Analysis
- max time kernel
79s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:36
Behavioral task
behavioral1
Sample
2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260930-mnfenszfqa
- SHA256 aaff974318f06afcbb430e33c5a737d9a07b9ac35fe604f69f1c180aa78fc008
- MD5 6e517e3d5c0346d445904d9a150a28ee
- SHA1 731c47de6fc2c2dc9cd44fa3a53c0dc7d1281dfa
- SHA512 f3aa70533665b0f2724b6ebc346894e76d3b80e625a6e6d384f8298379a73349954c4578db7e1a54b1744f305544c855f5c71b156dc62c363851db1a371d5e12
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTb:RPjOa1NxyYtH1b
- TLSH T1E615AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/4192-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c51c-19.dat family_gh0strat behavioral2/memory/4192-21-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c522-39.dat family_gh0strat behavioral2/memory/3280-64-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c527-61.dat family_gh0strat behavioral2/memory/5752-66-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c52b-85.dat family_gh0strat behavioral2/memory/1136-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c52e-108.dat family_gh0strat behavioral2/memory/4480-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c532-129.dat family_gh0strat behavioral2/memory/280-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c536-152.dat family_gh0strat behavioral2/memory/5108-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c53a-173.dat family_gh0strat behavioral2/memory/752-178-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c53e-195.dat family_gh0strat behavioral2/files/0x000d00000001c542-218.dat family_gh0strat behavioral2/files/0x000d00000001c555-240.dat family_gh0strat behavioral2/memory/4744-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c55d-287.dat family_gh0strat behavioral2/files/0x000d00000001c569-350.dat family_gh0strat behavioral2/memory/2940-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4776-515-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1388-551-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3164-568-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2888-533-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5256-479-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1912-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1616-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/692-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2092-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4856-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3680-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2332-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5824-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c565-328.dat family_gh0strat behavioral2/memory/4352-308-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c561-306.dat family_gh0strat behavioral2/memory/1956-286-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c559-262.dat family_gh0strat behavioral2/memory/4180-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1484-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3940-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/256-586-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c520-30.dat family_gh0strat behavioral2/memory/5744-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0130F63B-3878-49c0-9238-0CCCA0B59C36} inycykdza.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA52E48C-83D2-4f7f-988D-805F2AC7F81D} inwhpwale.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{520AC92E-14E4-4ae0-BDE7-9C1CFB2DBEB0}\stubpath = "C:\\Windows\\system32\\inaexuhtj.exe" inwmpgfnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CC4149F-9792-4667-BCE1-9A08224DA769} invbdruwx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E053D48B-73DC-405a-B3EE-84FD29C071AF} injrhdzvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE638AAE-2845-430f-AA86-16CF8DADBF91}\stubpath = "C:\\Windows\\system32\\inzvgovkd.exe" inlhzufqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1E591BA-15C6-4341-959A-1CC0DC6C5105} indpalewk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D4E284D-2D35-4237-8297-22035B82DE9E} inzvgovkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D5F0AFE-DC21-45a1-BADC-6E11C3CD4887}\stubpath = "C:\\Windows\\system32\\inibqostf.exe" indvjzcoq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CEEC0F8-DAEC-434d-8613-FDCE568209C6} inkdbjsnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2DA162E-1791-4957-BFF6-689B3770DB72} intxcqoxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4A6FDC4-3E88-465b-8DA4-46C770358669}\stubpath = "C:\\Windows\\system32\\inarenvge.exe" invmdukgq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89030274-F2B0-486a-A76B-B486931EE0F6}\stubpath = "C:\\Windows\\system32\\inpriaela.exe" inlbjrbai.