Analysis
- max time kernel
84s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:50
Behavioral task
behavioral1
Sample
2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260930-p259cszala
- SHA256 ed2438be14e02a5c73b78977515673f0721cef9b30db76d8ecd0465a8a617060
- MD5 293f4ba20fe67cec374264aad302e0a3
- SHA1 56473b22ae530cb671a211244bc278feb8ef047b
- SHA512 0fedd3056e8361185be41bb7244720c6aaad04771771e4a32668f773d035763ae75afff0edb07a190896595ac12b58ea853231a37c7a2ba1cf6117ba1cb8520b
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTr:RPjOa1NxyYtH1r
- TLSH T1FC15AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/4824-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c604-19.dat family_gh0strat behavioral2/memory/4824-21-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c60b-40.dat family_gh0strat behavioral2/memory/4004-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c60a-31.dat family_gh0strat behavioral2/files/0x000c00000001c610-64.dat family_gh0strat behavioral2/memory/3320-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c613-86.dat family_gh0strat behavioral2/memory/4320-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c617-108.dat family_gh0strat behavioral2/memory/2292-113-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c61c-130.dat family_gh0strat behavioral2/memory/2772-138-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c621-152.dat family_gh0strat behavioral2/files/0x000c00000001c625-173.dat family_gh0strat behavioral2/memory/4984-178-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c629-195.dat family_gh0strat behavioral2/memory/4692-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5160-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4220-265-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4372-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c648-349.dat family_gh0strat behavioral2/memory/5220-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3044-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2560-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4704-554-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4028-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4056-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4008-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5340-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4640-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1772-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5008-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5532-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2368-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4200-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1056-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c643-328.dat family_gh0strat behavioral2/memory/3420-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c63f-306.dat family_gh0strat behavioral2/files/0x000c00000001c63b-287.dat family_gh0strat behavioral2/memory/3096-286-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c637-262.dat family_gh0strat behavioral2/files/0x000c00000001c633-240.dat family_gh0strat behavioral2/memory/4492-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c62e-218.dat family_gh0strat behavioral2/memory/4124-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9BEDBF6-49A9-4879-9A1B-F276459BA07F}\stubpath = "C:\\Windows\\system32\\inkveoutv.exe" inacgtgkr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDA1AD0A-F3AF-426a-BF49-4A8AF0A08DAA}\stubpath = "C:\\Windows\\system32\\ingtvpopk.exe" inczogbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B93B5DA1-571B-404e-A87D-FBC860DF9141}\stubpath = "C:\\Windows\\system32\\inzhuwqpq.exe" inrtwgusw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA5E3F26-63B7-4c5e-90B7-51213D17B6D1} inigkkvii.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D7FFB4F-DE14-4d6b-9A1A-F17B2D6DDF08} incsvmltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81BAE6B7-5508-462c-8EA4-A14C881226A7} inzvgovkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5864FAE-622B-4f7c-BDFC-195BFAC54CB0}\stubpath = "C:\\Windows\\system32\\inqklaasr.exe" inrfpuysy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D6CC254-D69C-4f09-B6AC-3B798274A7D8}\stubpath = "C:\\Windows\\system32\\inirmhzng.exe" inwemzvcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{916FDD16-A09E-47e9-9FB7-6A60C356A33E}\stubpath = "C:\\Windows\\system32\\inpprolqn.exe" incwvxbyn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62B869A5-414A-4d01-A562-2FC37FAF6D84}\stubpath = "C:\\Windows\\system32\\ingcowdkg.exe" inmflkmos.