuqbjvqf.exe 2328 inzvgovkd.exe 2328 inzvgovkd.exe 5724 inxiaqxbm.exe 5724 inxiaqxbm.exe 3380 inldtepix.exe 3380 inldtepix.exe 1628 innfvgrkz.exe 1628 innfvgrkz.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inasgqvzt.exe_lang.ini inilcbjwj.exe File created C:\Windows\SysWOW64\indtosnaj.exe intmsjkwc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpdraxym.exe File opened for modification C:\Windows\SysWOW64\ingmcckte.exe_lang.ini invjtohcx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzfovdaj.exe File created C:\Windows\SysWOW64\inmfbghny.exe Process not Found File opened for modification C:\Windows\SysWOW64\inaaajueu.exe_lang.ini inykmqjhq.exe File created C:\Windows\SysWOW64\indtkzjxv.exe indpalewk.exe File opened for modification C:\Windows\SysWOW64\inbbkvfva.exe_lang.ini intglbjrf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indtfhlye.exe File opened for modification C:\Windows\SysWOW64\invlhtipl.exe_lang.ini invudbffq.exe File opened for modification C:\Windows\SysWOW64\inhlqhxjd.exe_lang.ini inuprejup.exe File opened for modification C:\Windows\SysWOW64\indwztgsi.exe_lang.ini inazpsjiq.exe File opened for modification C:\Windows\SysWOW64\injyixbhg.exe_lang.ini ingvetxyk.exe File opened for modification C:\Windows\SysWOW64\inlfbhwkc.exe_lang.ini inmhjtbmh.exe File created C:\Windows\SysWOW64\inqvsejsy.exe indzyzoqh.exe File created C:\Windows\SysWOW64\inuprejup.exe ingexjguv.exe File created C:\Windows\SysWOW64\indynypms.exe inhzrlmor.exe File created C:\Windows\SysWOW64\inliwxioe.exe Process not Found File opened for modification C:\Windows\SysWOW64\injegoang.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inzhuwqpq.exe_lang.ini indtosnaj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indtkzjxv.exe File created C:\Windows\SysWOW64\infbnevol.exe inlfbhwkc.exe File created C:\Windows\SysWOW64\ingphynie.exe inwtzamwg.exe File created C:\Windows\SysWOW64\inaggaocx.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat iniizepdz.exe File opened for modification C:\Windows\SysWOW64\intxcqoxe.exe_lang.ini inadbobmd.exe File opened for modification C:\Windows\SysWOW64\injmdckxk.exe_lang.ini inlvjosms.exe File created C:\Windows\SysWOW64\inmhqihce.exe inqyuxptk.exe File created C:\Windows\SysWOW64\inpxexdto.exe incpdebyb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhpkypiu.exe File opened for modification C:\Windows\SysWOW64\inhoksmcs.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inesltdsz.exe Process not Found File opened for modification C:\Windows\SysWOW64\inesqmezb.exe_lang.ini inhiypoew.exe File opened for modification C:\Windows\SysWOW64\inmwepkwe.exe_lang.ini inpprolqn.exe File opened for modification C:\Windows\SysWOW64\inckagkpg.exe_lang.ini inyoqadam.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inskjegqj.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\insfizgbe.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inkivmnpx.exe File created C:\Windows\SysWOW64\incmhaqvq.exe incpcgxnb.exe File opened for modification C:\Windows\SysWOW64\inlrcakqo.exe_lang.ini inekkdesc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbzddobb.exe File opened for modification C:\Windows\SysWOW64\intbagmav.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwskdhbh.exe File created C:\Windows\SysWOW64\inbrumuek.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inrxixhwa.exe File created C:\Windows\SysWOW64\inhzrfkoi.exe inqxbfmkb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmoufcdn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inahuhbcs.exe_lang.ini inaaajueu.exe File created C:\Windows\SysWOW64\invbdruwx.exe inyegtexf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indkgfezw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inznuyjzl.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inykmqjhq.exe File created C:\Windows\SysWOW64\inqzfhsqg.exe infacmfam.