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A719DE2E-6AE4-412b-AE19-B6A5D416FF06} ingvetxyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E06444AE-7B51-4d5a-9913-B8E47E90EFD9} inefvmlzb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34BF73FB-D342-4c96-A301-1C9E101DC54F}\stubpath = "C:\\Windows\\system32\\inghxondz.exe" indwezqep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4ACE78C-54EA-4b1f-95AB-8D32EAA858F9}\stubpath = "C:\\Windows\\system32\\ingyagyjp.exe" injqftzfq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D6CD539-5F93-4938-A749-37DDAC01418E}\stubpath = "C:\\Windows\\system32\\inmxiifwj.exe" inokbwlsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{859C479A-D0D7-459b-8A1D-C157DD82B28C} inhgwhjlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4048E071-8342-47b8-8C1E-15868FD184EB} inknedlyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05E5EB2F-588A-4a41-BF52-D91C0C5AB402} inmkxopbr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5662496-4F3E-403b-AC58-AA0EE24F3D73} innqmfdal.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40B79DE3-4379-4b81-92E7-F4B5F6D9D28C} inwanaevl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32FAA099-CFA3-412e-B02A-84FCEE32DBC9}\stubpath = "C:\\Windows\\system32\\inbkyszdb.exe" incehxwfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E51DC9AE-33C3-432d-A173-72851B2FD680} inadlmaxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1AA51DA-758D-4b8c-B466-DD1D0F82FA8D}\stubpath = "C:\\Windows\\system32\\inztjzmib.exe" inoyokzfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{035CD668-D6B7-404c-A6D5-D5FF9E91CD2A}\stubpath = "C:\\Windows\\system32\\inykznpoh.exe" inxbftvlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09A34875-476A-473a-90F6-C615BE89FD78}\stubpath = "C:\\Windows\\system32\\innezahdx.exe" injfdlthy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00A1E9EC-1660-40a4-9147-2002FEA9C686} injyixbhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB819CB9-0272-40d6-95CD-C57D0AF9B3FD} inulkzdji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BACCB56-C638-4d35-AFC5-3802852B8221} inrmslxzd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{188C7C5D-179F-424b-A0CF-8E7B12566A91}\stubpath = "C:\\Windows\\system32\\inktbmkag.exe" indnibrwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D0AC84E-8F8A-403b-9024-DAA1B232D3AB} incbskfog.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5660558-488B-46f8-9297-0F126C9ED89A}\stubpath = "C:\\Windows\\system32\\inwpkmkez.exe" inxgaoyjn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3425DC0-3F39-4415-A65D-D50D22321B11}\stubpath = "C:\\Windows\\system32\\inktojpiu.exe" inmrhdpxe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{532FFE50-CCA0-441f-83C3-CFC4DB14CE5E} inxiaqxbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{324B2150-919E-4232-B413-34EF3B7F75AC}\stubpath = "C:\\Windows\\system32\\inkivmnpx.exe" inkwblfyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A222E065-32A3-42b8-AEE5-AC4D66136046} inuiybnpg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBBEB905-5649-4800-BFFB-EB03E65B628E} inwikohfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E4FC76A-2495-4629-8527-359B3BD0E04B}\stubpath = "C:\\Windows\\system32\\inazpsjiq.exe" inbjudnts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CB1D226-6F2C-42f7-BB23-69FB668161B9}\stubpath = "C:\\Windows\\system32\\inmkoozmm.exe" inepndjtb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6844C26D-9977-4489-BE22-DD4AB7DF0AD7}\stubpath = "C:\\Windows\\system32\\innezovdr.exe" injqkgmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC162EAD-4981-4e59-8BFF-B0407BBC4260}\stubpath = "C:\\Windows\\system32\\inhwnltjf.exe" indlyubtu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D297CCDA-43DF-4b39-B365-80EB368C5383} inrngsnzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A279D605-9022-4517-AF16-E528E0D48998} indwztgsi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E2C5B88-F0F9-4ba9-8BAA-2F11A9156050} inacgtgkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12B3A033-A398-44ff-B1DF-4C063068CB3B} inupkqjvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87EAFBDC-88B9-4763-AAD6-08651F77A732} inmibthrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E09524E-E49C-4790-986A-A6F4918F946E} injidfpid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26740508-2456-490b-8B62-6D795708129B}\stubpath = "C:\\Windows\\system32\\invgvfzue.exe" inpljrdzf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6168ED8B-3DB9-4206-8828-B441521BDB09} inebgydau.