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD1C1445-398C-4537-9BBE-34598C29D106} inogwahsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{422CCDD6-4695-422e-B2A4-C75AA34DE525} inknedlyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C085E08-3481-4f4d-8D6A-DFA9068A6FA1} inidwdyvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD98BCA4-C4DE-4130-8BD1-C3469680DFA6}\stubpath = "C:\\Windows\\system32\\inhiypoew.exe" inyjbrycn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F75047DA-BE85-4580-8BEE-86162093BE50} inilcbjwj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CCD9C2A3-2FE7-47ad-B4EC-F1F91C7AD0DB} ingrakqpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CA2D11F-C2C9-4ad8-9D5A-80D50FF3F336} inahuhbcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB83AFCB-FB92-4997-A75D-151847B3D7C3} inxiaqxbm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55D1D64A-5D43-48e7-A95C-593CD6B23C14} innfvgrkz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EA07B8BC-6476-4412-BD53-D7D6734FF0FC}\stubpath = "C:\\Windows\\system32\\inghxondz.exe" inwhpwale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE123928-B761-4cdc-8626-25D4C39383BA} inwmcsiky.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59F4FC67-CD8D-47c9-95F1-FD73A7171EB3} inrvqwujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04525E4D-3D6B-452d-A156-E8274F74D991}\stubpath = "C:\\Windows\\system32\\inbuxzyre.exe" innuocedv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B69E49CA-0818-4ab1-8FF1-59370936B97B} inochlfll.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{404AF032-366C-4a1c-BBDE-1E4FBAE516A1} initcmsrt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9954CC32-456A-4779-B19D-D928CDB0E07E}\stubpath = "C:\\Windows\\system32\\incbrdfjw.exe" inobndxaw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB623A96-65B3-48e4-8575-5934479A2C12} invlbrhjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09694B02-931F-4aae-AD2D-FF0C0A977A66}\stubpath = "C:\\Windows\\system32\\infgqgwzc.exe" inwfngdng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3867966-2750-4108-AC6A-28ACEBD82CD3} invtcqgup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD1C1445-398C-4537-9BBE-34598C29D106}\stubpath = "C:\\Windows\\system32\\ingvnhoze.exe" inogwahsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29E0AFFA-E022-4b39-A6C6-AEE81B3DAA86} inqmfrmyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F9CDDB7-C775-4997-AA79-A705D78C57FE}\stubpath = "C:\\Windows\\system32\\initcmsrt.exe" inxitdtqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5430462C-2B7B-4fd7-AA1A-E2A700D7F397}\stubpath = "C:\\Windows\\system32\\inhwnltjf.exe" intcrvwiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6021A203-7BBA-4437-B6EC-C0425CA5C6E5}\stubpath = "C:\\Windows\\system32\\inbpxnjbw.exe" indtkzjxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A82A5853-DC15-480d-AE6D-AE10D6EF2D70} invgvfzue.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6301B55D-C27A-47a4-A0B9-032E05258BEE} inuwegjgs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B67078A8-11E0-4bab-B92C-83F1C6CD3215} inhrtbdgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A89E42EF-CB9D-4331-BC49-F37AC7E52368} inkesnbrx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBBEC02A-30A2-4433-B429-D64FBE75CB65}\stubpath = "C:\\Windows\\system32\\inagshjtq.exe" inueaqidm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFD91EAD-0BE4-4c92-8348-F62300A118B2}\stubpath = "C:\\Windows\\system32\\inimthpzj.exe" inikbvtjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F87D406-685D-4ea6-A173-EB86CA5EE14F}\stubpath = "C:\\Windows\\system32\\innbxlquo.exe" inaqgiwze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8985E8D2-6B82-4564-B209-59A6D2E205D8} incehxwfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20D1017A-259B-4d22-A974-BB34EBB72A34} incybtpgq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0097A8BE-AB38-4b9a-A3D6-C0BA6BF48642}\stubpath = "C:\\Windows\\system32\\injkrqgyq.exe" infcpjolj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E224215-0834-4363-81B6-4C12DEC0A524}\stubpath = "C:\\Windows\\system32\\inudpxert.exe" inuytzxmg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C6010F2-61BC-4150-BF37-7399D3848F4D} inngbnczn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0442D92-953E-4de2-A2A1-4519C8065105}\stubpath = "C:\\Windows\\system32\\inmprqjiy.exe" inbuxzyre.