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyrmomgz.exe File opened for modification C:\Windows\SysWOW64\inffidabk.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inyjlwest.exe Process not Found File opened for modification C:\Windows\SysWOW64\inwlhjhih.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\invuwaxma.exe_lang.ini ingvzmksi.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpprolqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inskscibo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inufueytz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniqgcwmo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inunawidf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incirxuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyvyscpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmvblntu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxfpwvzq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insxoqkwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrfqjpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inutvwllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuiybnpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innbxlquo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incldxuje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwaymvpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwpxhpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innbpvwku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invatpnbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrlmbbts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infxiosfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxajcwrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innqsrkjz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatwyxqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkuaczqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrkqhiua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inizrmbvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxncqsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuytzxmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invtcqgup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthjosvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inffruvhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inimbeutc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indeulkya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inesiwrli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injavkrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intuwvzao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbkyszdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvfndjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intrqbfmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxlrthqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invshckbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innmfqrmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intetdxsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzjwmbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzwrvbus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyherndc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5472 inortslka.exe 5472 inortslka.exe 5116 inugvjlkd.exe 5116 inugvjlkd.exe 4064 inbfyviuk.exe 4064 inbfyviuk.exe 4980 innqsrkjz.exe 4980 innqsrkjz.exe 4884 inqtvunam.exe 4884 inqtvunam.exe 2580 inwsdlxsh.exe 2580 inwsdlxsh.exe 2708 inwixlnmf.exe 2708 inwixlnmf.exe 2520 inykznpoh.exe 2520 inykznpoh.exe 5620 intsuvkkg.exe 5620 intsuvkkg.exe 6100 intpaiupe.exe 6100 intpaiupe.exe 3004 indskelwb.exe 3004 indskelwb.exe 3352 ingvnhoze.exe 3352 ingvnhoze.exe 5964 inixpjqgj.exe 5964 inixpjqgj.exe 5960 inlsmacbt.exe 5960 inlsmacbt.exe 5704 inpsutmlb.exe 5704 inpsutmlb.exe 204 inruwvobn.exe 204 inruwvobn.exe 5100 inxtemyti.exe 5100 inxtemyti.exe 3980 inwhpwale.exe 3980 inwhpwale.exe 4796 inyjbrycn.exe 4796 inyjbrycn.exe 4832 inmeufqjy.exe 4832 inmeufqjy.exe 4060 inogwahsa.exe 4060 inogwahsa.exe 376 incrjzdkv.exe 376 incrjzdkv.exe 2312 incsvmltt.exe 2312 incsvmltt.exe 4876 ineuxonvv.exe 4876 ineuxonvv.exe 2812 inzloqpih.exe 2812 inzloqpih.exe 2796 inrfpuysy.exe 2796 inrfpuysy.exe 4508 inuqbjvqf.exe 4508 inuqbjvqf.exe 2328 inzvgovkd.exe 2328 inzvgovkd.exe 5724 inxiaqxbm.exe 5724 inxiaqxbm.exe 3380 inldtepix.exe 3380 inldtepix.exe 1628 innfvgrkz.exe 1628 innfvgrkz.