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05CCD425-491C-42b4-A2D1-3F6C8195CBB3}\stubpath = "C:\\Windows\\system32\\inxhvtpha.exe" inljyapnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F310F21-B67C-4586-9CCD-042E22C221B3} inomvcziu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE638AAE-2845-430f-AA86-16CF8DADBF91} inlhzufqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A52ED83C-AFE2-45f2-8F06-57F84C94FF88}\stubpath = "C:\\Windows\\system32\\ingvnhoze.exe" ingvzmksi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D04C4E38-B259-4132-9DE9-300B4AD423FD} inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CACCC1C5-4DB2-4454-86E6-41A18AEC214F}\stubpath = "C:\\Windows\\system32\\inruwvobn.exe" incgzwjvl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5A97A75-D575-496c-A4FA-D1785A9D64C3} incrjzdkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF3FE0A8-A5A7-41ac-AE0E-7003744A0F35}\stubpath = "C:\\Windows\\system32\\inzuolauz.exe" initcmsrt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59D354EE-E334-4c82-8D29-AD4E60DB1B25} inltdlhks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D04C4E38-B259-4132-9DE9-300B4AD423FD}\stubpath = "C:\\Windows\\system32\\infdqdofu.exe" inortslka.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D949BD01-6937-42c9-9BFF-23D6F2AA5568} innusjmop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{951B0728-7A62-4a8d-8A26-BE93AB781AFE}\stubpath = "C:\\Windows\\system32\\inzhuwqpq.exe" intndtuwg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E059F3A-4485-44c9-8B08-3C8404EA5F76} insylvfcw.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000019cb7-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5752 inpbwqegf.exe 3280 innqsrkjz.exe 1136 incvyzsfr.exe 4480 inpsutmlb.exe 280 inxtemyti.exe 5108 inpleqlxa.exe 752 inbqostfv.exe 3940 inigtklnv.exe 1484 inwsdlxsh.exe 4180 inlsmacbt.exe 4744 inbuxzyre.exe 1956 inmeufqjy.exe 4352 indlyubtu.exe 5824 inhwnltjf.exe 2332 inpkvggzd.exe 3680 inldtepix.exe 4856 inetlfmxc.exe 2092 intsuvkkg.exe 692 intfuikjc.exe 1616 innuocedv.exe 1912 indwztgsi.exe 5256 insohtodl.exe 2940 inhwoipfi.exe 4776 inqtvunam.exe 2888 inxiaqxbm.exe 1388 invrckwrg.exe 3164 inmprqjiy.exe 256 infumgnyd.exe 5744 ingtgabri.exe 4988 inuqbjvqf.exe 5944 ingvzmksi.exe 2436 ingvnhoze.exe 2592 inlofemzm.exe 5196 invhwkmle.exe 748 inogwahsa.exe 2860 infhthtec.exe 468 inmtnbdcu.exe 1680 inbrulkss.exe 2060 injmdckxk.exe 4788 inomzqrdt.exe 4620 inwhpwale.exe 1080 injwnoaqy.exe 3404 inpiofygs.exe 4828 inljyapnv.exe 6020 inxhvtpha.exe 3356 inlhzufqa.exe 4284 inzvgovkd.exe 5800 inrfpuysy.exe 952 inmnccutj.exe 5552 insrzztuj.exe 1984 inqgdzfrf.exe 4532 injfqeotx.exe 5392 innlypqcs.exe 1280 ineeenyiy.exe 252 inoavpdfe.exe 2292 inhegsgsd.exe 5208 indhxkwmb.exe 3632 inqcxrfhg.exe 2816 inrxixhwa.exe 6004 insezthji.exe 1936 ingfvhjng.exe 5464 inugvjlkd.exe 3456 inknedlyl.exe 3428 inapnrseu.exe - Loads dropped DLL 64 IoCs
pid Process 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5752 inpbwqegf.exe 5752 inpbwqegf.exe 3280 innqsrkjz.exe 3280 innqsrkjz.exe 1136 incvyzsfr.exe 1136 incvyzsfr.exe 4480 inpsutmlb.exe 4480 inpsutmlb.exe 280 inxtemyti.exe 280 inxtemyti.exe 5108 inpleqlxa.exe 5108 inpleqlxa.exe 752 inbqostfv.exe 752 inbqostfv.exe 3940 inigtklnv.exe 3940 inigtklnv.exe 1484 inwsdlxsh.exe 1484 inwsdlxsh.exe 4180 inlsmacbt.exe 4180 inlsmacbt.exe 4744 inbuxzyre.exe 4744 inbuxzyre.exe 1956 inmeufqjy.exe 1956 inmeufqjy.exe 4352 indlyubtu.exe 4352 indlyubtu.exe 5824 inhwnltjf.exe 5824 inhwnltjf.exe 2332 inpkvggzd.exe 2332 inpkvggzd.exe 3680 inldtepix.exe 3680 inldtepix.exe 4856 inetlfmxc.exe 4856 inetlfmxc.exe 2092 intsuvkkg.exe 2092 intsuvkkg.exe 692 intfuikjc.exe 692 intfuikjc.exe 1616 innuocedv.exe 1616 innuocedv.exe 1912 indwztgsi.exe 1912 indwztgsi.exe 5256 insohtodl.exe 5256 insohtodl.exe 2940 inhwoipfi.exe 2940 inhwoipfi.exe 4776 inqtvunam.exe 4776 inqtvunam.exe 2888 inxiaqxbm.exe 2888 inxiaqxbm.exe 1388 invrckwrg.exe 1388 invrckwrg.exe 3164 inmprqjiy.exe 3164 inmprqjiy.exe 256 infumgnyd.exe 256 infumgnyd.exe 5744 ingtgabri.exe 5744 ingtgabri.exe 4988 inuqbjvqf.exe 4988 inuqbjvqf.exe 5944 ingvzmksi.exe 5944 ingvzmksi.