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E007AC6E-FFDD-44c5-AD27-9FFAC8E8AB51} inxhvtpha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96E77526-6062-4ecb-A07A-564FF7211893}\stubpath = "C:\\Windows\\system32\\inmktaxgs.exe" inxrqyyst.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDAF1A33-12F4-400e-9622-258CDF499C92} inwikshbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4113D50C-09EC-43dd-8BA6-8AAEF45B8704}\stubpath = "C:\\Windows\\system32\\infsuonoj.exe" inrkqhiua.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2263C4AD-EFF7-41f5-941A-BC5F7098AB94} inpiofygs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04525E4D-3D6B-452d-A156-E8274F74D991} innuocedv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A62DB59-D5BB-468e-873D-194B16B77935} inljyapnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADF5B14E-6A44-4ced-98AB-7DACDBC04D42} inthmqkqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4BE8C93-74C8-4e06-96B9-A4F1DB1CDA7E}\stubpath = "C:\\Windows\\system32\\indbkovjr.exe" inisglpjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FBC8DDD-CED3-4549-839F-AD98F2D958E6}\stubpath = "C:\\Windows\\system32\\inrbrocsh.exe" inyegtexf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B9495C1-EFD4-4c9f-88E4-FEECA5D458C8}\stubpath = "C:\\Windows\\system32\\inrhmypep.exe" inljswfrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E5FAE39-5693-43b7-A270-D44C793458E2} inebmvqfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE123928-B761-4cdc-8626-25D4C39383BA}\stubpath = "C:\\Windows\\system32\\inpleqlxa.exe" inwmcsiky.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{222CA07C-093D-4c4d-B243-E2C52BD2CE71}\stubpath = "C:\\Windows\\system32\\inqzaupvo.exe" inyteppma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E7DE7E7-2DC3-4ac0-8F76-CAB1E3D8D9EE}\stubpath = "C:\\Windows\\system32\\inhhsffsh.exe" inlmosntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9146DFE5-217B-4a8a-92BD-FFFED5BE0FDF}\stubpath = "C:\\Windows\\system32\\ingyagyjp.exe" inupalliz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E484BD2-6E72-4702-BA52-35E6A116BAB5}\stubpath = "C:\\Windows\\system32\\inuvxhdct.exe" inlolxmlm.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000d000000019cb7-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4004 inoavpdfe.exe 3320 inldtepix.exe 4320 indskelwb.exe 2292 inortslka.exe 2772 inrdysgih.exe 4124 inaexuhtj.exe 4984 inykznpoh.exe 4692 inqcxrfhg.exe 4492 inxjymong.exe 5160 inpbwqegf.exe 4220 inwixlnmf.exe 3096 inwmpgfnn.exe 3420 ineuxonvv.exe 4372 intpaiupe.exe 1056 ingiuiufd.exe 4200 inpsutmlb.exe 2368 invhwkmle.exe 5532 inmtnbdcu.exe 5008 inxtemyti.exe 1772 injyqkarh.exe 4640 inqtvunam.exe 5340 inpqffxwb.exe 4008 innfvgrkz.exe 4056 intfuikjc.exe 4028 incgzwjvl.exe 4704 inaphxbit.exe 2560 indtwnmuu.exe 3044 inmeufqjy.exe 5220 inazpsjiq.exe 4020 inbfyviuk.exe 3868 inrngsnzc.exe 4196 inetlfmxc.exe 1312 indhxkwmb.exe 4556 inmkxopbr.exe 764 inqjpgzht.exe 4664 innuocedv.exe 1984 inbuxzyre.exe 1492 inmprqjiy.exe 4628 inuqbjvqf.exe 5068 inhjvjvge.exe 3424 inogwahsa.exe 5452 ingvnhoze.exe 4500 inixomukg.exe 4000 inqgdzfrf.exe 4040 inaikwkwh.exe 3772 inruwvobn.exe 4644 inhwoipfi.exe 5376 inljyapnv.exe 4024 indwztgsi.exe 2960 inknedlyl.exe 2856 insvxwpco.exe 5052 inhsblrqs.exe 1544 inqmfrmyb.exe 3552 ineybxzdp.exe 296 inixpjqgj.exe 1468 inlofemzm.exe 4456 inbqostfv.exe 3856 inkzrlbas.exe 1824 inlhzufqa.exe 1148 indlyubtu.exe 5584 inyjbrycn.exe 976 inhiypoew.exe 432 infdqdofu.exe 4624 ingwzqpxx.exe - Loads dropped DLL 64 IoCs