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 5472 inortslka.exe Token: SeDebugPrivilege 5116 inugvjlkd.exe Token: SeDebugPrivilege 4064 inbfyviuk.exe Token: SeDebugPrivilege 4980 innqsrkjz.exe Token: SeDebugPrivilege 4884 inqtvunam.exe Token: SeDebugPrivilege 2580 inwsdlxsh.exe Token: SeDebugPrivilege 2708 inwixlnmf.exe Token: SeDebugPrivilege 2520 inykznpoh.exe Token: SeDebugPrivilege 5620 intsuvkkg.exe Token: SeDebugPrivilege 6100 intpaiupe.exe Token: SeDebugPrivilege 3004 indskelwb.exe Token: SeDebugPrivilege 3352 ingvnhoze.exe Token: SeDebugPrivilege 5964 inixpjqgj.exe Token: SeDebugPrivilege 5960 inlsmacbt.exe Token: SeDebugPrivilege 5704 inpsutmlb.exe Token: SeDebugPrivilege 204 inruwvobn.exe Token: SeDebugPrivilege 5100 inxtemyti.exe Token: SeDebugPrivilege 3980 inwhpwale.exe Token: SeDebugPrivilege 4796 inyjbrycn.exe Token: SeDebugPrivilege 4832 inmeufqjy.exe Token: SeDebugPrivilege 4060 inogwahsa.exe Token: SeDebugPrivilege 376 incrjzdkv.exe Token: SeDebugPrivilege 2312 incsvmltt.exe Token: SeDebugPrivilege 4876 ineuxonvv.exe Token: SeDebugPrivilege 2812 inzloqpih.exe Token: SeDebugPrivilege 2796 inrfpuysy.exe Token: SeDebugPrivilege 4508 inuqbjvqf.exe Token: SeDebugPrivilege 2328 inzvgovkd.exe Token: SeDebugPrivilege 5724 inxiaqxbm.exe Token: SeDebugPrivilege 3380 inldtepix.exe Token: SeDebugPrivilege 1628 innfvgrkz.exe Token: SeDebugPrivilege 5456 inbqiycju.exe Token: SeDebugPrivilege 6084 intfuikjc.exe Token: SeDebugPrivilege 3504 invhwkmle.exe Token: SeDebugPrivilege 2428 ingwzqpxx.exe Token: SeDebugPrivilege 5888 inmprqjiy.exe Token: SeDebugPrivilege 2564 insohtodl.exe Token: SeDebugPrivilege 3424 invrckwrg.exe Token: SeDebugPrivilege 4752 inbqostfv.exe Token: SeDebugPrivilege 4392 inhwoipfi.exe Token: SeDebugPrivilege 1208 inkzrlbas.exe Token: SeDebugPrivilege 3244 inutvwllh.exe Token: SeDebugPrivilege 612 innlypqcs.exe Token: SeDebugPrivilege 5976 indlyubtu.exe Token: SeDebugPrivilege 3880 ingtgabri.exe Token: SeDebugPrivilege 3528 inpleqlxa.exe Token: SeDebugPrivilege 5208 inoavpdfe.exe Token: SeDebugPrivilege 2576 inrdysgih.exe Token: SeDebugPrivilege 3676 inbrulkss.exe Token: SeDebugPrivilege 3492 inaexuhtj.exe Token: SeDebugPrivilege 4308 ingvzmksi.exe Token: SeDebugPrivilege 1440 invuwaxma.exe Token: SeDebugPrivilege 408 inomzqrdt.exe Token: SeDebugPrivilege 5664 inhfsfaqh.exe Token: SeDebugPrivilege 1768 inrshhzyd.exe Token: SeDebugPrivilege 5676 insrzztuj.exe Token: SeDebugPrivilege 2452 inmibthrw.exe Token: SeDebugPrivilege 6120 inbjwysrs.exe Token: SeDebugPrivilege 2560 infumgnyd.exe Token: SeDebugPrivilege 4888 inxjymong.exe Token: SeDebugPrivilege 3632 inigtklnv.exe Token: SeDebugPrivilege 3956 inljyapnv.exe Token: SeDebugPrivilege 2760 inazpsjiq.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5472 inortslka.exe 5116 inugvjlkd.exe 4064 inbfyviuk.exe 4980 innqsrkjz.exe 4884 inqtvunam.exe 2580 inwsdlxsh.exe 2708 inwixlnmf.exe 2520 inykznpoh.exe 5620 intsuvkkg.exe 6100 intpaiupe.exe 3004 indskelwb.exe 3352 ingvnhoze.exe 5964 inixpjqgj.exe 5960 inlsmacbt.exe 5704 inpsutmlb.exe 204 inruwvobn.exe 5100 inxtemyti.exe 3980 inwhpwale.exe 4796 inyjbrycn.exe 4832 inmeufqjy.exe 4060 inogwahsa.exe 376 incrjzdkv.exe 2312 incsvmltt.exe 4876 ineuxonvv.exe 2812 inzloqpih.exe 2796 inrfpuysy.exe 4508 inuqbjvqf.