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\invhwkmle.exe_lang.ini inlofemzm.exe File opened for modification C:\Windows\SysWOW64\inzhuwqpq.exe_lang.ini intndtuwg.exe File created C:\Windows\SysWOW64\incgncjih.exe innoqupvt.exe File created C:\Windows\SysWOW64\inalzlawr.exe inivxkbyw.exe File opened for modification C:\Windows\SysWOW64\inpeapdzu.exe_lang.ini inihodrxd.exe File created C:\Windows\SysWOW64\innezahdx.exe injfdlthy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inghxondz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innusjmop.exe File opened for modification C:\Windows\SysWOW64\infnxzhjm.exe_lang.ini ingyagyjp.exe File opened for modification C:\Windows\SysWOW64\intuwvzao.exe_lang.ini inlisltat.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwikohfo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infudswxj.exe File opened for modification C:\Windows\SysWOW64\inhiypoew.exe_lang.ini invudbffq.exe File created C:\Windows\SysWOW64\inupkqjvx.exe inupalliz.exe File opened for modification C:\Windows\SysWOW64\innpclapa.exe_lang.ini innhouwkt.exe File created C:\Windows\SysWOW64\inknhvqeu.exe inbnjcuis.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxgaoyjn.exe File opened for modification C:\Windows\SysWOW64\incbrcegj.exe_lang.ini inqjpgzht.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indtosnaj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpprolqn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inadlmaxb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inncprues.exe File opened for modification C:\Windows\SysWOW64\invqlwhhe.exe_lang.ini inxlrthqk.exe File opened for modification C:\Windows\SysWOW64\inniyteex.exe_lang.ini inzkcszdo.exe File opened for modification C:\Windows\SysWOW64\inxtleici.exe_lang.ini inbbkvfva.exe File created C:\Windows\SysWOW64\inertnmni.exe insnyjjgx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inytozkkh.exe File opened for modification C:\Windows\SysWOW64\inztjzmib.exe_lang.ini inoyokzfp.exe File created C:\Windows\SysWOW64\inucxmxol.exe infauwnfj.exe File created C:\Windows\SysWOW64\inrngsnzc.exe incsvmltt.exe File created C:\Windows\SysWOW64\inbaqtkjr.exe inujqmuoe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innoqupvt.exe File created C:\Windows\SysWOW64\inkbytnkt.exe inktbmkag.exe File opened for modification C:\Windows\SysWOW64\inhhsffsh.exe_lang.ini inknhvqeu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inewrcnnk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoxdfqoe.exe File created C:\Windows\SysWOW64\inutvwllh.exe ingrakqpr.exe File opened for modification C:\Windows\SysWOW64\inzjwmbpr.exe_lang.ini indpalewk.exe File created C:\Windows\SysWOW64\injwbpnkv.exe inogxmhdp.exe File created C:\Windows\SysWOW64\insacfcod.exe inbfyviuk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infnxzhjm.exe File created C:\Windows\SysWOW64\invpovkyk.exe inigkkvii.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injlxlxig.exe File created C:\Windows\SysWOW64\inakrpgjz.exe inyvsxuru.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inatybwnb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inewhnrej.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfqeotx.exe File created C:\Windows\SysWOW64\inkzrlbas.exe inbsfowhf.exe File created C:\Windows\SysWOW64\inqklaasr.exe injsnioht.exe File opened for modification C:\Windows\SysWOW64\inupkqjvx.exe_lang.ini inupalliz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmflkmos.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlhpjpqs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infhthtec.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpiofygs.exe File created C:\Windows\SysWOW64\inqcxrfhg.exe indhxkwmb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inefvmlzb.exe File opened for modification C:\Windows\SysWOW64\inruwvobn.exe_lang.ini incgzwjvl.exe File created C:\Windows\SysWOW64\inyccnaan.exe inclzteci.exe File created C:\Windows\SysWOW64\incanalcr.exe ineugyxhj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhuwzjax.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyqkarh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzkcszdo.exe File created C:\Windows\SysWOW64\inhwnltjf.exe indlyubtu.exe File created C:\Windows\SysWOW64\infhthtec.exe inogwahsa.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupeyqpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insezthji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invlhtipl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebmvqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incajnuiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkesnbrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inamdunku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invhwkmle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkietvme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhpdyhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inblsqhkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrjcgagg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innlypqcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrurbsrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfevnir.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incixldvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfqeotx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineamubie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbnjcuis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmayveeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invqlwhhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injmdckxk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgusiod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingyagyjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvqwujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuinrlrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inigkkvii.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzrqlnxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incqysiyz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbskfog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbxslgig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insnxovkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvnhoze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyiwuqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intojzuff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwpkmkez.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqmfrmyb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhqyjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyvsxuru.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbohznex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhsblrqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnwdvwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomvcziu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insdtdypv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwfngdng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvcvbrm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwaymvpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqfmalkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwixlnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzjwmbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inivxkbyw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indrzpldy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoxdfqoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhmcksg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxitdtqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inypsuvxw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incanalcr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsbjtei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtosnaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaigtkln.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5752 inpbwqegf.exe 5752 inpbwqegf.exe 3280 innqsrkjz.exe 3280 innqsrkjz.exe 1136 incvyzsfr.exe 1136 incvyzsfr.exe 4480 inpsutmlb.exe 4480 inpsutmlb.exe 280 inxtemyti.exe 280 inxtemyti.exe 5108 inpleqlxa.exe 5108 inpleqlxa.exe 752 inbqostfv.exe 752 inbqostfv.exe 3940 inigtklnv.exe 3940 inigtklnv.exe 1484 inwsdlxsh.exe 1484 inwsdlxsh.exe 4180 inlsmacbt.exe 4180 inlsmacbt.exe 4744 inbuxzyre.exe 4744 inbuxzyre.exe 1956 inmeufqjy.exe 1956 inmeufqjy.exe 4352 indlyubtu.exe 4352 indlyubtu.exe 5824 inhwnltjf.exe 5824 inhwnltjf.exe 2332 inpkvggzd.exe 2332 inpkvggzd.exe 3680 inldtepix.exe 3680 inldtepix.exe 4856 inetlfmxc.exe 4856 inetlfmxc.exe 2092 intsuvkkg.exe 2092 intsuvkkg.exe 692 intfuikjc.exe 692 intfuikjc.exe 1616 innuocedv.exe 1616 innuocedv.exe 1912 indwztgsi.exe 1912 indwztgsi.exe 5256 insohtodl.exe 5256 insohtodl.exe 2940 inhwoipfi.exe 2940 inhwoipfi.exe 4776 inqtvunam.exe 4776 inqtvunam.exe 2888 inxiaqxbm.exe 2888 inxiaqxbm.exe 1388 invrckwrg.exe 1388 invrckwrg.exe 3164 inmprqjiy.exe 3164 inmprqjiy.exe 256 infumgnyd.exe 256 infumgnyd.exe 5744 ingtgabri.exe 5744 ingtgabri.exe 4988 inuqbjvqf.exe 4988 inuqbjvqf.exe 5944 ingvzmksi.exe 5944 ingvzmksi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 5752 inpbwqegf.exe Token: SeDebugPrivilege 3280 innqsrkjz.exe Token: SeDebugPrivilege 1136 incvyzsfr.exe Token: SeDebugPrivilege 4480 inpsutmlb.exe Token: SeDebugPrivilege 280 inxtemyti.exe Token: SeDebugPrivilege 5108 inpleqlxa.exe Token: SeDebugPrivilege 752 inbqostfv.exe Token: SeDebugPrivilege 3940 inigtklnv.exe Token: SeDebugPrivilege 1484 inwsdlxsh.exe Token: SeDebugPrivilege 4180 inlsmacbt.exe Token: SeDebugPrivilege 4744 inbuxzyre.exe Token: SeDebugPrivilege 1956 inmeufqjy.exe Token: SeDebugPrivilege 4352 indlyubtu.exe Token: SeDebugPrivilege 5824 inhwnltjf.exe Token: SeDebugPrivilege 2332 inpkvggzd.exe Token: SeDebugPrivilege 3680 inldtepix.exe Token: SeDebugPrivilege 4856 inetlfmxc.exe Token: SeDebugPrivilege 2092 intsuvkkg.exe Token: SeDebugPrivilege 692 intfuikjc.exe Token: SeDebugPrivilege 1616 innuocedv.exe Token: SeDebugPrivilege 1912 indwztgsi.exe Token: SeDebugPrivilege 5256 insohtodl.exe Token: SeDebugPrivilege 2940 inhwoipfi.exe Token: SeDebugPrivilege 4776 inqtvunam.exe Token: SeDebugPrivilege 2888 inxiaqxbm.exe Token: SeDebugPrivilege 1388 invrckwrg.exe Token: SeDebugPrivilege 3164 inmprqjiy.exe Token: SeDebugPrivilege 256 infumgnyd.exe Token: SeDebugPrivilege 5744 ingtgabri.exe Token: SeDebugPrivilege 4988 inuqbjvqf.exe Token: SeDebugPrivilege 5944 ingvzmksi.exe Token: SeDebugPrivilege 2436 ingvnhoze.exe Token: SeDebugPrivilege 2592 inlofemzm.exe Token: SeDebugPrivilege 5196 invhwkmle.exe Token: SeDebugPrivilege 748 inogwahsa.exe Token: SeDebugPrivilege 2860 infhthtec.exe Token: SeDebugPrivilege 468 inmtnbdcu.exe Token: SeDebugPrivilege 1680 inbrulkss.exe Token: SeDebugPrivilege 2060 injmdckxk.exe Token: SeDebugPrivilege 4788 inomzqrdt.exe Token: SeDebugPrivilege 4620 inwhpwale.exe Token: SeDebugPrivilege 1080 injwnoaqy.exe Token: SeDebugPrivilege 3404 inpiofygs.exe Token: SeDebugPrivilege 4828 inljyapnv.exe Token: SeDebugPrivilege 6020 inxhvtpha.exe Token: SeDebugPrivilege 3356 inlhzufqa.exe Token: SeDebugPrivilege 4284 inzvgovkd.exe Token: SeDebugPrivilege 5800 inrfpuysy.exe Token: SeDebugPrivilege 952 inmnccutj.exe Token: SeDebugPrivilege 5552 insrzztuj.exe Token: SeDebugPrivilege 1984 inqgdzfrf.exe Token: SeDebugPrivilege 4532 injfqeotx.exe Token: SeDebugPrivilege 5392 innlypqcs.exe Token: SeDebugPrivilege 1280 ineeenyiy.exe Token: SeDebugPrivilege 252 inoavpdfe.exe Token: SeDebugPrivilege 2292 inhegsgsd.exe Token: SeDebugPrivilege 5208 indhxkwmb.exe Token: SeDebugPrivilege 3632 inqcxrfhg.exe Token: SeDebugPrivilege 2816 inrxixhwa.exe Token: SeDebugPrivilege 6004 insezthji.exe Token: SeDebugPrivilege 1936 ingfvhjng.exe Token: SeDebugPrivilege 5464 inugvjlkd.exe Token: SeDebugPrivilege 3456 inknedlyl.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 5752 inpbwqegf.exe 3280 innqsrkjz.exe 1136 incvyzsfr.exe 4480 inpsutmlb.exe 280 inxtemyti.exe 5108 inpleqlxa.exe 752 inbqostfv.exe 3940 inigtklnv.exe 1484 inwsdlxsh.exe 4180 inlsmacbt.exe 4744 inbuxzyre.exe 1956 inmeufqjy.exe 4352 indlyubtu.exe 5824 inhwnltjf.exe 2332 inpkvggzd.exe 3680 inldtepix.exe 4856 inetlfmxc.exe 2092 intsuvkkg.exe 692 intfuikjc.exe 1616 innuocedv.exe 1912 indwztgsi.exe 5256 insohtodl.exe 2940 inhwoipfi.exe 4776 inqtvunam.exe 2888 inxiaqxbm.exe 1388 invrckwrg.exe 3164 inmprqjiy.