pid Process 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe 4004 inoavpdfe.exe 4004 inoavpdfe.exe 3320 inldtepix.exe 3320 inldtepix.exe 4320 indskelwb.exe 4320 indskelwb.exe 2292 inortslka.exe 2292 inortslka.exe 2772 inrdysgih.exe 2772 inrdysgih.exe 4124 inaexuhtj.exe 4124 inaexuhtj.exe 4984 inykznpoh.exe 4984 inykznpoh.exe 4692 inqcxrfhg.exe 4692 inqcxrfhg.exe 4492 inxjymong.exe 4492 inxjymong.exe 5160 inpbwqegf.exe 5160 inpbwqegf.exe 4220 inwixlnmf.exe 4220 inwixlnmf.exe 3096 inwmpgfnn.exe 3096 inwmpgfnn.exe 3420 ineuxonvv.exe 3420 ineuxonvv.exe 4372 intpaiupe.exe 4372 intpaiupe.exe 1056 ingiuiufd.exe 1056 ingiuiufd.exe 4200 inpsutmlb.exe 4200 inpsutmlb.exe 2368 invhwkmle.exe 2368 invhwkmle.exe 5532 inmtnbdcu.exe 5532 inmtnbdcu.exe 5008 inxtemyti.exe 5008 inxtemyti.exe 1772 injyqkarh.exe 1772 injyqkarh.exe 4640 inqtvunam.exe 4640 inqtvunam.exe 5340 inpqffxwb.exe 5340 inpqffxwb.exe 4008 innfvgrkz.exe 4008 innfvgrkz.exe 4056 intfuikjc.exe 4056 intfuikjc.exe 4028 incgzwjvl.exe 4028 incgzwjvl.exe 4704 inaphxbit.exe 4704 inaphxbit.exe 2560 indtwnmuu.exe 2560 indtwnmuu.exe 3044 inmeufqjy.exe 3044 inmeufqjy.exe 5220 inazpsjiq.exe 5220 inazpsjiq.exe 4020 inbfyviuk.exe 4020 inbfyviuk.exe 3868 inrngsnzc.exe 3868 inrngsnzc.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\injfevnir.exe_lang.ini inihodrxd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqnbrgit.exe File opened for modification C:\Windows\SysWOW64\inzvgovkd.exe_lang.ini incanalcr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrcangym.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyteppma.exe File opened for modification C:\Windows\SysWOW64\inirmhzng.exe_lang.ini inwemzvcu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhomdgwi.exe File opened for modification C:\Windows\SysWOW64\inesiwrli.exe_lang.ini inoioprby.exe File opened for modification C:\Windows\SysWOW64\inmsevrki.exe_lang.ini inyoeaukm.exe File opened for modification C:\Windows\SysWOW64\infsuonoj.exe_lang.ini inrkqhiua.exe File opened for modification C:\Windows\SysWOW64\inthmqkqb.exe_lang.ini inpleqlxa.exe File created C:\Windows\SysWOW64\inwskdhbh.exe inniyteex.exe File opened for modification C:\Windows\SysWOW64\infauwnfj.exe_lang.ini inyaereiz.exe File created C:\Windows\SysWOW64\inmzfdmqx.exe infmbihgy.exe File opened for modification C:\Windows\SysWOW64\inugvjlkd.exe_lang.ini innikicxv.exe File opened for modification C:\Windows\SysWOW64\inidwdyvc.exe_lang.ini inomvcziu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwikohfo.exe File opened for modification C:\Windows\SysWOW64\inkuaczqt.exe_lang.ini inmxiifwj.exe File created C:\Windows\SysWOW64\inthxpach.exe inyxynpgc.exe File created C:\Windows\SysWOW64\innjrlbrs.exe inhyqlaum.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inidwdyvc.exe File created C:\Windows\SysWOW64\innuocedv.exe inqjpgzht.exe File created C:\Windows\SysWOW64\invpovkyk.exe inuiybnpg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwyoarng.exe File opened for modification C:\Windows\SysWOW64\infmbpvbz.exe_lang.ini inzfhvydh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insywlfel.exe File opened for modification C:\Windows\SysWOW64\inctpigdo.exe_lang.ini inhztqfaz.exe File created C:\Windows\SysWOW64\iniujiyjl.exe inpedtegi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intpaiupe.exe File created C:\Windows\SysWOW64\incrjzdkv.exe inlsmacbt.exe File created C:\Windows\SysWOW64\inwgusogd.exe inochlfll.exe File opened for modification C:\Windows\SysWOW64\inulkzdji.exe_lang.ini inuydrpyf.exe File opened for modification C:\Windows\SysWOW64\invfrxfpk.exe_lang.ini inxnewqnc.exe File created C:\Windows\SysWOW64\inxavmale.exe inniombtb.exe File opened for modification C:\Windows\SysWOW64\inldtepix.exe_lang.ini inoavpdfe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intmsjkwc.exe File opened for modification C:\Windows\SysWOW64\infgwnmcy.exe_lang.ini insgwlney.exe File opened for modification C:\Windows\SysWOW64\incvyzsfr.exe_lang.ini innamcwvx.exe File opened for modification C:\Windows\SysWOW64\inhomdgwi.exe_lang.ini insywlfel.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzolinkh.exe File created C:\Windows\SysWOW64\inejnhnnw.exe inuwftrhn.exe File created C:\Windows\SysWOW64\incxuerhz.exe indlvgkyq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intuwvzao.exe File created C:\Windows\SysWOW64\inaexuhtj.exe inrdysgih.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inazpsjiq.exe File opened for modification C:\Windows\SysWOW64\incanalcr.exe_lang.ini inkbaivic.exe File created C:\Windows\SysWOW64\infslrijv.exe inmnccutj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inktojpiu.exe File opened for modification C:\Windows\SysWOW64\inobndxaw.exe_lang.ini innbxlquo.exe File opened for modification C:\Windows\SysWOW64\inbsfowhf.exe_lang.ini inlhpjpqs.exe File opened for modification C:\Windows\SysWOW64\infzicqlp.exe_lang.ini inddqfcew.exe File created C:\Windows\SysWOW64\incjmswjo.exe inwskdhbh.exe File created C:\Windows\SysWOW64\inrlmbbts.exe inwanaevl.exe File opened for modification C:\Windows\SysWOW64\ineamubie.exe_lang.ini inzkzjyci.exe File created C:\Windows\SysWOW64\inalzlawr.exe inlgphgbd.exe File created C:\Windows\SysWOW64\inkmpmynm.exe inalzlawr.exe File created C:\Windows\SysWOW64\inhomdgwi.exe insywlfel.exe File created C:\Windows\SysWOW64\inpzchsnz.exe iniqjgqjr.exe File opened for modification C:\Windows\SysWOW64\inxbftvlo.exe_lang.ini infvqbbup.exe File created C:\Windows\SysWOW64\inixomukg.exe ingvnhoze.