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5228 wrote to memory of 5472 5228 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 85 PID 5472 wrote to memory of 5116 5472 inortslka.exe 86 PID 5116 wrote to memory of 4064 5116 inugvjlkd.exe 87 PID 4064 wrote to memory of 4980 4064 inbfyviuk.exe 88 PID 4980 wrote to memory of 4884 4980 innqsrkjz.exe 89 PID 4884 wrote to memory of 2580 4884 inqtvunam.exe 90 PID 2580 wrote to memory of 2708 2580 inwsdlxsh.exe 91 PID 2708 wrote to memory of 2520 2708 inwixlnmf.exe 92 PID 2520 wrote to memory of 5620 2520 inykznpoh.exe 93 PID 5620 wrote to memory of 6100 5620 intsuvkkg.exe 94 PID 6100 wrote to memory of 3004 6100 intpaiupe.exe 95 PID 3004 wrote to memory of 3352 3004 indskelwb.exe 96 PID 3352 wrote to memory of 5964 3352 ingvnhoze.exe 97 PID 5964 wrote to memory of 5960 5964 inixpjqgj.exe 98 PID 5960 wrote to memory of 5704 5960 inlsmacbt.exe 99 PID 5704 wrote to memory of 204 5704 inpsutmlb.exe 100 PID 204 wrote to memory of 5100 204 inruwvobn.exe 101 PID 5100 wrote to memory of 3980 5100 inxtemyti.exe 102 PID 3980 wrote to memory of 4796 3980 inwhpwale.exe 103 PID 4796 wrote to memory of 4832 4796 inyjbrycn.exe 104 PID 4832 wrote to memory of 4060 4832 inmeufqjy.exe 105 PID 4060 wrote to memory of 376 4060 inogwahsa.exe 106 PID 376 wrote to memory of 2312 376 incrjzdkv.exe 107 PID 2312 wrote to memory of 4876 2312 incsvmltt.exe 108 PID 4876 wrote to memory of 2812 4876 ineuxonvv.exe 109 PID 2812 wrote to memory of 2796 2812 inzloqpih.exe 110 PID 2796 wrote to memory of 4508 2796 inrfpuysy.exe 111 PID 4508 wrote to memory of 4164 4508 inuqbjvqf.exe 112 PID 2328 wrote to memory of 5724 2328 inzvgovkd.exe 114 PID 5724 wrote to memory of 3380 5724 inxiaqxbm.exe 115 PID 3380 wrote to memory of 1628 3380 inldtepix.exe 116 PID 1628 wrote to memory of 5456 1628 innfvgrkz.exe 117 PID 5456 wrote to memory of 6084 5456 inbqiycju.exe 118 PID 6084 wrote to memory of 3504 6084 intfuikjc.exe 119 PID 3504 wrote to memory of 2428 3504 invhwkmle.exe 120 PID 2428 wrote to memory of 5888 2428 ingwzqpxx.exe 121 PID 5888 wrote to memory of 2564 5888 inmprqjiy.exe 122 PID 2564 wrote to memory of 3424 2564 insohtodl.exe 123 PID 3424 wrote to memory of 4752 3424 invrckwrg.exe 124 PID 4752 wrote to memory of 4392 4752 inbqostfv.exe 125 PID 4392 wrote to memory of 1208 4392 inhwoipfi.exe 126 PID 1208 wrote to memory of 3244 1208 inkzrlbas.exe 127 PID 3244 wrote to memory of 612 3244 inutvwllh.exe 128 PID 612 wrote to memory of 5976 612 innlypqcs.exe 129 PID 5976 wrote to memory of 3880 5976 indlyubtu.exe 130 PID 3880 wrote to memory of 3528 3880 ingtgabri.exe 131 PID 3528 wrote to memory of 5208 3528 inpleqlxa.exe 132 PID 5208 wrote to memory of 2576 5208 inoavpdfe.exe 133 PID 2576 wrote to memory of 3676 2576 inrdysgih.exe 134 PID 3676 wrote to memory of 3492 3676 inbrulkss.exe 135 PID 3492 wrote to memory of 4308 3492 inaexuhtj.exe 136 PID 4308 wrote to memory of 1440 4308 ingvzmksi.exe 137 PID 1440 wrote to memory of 408 1440 invuwaxma.exe 138 PID 408 wrote to memory of 5664 408 inomzqrdt.exe 139 PID 5664 wrote to memory of 1768 5664 inhfsfaqh.exe 140 PID 1768 wrote to memory of 5676 1768 inrshhzyd.exe 141 PID 5676 wrote to memory of 2452 5676 insrzztuj.exe 142 PID 2452 wrote to memory of 6120 2452 inmibthrw.exe 143 PID 6120 wrote to memory of 2560 6120 inbjwysrs.exe 144 PID 2560 wrote to memory of 4888 2560 infumgnyd.exe 145 PID 4888 wrote to memory of 3632 4888 inxjymong.exe 146 PID 3632 wrote to memory of 3956 3632 inigtklnv.exe 147 PID 3956 wrote to memory of 2760 3956 inljyapnv.exe 148 PID 2760 wrote to memory of 1988 2760 inazpsjiq.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe24⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe30⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe49⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe66⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe67⤵PID:2624
-
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe68⤵PID:3832
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe69⤵PID:3892