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 5752 4192 2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 5752 wrote to memory of 3280 5752 inpbwqegf.exe 90 PID 3280 wrote to memory of 1136 3280 innqsrkjz.exe 91 PID 1136 wrote to memory of 4480 1136 incvyzsfr.exe 92 PID 4480 wrote to memory of 280 4480 inpsutmlb.exe 93 PID 280 wrote to memory of 5108 280 inxtemyti.exe 94 PID 5108 wrote to memory of 752 5108 inpleqlxa.exe 95 PID 752 wrote to memory of 3940 752 inbqostfv.exe 96 PID 3940 wrote to memory of 1484 3940 inigtklnv.exe 97 PID 1484 wrote to memory of 4180 1484 inwsdlxsh.exe 98 PID 4180 wrote to memory of 4744 4180 inlsmacbt.exe 99 PID 4744 wrote to memory of 1956 4744 inbuxzyre.exe 100 PID 1956 wrote to memory of 4352 1956 inmeufqjy.exe 101 PID 4352 wrote to memory of 5824 4352 indlyubtu.exe 102 PID 5824 wrote to memory of 2332 5824 inhwnltjf.exe 103 PID 2332 wrote to memory of 3680 2332 inpkvggzd.exe 104 PID 3680 wrote to memory of 4856 3680 inldtepix.exe 105 PID 4856 wrote to memory of 2092 4856 inetlfmxc.exe 106 PID 2092 wrote to memory of 692 2092 intsuvkkg.exe 107 PID 692 wrote to memory of 1616 692 intfuikjc.exe 108 PID 1616 wrote to memory of 1912 1616 innuocedv.exe 109 PID 1912 wrote to memory of 5256 1912 indwztgsi.exe 110 PID 5256 wrote to memory of 2940 5256 insohtodl.exe 111 PID 2940 wrote to memory of 4776 2940 inhwoipfi.exe 112 PID 4776 wrote to memory of 2888 4776 inqtvunam.exe 113 PID 2888 wrote to memory of 1388 2888 inxiaqxbm.exe 114 PID 1388 wrote to memory of 3164 1388 invrckwrg.exe 115 PID 3164 wrote to memory of 256 3164 inmprqjiy.exe 116 PID 256 wrote to memory of 5744 256 infumgnyd.exe 117 PID 5744 wrote to memory of 4988 5744 ingtgabri.exe 118 PID 4988 wrote to memory of 5944 4988 inuqbjvqf.exe 119 PID 5944 wrote to memory of 2436 5944 ingvzmksi.exe 120 PID 2436 wrote to memory of 2592 2436 ingvnhoze.exe 121 PID 2592 wrote to memory of 5196 2592 inlofemzm.exe 122 PID 5196 wrote to memory of 748 5196 invhwkmle.exe 123 PID 748 wrote to memory of 2860 748 inogwahsa.exe 124 PID 2860 wrote to memory of 468 2860 infhthtec.exe 125 PID 468 wrote to memory of 1680 468 inmtnbdcu.exe 126 PID 1680 wrote to memory of 2060 1680 inbrulkss.exe 127 PID 2060 wrote to memory of 4788 2060 injmdckxk.exe 128 PID 4788 wrote to memory of 4620 4788 inomzqrdt.exe 129 PID 4620 wrote to memory of 1080 4620 inwhpwale.exe 130 PID 1080 wrote to memory of 3404 1080 injwnoaqy.exe 131 PID 3404 wrote to memory of 4828 3404 inpiofygs.exe 132 PID 4828 wrote to memory of 6020 4828 inljyapnv.exe 133 PID 6020 wrote to memory of 3356 6020 inxhvtpha.exe 134 PID 3356 wrote to memory of 4284 3356 inlhzufqa.exe 135 PID 4284 wrote to memory of 5800 4284 inzvgovkd.exe 136 PID 5800 wrote to memory of 952 5800 inrfpuysy.exe 137 PID 952 wrote to memory of 5552 952 inmnccutj.exe 138 PID 5552 wrote to memory of 1984 5552 insrzztuj.exe 139 PID 1984 wrote to memory of 4532 1984 inqgdzfrf.exe 140 PID 4532 wrote to memory of 5392 4532 injfqeotx.exe 141 PID 5392 wrote to memory of 1280 5392 innlypqcs.exe 142 PID 1280 wrote to memory of 252 1280 ineeenyiy.exe 143 PID 252 wrote to memory of 2292 252 inoavpdfe.exe 144 PID 2292 wrote to memory of 5208 2292 inhegsgsd.exe 145 PID 5208 wrote to memory of 3632 5208 indhxkwmb.exe 146 PID 3632 wrote to memory of 2816 3632 inqcxrfhg.exe 147 PID 2816 wrote to memory of 6004 2816 inrxixhwa.exe 148 PID 6004 wrote to memory of 1936 6004 insezthji.exe 149 PID 1936 wrote to memory of 5464 1936 ingfvhjng.exe 150 PID 5464 wrote to memory of 3456 5464 inugvjlkd.exe 151 PID 3456 wrote to memory of 3428 3456 inknedlyl.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6e517e3d5c0346d445904d9a150a28ee_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe22⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe26⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe32⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe42⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe47⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe48⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\inrxixhwa.exeC:\Windows\system32\inrxixhwa.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\ingfvhjng.exeC:\Windows\system32\ingfvhjng.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe64⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe65⤵
- Executes dropped EXE
PID:3428 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe66⤵
- Drops file in System32 directory
PID:2512 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe67⤵PID:6128
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe68⤵
- Drops file in System32 directory
PID:1124 -
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe69⤵PID:5696
-
C:\Windows\SysWOW64\inenraymu.exeC:\Windows\system32\inenraymu.exe70⤵PID:1816