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inixomukg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inadbobmd.exe File opened for modification C:\Windows\SysWOW64\inopeewva.exe_lang.ini invnbgkek.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingerepgv.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvetxyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingcowdkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaphxbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inadbobmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwanaevl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniizepdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invhyunli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inesqmezb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkoozmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmhgrmq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdhyock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injprzfoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuytzxmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intfcjrzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyorihpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indxawycz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzfhvydh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inokbwlsa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxuxrboe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insacfcod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzzbyva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxhvtpha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqiycju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inddmxhxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhpjpqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgphgbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthxpach.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtwnmuu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwbpnkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inucuflpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzixomu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrjcgagg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxitdtqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzrfkoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwfngdng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrgtvyi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intojzuff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkfxleq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvqwujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingrakqpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzrcejxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrfvkmdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzfdmqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indbkovjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhjedoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvxxhec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innnpmjol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilftocs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqostfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyufnzuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwnltjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineupaato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgaoyjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innswqwhw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inknhvqeu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intxcqoxe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbnjcuis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intdzdpys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrurbsrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuizasnp.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe 4004 inoavpdfe.exe 4004 inoavpdfe.exe 3320 inldtepix.exe 3320 inldtepix.exe 4320 indskelwb.exe 4320 indskelwb.exe 2292 inortslka.exe 2292 inortslka.exe 2772 inrdysgih.exe 2772 inrdysgih.exe 4124 inaexuhtj.exe 4124 inaexuhtj.exe 4984 inykznpoh.exe 4984 inykznpoh.exe 4692 inqcxrfhg.exe 4692 inqcxrfhg.exe 4492 inxjymong.exe 4492 inxjymong.exe 5160 inpbwqegf.exe 5160 inpbwqegf.exe 4220 inwixlnmf.exe 4220 inwixlnmf.exe 3096 inwmpgfnn.exe 3096 inwmpgfnn.exe 3420 ineuxonvv.exe 3420 ineuxonvv.exe 4372 intpaiupe.exe 4372 intpaiupe.exe 1056 ingiuiufd.exe 1056 ingiuiufd.exe 4200 inpsutmlb.exe 4200 inpsutmlb.exe 2368 invhwkmle.exe 2368 invhwkmle.exe 5532 inmtnbdcu.exe 5532 inmtnbdcu.exe 5008 inxtemyti.exe 5008 inxtemyti.exe 1772 injyqkarh.exe 1772 injyqkarh.exe 4640 inqtvunam.exe 4640 inqtvunam.exe 5340 inpqffxwb.exe 5340 inpqffxwb.exe 4008 innfvgrkz.exe 4008 innfvgrkz.exe 4056 intfuikjc.exe 4056 intfuikjc.exe 4028 incgzwjvl.exe 4028 incgzwjvl.exe 4704 inaphxbit.exe 4704 inaphxbit.exe 2560 indtwnmuu.exe 2560 indtwnmuu.exe 3044 inmeufqjy.exe 3044 inmeufqjy.exe 5220 inazpsjiq.exe 5220 inazpsjiq.exe 4020 inbfyviuk.exe 4020 inbfyviuk.exe 3868 inrngsnzc.exe 3868 inrngsnzc.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 4004 inoavpdfe.exe Token: SeDebugPrivilege 3320 inldtepix.exe Token: SeDebugPrivilege 4320 indskelwb.exe Token: SeDebugPrivilege 2292 inortslka.exe Token: SeDebugPrivilege 2772 inrdysgih.exe Token: SeDebugPrivilege 4124 inaexuhtj.exe Token: SeDebugPrivilege 4984 inykznpoh.exe Token: SeDebugPrivilege 4692 inqcxrfhg.exe Token: SeDebugPrivilege 4492 inxjymong.exe Token: SeDebugPrivilege 5160 inpbwqegf.exe Token: SeDebugPrivilege 4220 inwixlnmf.exe Token: SeDebugPrivilege 3096 inwmpgfnn.exe Token: SeDebugPrivilege 3420 ineuxonvv.exe Token: SeDebugPrivilege 4372 intpaiupe.exe Token: SeDebugPrivilege 1056 ingiuiufd.exe Token: SeDebugPrivilege 4200 inpsutmlb.exe Token: SeDebugPrivilege 2368 invhwkmle.exe Token: SeDebugPrivilege 5532 inmtnbdcu.exe Token: SeDebugPrivilege 5008 inxtemyti.exe Token: SeDebugPrivilege 1772 injyqkarh.exe Token: SeDebugPrivilege 4640 inqtvunam.exe Token: SeDebugPrivilege 5340 inpqffxwb.exe Token: SeDebugPrivilege 4008 innfvgrkz.exe Token: SeDebugPrivilege 4056 intfuikjc.exe Token: SeDebugPrivilege 4028 incgzwjvl.exe Token: SeDebugPrivilege 4704 inaphxbit.exe Token: SeDebugPrivilege 2560 indtwnmuu.exe Token: SeDebugPrivilege 3044 inmeufqjy.exe Token: SeDebugPrivilege 5220 inazpsjiq.exe Token: SeDebugPrivilege 4020 inbfyviuk.exe Token: SeDebugPrivilege 3868 inrngsnzc.exe Token: SeDebugPrivilege 4196 inetlfmxc.exe Token: SeDebugPrivilege 1312 indhxkwmb.exe Token: SeDebugPrivilege 4556 inmkxopbr.exe Token: SeDebugPrivilege 764 inqjpgzht.exe Token: SeDebugPrivilege 4664 innuocedv.exe Token: SeDebugPrivilege 1984 inbuxzyre.exe Token: SeDebugPrivilege 1492 inmprqjiy.exe Token: SeDebugPrivilege 4628 inuqbjvqf.exe Token: SeDebugPrivilege 5068 inhjvjvge.exe Token: SeDebugPrivilege 3424 inogwahsa.exe Token: SeDebugPrivilege 5452 ingvnhoze.exe Token: SeDebugPrivilege 4500 inixomukg.exe Token: SeDebugPrivilege 4000 inqgdzfrf.exe Token: SeDebugPrivilege 4040 inaikwkwh.exe Token: SeDebugPrivilege 3772 inruwvobn.exe Token: SeDebugPrivilege 4644 inhwoipfi.exe Token: SeDebugPrivilege 5376 inljyapnv.exe Token: SeDebugPrivilege 4024 indwztgsi.exe Token: SeDebugPrivilege 2960 inknedlyl.exe Token: SeDebugPrivilege 2856 insvxwpco.exe Token: SeDebugPrivilege 5052 inhsblrqs.exe Token: SeDebugPrivilege 1544 inqmfrmyb.exe Token: SeDebugPrivilege 3552 ineybxzdp.exe Token: SeDebugPrivilege 296 inixpjqgj.exe Token: SeDebugPrivilege 1468 inlofemzm.exe Token: SeDebugPrivilege 4456 inbqostfv.exe Token: SeDebugPrivilege 3856 inkzrlbas.exe Token: SeDebugPrivilege 1824 inlhzufqa.exe Token: SeDebugPrivilege 1148 indlyubtu.exe Token: SeDebugPrivilege 5584 inyjbrycn.exe Token: SeDebugPrivilege 976 inhiypoew.exe Token: SeDebugPrivilege 432 infdqdofu.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe 4004 inoavpdfe.exe 3320 inldtepix.exe 4320 indskelwb.exe 2292 inortslka.exe 2772 inrdysgih.exe 4124 inaexuhtj.exe 4984 inykznpoh.exe 4692 inqcxrfhg.exe 4492 inxjymong.exe 5160 inpbwqegf.exe 4220 inwixlnmf.exe 3096 inwmpgfnn.exe 3420 ineuxonvv.exe 4372 intpaiupe.exe 1056 ingiuiufd.exe 4200 inpsutmlb.exe 2368 invhwkmle.exe 5532 inmtnbdcu.exe 5008 inxtemyti.exe 1772 injyqkarh.exe 4640 inqtvunam.exe 5340 inpqffxwb.exe 4008 innfvgrkz.exe 4056 intfuikjc.exe 4028 incgzwjvl.exe 4704 inaphxbit.exe 2560 indtwnmuu.