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe70⤵PID:2600
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe71⤵PID:4828
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe72⤵PID:6124
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe73⤵PID:2568
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe74⤵PID:2500
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe75⤵PID:5648
-
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe76⤵PID:4640
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe77⤵PID:5312
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe78⤵
- Drops file in System32 directory
PID:5840 -
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe79⤵PID:3944
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe80⤵PID:4532
-
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe81⤵PID:864
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe82⤵PID:5324
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe83⤵
- Drops file in System32 directory
PID:5444 -
C:\Windows\SysWOW64\injyixbhg.exeC:\Windows\system32\injyixbhg.exe84⤵PID:3836
-
C:\Windows\SysWOW64\inarenvge.exeC:\Windows\system32\inarenvge.exe85⤵PID:5056
-
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe86⤵PID:2748
-
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe87⤵PID:4924
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe88⤵PID:6104
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe89⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2724 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe90⤵PID:6132
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe91⤵PID:5628
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe92⤵PID:2636
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe93⤵PID:5452
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe94⤵PID:4228
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe95⤵PID:1780
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe96⤵PID:2728
-
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe97⤵PID:1724
-
C:\Windows\SysWOW64\inuhqyjhd.exeC:\Windows\system32\inuhqyjhd.exe98⤵PID:2092
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe99⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5816 -
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe100⤵PID:1968
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe101⤵PID:1560
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe102⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe103⤵PID:3952
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe104⤵PID:1020
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe105⤵PID:2672
-
C:\Windows\SysWOW64\inakrpgjz.exeC:\Windows\system32\inakrpgjz.exe106⤵PID:3692
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe107⤵PID:4552
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe108⤵PID:5260
-
C:\Windows\SysWOW64\inwikohfo.exeC:\Windows\system32\inwikohfo.exe109⤵PID:916
-
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe110⤵PID:6016
-
C:\Windows\SysWOW64\indrzpldy.exeC:\Windows\system32\indrzpldy.exe111⤵PID:5468
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe112⤵PID:2844
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe113⤵PID:5388
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe114⤵PID:5576
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe115⤵PID:4704
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe116⤵PID:2880
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe117⤵PID:2984
-
C:\Windows\SysWOW64\innusjmop.exeC:\Windows\system32\innusjmop.exe118⤵PID:4092
-
C:\Windows\SysWOW64\iniizepdz.exeC:\Windows\system32\iniizepdz.exe119⤵
- Drops file in System32 directory
PID:692 -
C:\Windows\SysWOW64\inlmosntr.exeC:\Windows\system32\inlmosntr.exe120⤵PID:4844
-
C:\Windows\SysWOW64\inuiybnpg.exeC:\Windows\system32\inuiybnpg.exe121⤵
- System Location Discovery: System Language Discovery
PID:5864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-