-
C:\Windows\SysWOW64\inuhqyjhd.exeC:\Windows\system32\inuhqyjhd.exe71⤵
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe72⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe73⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\injyixbhg.exeC:\Windows\system32\injyixbhg.exe74⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1472 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe75⤵PID:1728
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe76⤵PID:944
-
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe77⤵PID:4768
-
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe78⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3376 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe79⤵PID:4820
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe80⤵PID:4088
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe81⤵PID:5504
-
C:\Windows\SysWOW64\inwikohfo.exeC:\Windows\system32\inwikohfo.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:3740 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe83⤵PID:4944
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe84⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:3396 -
C:\Windows\SysWOW64\inbsfowhf.exeC:\Windows\system32\inbsfowhf.exe85⤵
- Drops file in System32 directory
PID:4428 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe86⤵PID:4784
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe87⤵PID:5200
-
C:\Windows\SysWOW64\insbznvcp.exeC:\Windows\system32\insbznvcp.exe88⤵PID:3184
-
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe89⤵
- System Location Discovery: System Language Discovery
PID:552 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe90⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2356 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe91⤵PID:3384
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe92⤵PID:5212
-
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe93⤵
- Drops file in System32 directory
PID:1504 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe94⤵PID:3360
-
C:\Windows\SysWOW64\intxcqoxe.exeC:\Windows\system32\intxcqoxe.exe95⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2228 -
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe96⤵PID:248
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe97⤵
- Drops file in System32 directory
PID:264 -
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe98⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1480 -
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe99⤵
- Drops file in System32 directory
PID:4220 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe100⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4372 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe101⤵PID:2652
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe102⤵PID:1076
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe103⤵
- Drops file in System32 directory
PID:5228 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe104⤵PID:5852
-
C:\Windows\SysWOW64\inionprva.exeC:\Windows\system32\inionprva.exe105⤵PID:5140
-
C:\Windows\SysWOW64\inboqtqar.exeC:\Windows\system32\inboqtqar.exe106⤵PID:2020
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe107⤵PID:3408
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe108⤵PID:4280
-
C:\Windows\SysWOW64\inkuaczqt.exeC:\Windows\system32\inkuaczqt.exe109⤵PID:5172
-
C:\Windows\SysWOW64\insgwlney.exeC:\Windows\system32\insgwlney.exe110⤵PID:5516
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe111⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\inomvcziu.exeC:\Windows\system32\inomvcziu.exe112⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:3736 -
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe113⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1540 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe114⤵PID:4104
-
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe115⤵PID:4356
-
C:\Windows\SysWOW64\inwmcsiky.exeC:\Windows\system32\inwmcsiky.exe116⤵PID:2676
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe117⤵PID:1312
-
C:\Windows\SysWOW64\inqzaupvo.exeC:\Windows\system32\inqzaupvo.exe118⤵PID:3256
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe119⤵PID:400
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe120⤵PID:3580
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe121⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-