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 4004 4824 2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe 88 PID 4004 wrote to memory of 3320 4004 inoavpdfe.exe 89 PID 3320 wrote to memory of 4320 3320 inldtepix.exe 90 PID 4320 wrote to memory of 2292 4320 indskelwb.exe 91 PID 2292 wrote to memory of 2772 2292 inortslka.exe 92 PID 2772 wrote to memory of 4124 2772 inrdysgih.exe 93 PID 4124 wrote to memory of 4984 4124 inaexuhtj.exe 94 PID 4984 wrote to memory of 4692 4984 inykznpoh.exe 95 PID 4692 wrote to memory of 4492 4692 inqcxrfhg.exe 96 PID 4492 wrote to memory of 5160 4492 inxjymong.exe 97 PID 5160 wrote to memory of 4220 5160 inpbwqegf.exe 98 PID 4220 wrote to memory of 3096 4220 inwixlnmf.exe 99 PID 3096 wrote to memory of 3420 3096 inwmpgfnn.exe 100 PID 3420 wrote to memory of 4372 3420 ineuxonvv.exe 101 PID 4372 wrote to memory of 1056 4372 intpaiupe.exe 102 PID 1056 wrote to memory of 4200 1056 ingiuiufd.exe 103 PID 4200 wrote to memory of 2368 4200 inpsutmlb.exe 104 PID 2368 wrote to memory of 5532 2368 invhwkmle.exe 105 PID 5532 wrote to memory of 5008 5532 inmtnbdcu.exe 106 PID 5008 wrote to memory of 1772 5008 inxtemyti.exe 107 PID 1772 wrote to memory of 4640 1772 injyqkarh.exe 108 PID 4640 wrote to memory of 5340 4640 inqtvunam.exe 109 PID 5340 wrote to memory of 4008 5340 inpqffxwb.exe 110 PID 4008 wrote to memory of 4056 4008 innfvgrkz.exe 111 PID 4056 wrote to memory of 4028 4056 intfuikjc.exe 112 PID 4028 wrote to memory of 4704 4028 incgzwjvl.exe 113 PID 4704 wrote to memory of 2560 4704 inaphxbit.exe 114 PID 2560 wrote to memory of 3044 2560 indtwnmuu.exe 115 PID 3044 wrote to memory of 5220 3044 inmeufqjy.exe 116 PID 5220 wrote to memory of 4020 5220 inazpsjiq.exe 117 PID 4020 wrote to memory of 3868 4020 inbfyviuk.exe 118 PID 3868 wrote to memory of 4196 3868 inrngsnzc.exe 119 PID 4196 wrote to memory of 1312 4196 inetlfmxc.exe 120 PID 1312 wrote to memory of 4556 1312 indhxkwmb.exe 121 PID 4556 wrote to memory of 764 4556 inmkxopbr.exe 122 PID 764 wrote to memory of 4664 764 inqjpgzht.exe 123 PID 4664 wrote to memory of 1984 4664 innuocedv.exe 124 PID 1984 wrote to memory of 1492 1984 inbuxzyre.exe 125 PID 1492 wrote to memory of 4628 1492 inmprqjiy.exe 126 PID 4628 wrote to memory of 5068 4628 inuqbjvqf.exe 127 PID 5068 wrote to memory of 3424 5068 inhjvjvge.exe 128 PID 3424 wrote to memory of 5452 3424 inogwahsa.exe 129 PID 5452 wrote to memory of 4500 5452 ingvnhoze.exe 130 PID 4500 wrote to memory of 4000 4500 inixomukg.exe 131 PID 4000 wrote to memory of 4040 4000 inqgdzfrf.exe 132 PID 4040 wrote to memory of 3772 4040 inaikwkwh.exe 133 PID 3772 wrote to memory of 4644 3772 inruwvobn.exe 134 PID 4644 wrote to memory of 5376 4644 inhwoipfi.exe 135 PID 5376 wrote to memory of 4024 5376 inljyapnv.exe 136 PID 4024 wrote to memory of 2960 4024 indwztgsi.exe 137 PID 2960 wrote to memory of 2856 2960 inknedlyl.exe 138 PID 2856 wrote to memory of 5052 2856 insvxwpco.exe 139 PID 5052 wrote to memory of 1544 5052 inhsblrqs.exe 140 PID 1544 wrote to memory of 3552 1544 inqmfrmyb.exe 141 PID 3552 wrote to memory of 296 3552 ineybxzdp.exe 142 PID 296 wrote to memory of 1468 296 inixpjqgj.exe 143 PID 1468 wrote to memory of 4456 1468 inlofemzm.exe 144 PID 4456 wrote to memory of 3856 4456 inbqostfv.exe 145 PID 3856 wrote to memory of 1824 3856 inkzrlbas.exe 146 PID 1824 wrote to memory of 1148 1824 inlhzufqa.exe 147 PID 1148 wrote to memory of 5584 1148 indlyubtu.exe 148 PID 5584 wrote to memory of 976 5584 inyjbrycn.exe 149 PID 976 wrote to memory of 432 976 inhiypoew.exe 150 PID 432 wrote to memory of 4624 432 infdqdofu.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_293f4ba20fe67cec374264aad302e0a3_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe24⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe36⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe37⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe38⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe42⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe49⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe54⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe62⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe65⤵
- Executes dropped EXE
PID:4624 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe66⤵PID:5420
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe67⤵
- System Location Discovery: System Language Discovery
PID:2128 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe68⤵
- Drops file in System32 directory
PID:3788 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe69⤵PID:3996
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe70⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4428 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe71⤵PID:5460
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe72⤵PID:5296
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe73⤵
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe74⤵PID:1588
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe75⤵PID:4748
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe76⤵PID:2384
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe77⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3696 -
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe78⤵PID:1328
-
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe79⤵PID:720
-
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\system32\indeulkya.exe80⤵PID:5636
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe81⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe83⤵PID:2588
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe84⤵PID:5744
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe85⤵PID:1364
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe86⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe87⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2080 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe88⤵
- System Location Discovery: System Language Discovery
PID:776 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe89⤵PID:5688
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe90⤵PID:1916
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe91⤵PID:4240
-
C:\Windows\SysWOW64\inuhqyjhd.exeC:\Windows\system32\inuhqyjhd.exe92⤵PID:4312
-
C:\Windows\SysWOW64\inrkqhiua.exeC:\Windows\system32\inrkqhiua.exe93⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4044 -
C:\Windows\SysWOW64\infsuonoj.exeC:\Windows\system32\infsuonoj.exe94⤵PID:1856
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe95⤵
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\intmsjkwc.exeC:\Windows\system32\intmsjkwc.exe96⤵
- Drops file in System32 directory
PID:1292 -
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:1668 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe98⤵PID:980
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe99⤵PID:2256
-
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe100⤵PID:1444
-
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe101⤵PID:5876
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe102⤵PID:5752
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe103⤵PID:3036
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe104⤵
- Drops file in System32 directory
PID:3516 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe105⤵
- Drops file in System32 directory
PID:3148 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe106⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2192 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe107⤵PID:3384
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe108⤵PID:4784
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe109⤵PID:5712
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe110⤵PID:4744
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe111⤵
- Drops file in System32 directory
PID:5268 -
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe112⤵PID:5348
-
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe113⤵PID:6032
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe114⤵PID:4288
-
C:\Windows\SysWOW64\inrhnxdft.exeC:\Windows\system32\inrhnxdft.exe115⤵PID:4752
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe116⤵PID:5128
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe117⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5088 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe118⤵PID:2992
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe119⤵PID:1812
-
C:\Windows\SysWOW64\invnbgkek.exeC:\Windows\system32\invnbgkek.exe120⤵
- Drops file in System32 directory
PID:4060 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe121⤵PID:5360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-