Analysis
- max time kernel
78s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 18:46
Behavioral task
behavioral1
Sample
2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260930-xez3tsff28
- SHA256 a6d559245fe65c2f0646145adfd6c8c4fe099253857c839108cf47cd11f4c371
- MD5 8aee9950e8976ad20a91f20ce8e5cdd8
- SHA1 df89fbd075c32cdb824d88e1d01c3ee678a10ef7
- SHA512 838f6e9dfa1003c14f42126692604e88ae04ff7f18ae3650f4744a4c46ef18cd70c5c3c8402892caf47c10fdcaba4b9d6a1432bb9bdc9bbe2ed3426c9c76e876
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT2:RPjOa1NxyYtH12
- TLSH T16115AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/4728-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x00040000000187c7-20.dat family_gh0strat behavioral2/memory/4728-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x001200000001c4d2-39.dat family_gh0strat behavioral2/files/0x001100000001c43c-31.dat family_gh0strat behavioral2/memory/6044-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4dc-65.dat family_gh0strat behavioral2/files/0x000d00000001c4e1-86.dat family_gh0strat behavioral2/memory/1404-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e6-108.dat family_gh0strat behavioral2/files/0x000d00000001c4ea-130.dat family_gh0strat behavioral2/files/0x000d00000001c4f2-174.dat family_gh0strat behavioral2/files/0x000d00000001c4f6-200.dat family_gh0strat behavioral2/memory/4788-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4952-445-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/264-517-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4696-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4580-625-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3376-607-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5760-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2544-553-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2072-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4624-499-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3464-481-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1120-463-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1844-427-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4504-409-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2856-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4744-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6004-355-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c514-351.dat family_gh0strat behavioral2/memory/2760-333-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c510-329.dat family_gh0strat behavioral2/memory/4240-311-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50c-307.dat family_gh0strat behavioral2/memory/3188-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c507-285.dat family_gh0strat behavioral2/memory/1864-267-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c503-263.dat family_gh0strat behavioral2/files/0x000d00000001c4ff-241.dat family_gh0strat behavioral2/memory/4320-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4fb-219.dat family_gh0strat behavioral2/memory/3396-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4060-179-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6056-157-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ee-153.dat family_gh0strat behavioral2/memory/5624-135-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3100-113-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2692-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30A4D3AA-FA3F-4987-A742-713B42B9DD67}\stubpath = "C:\\Windows\\system32\\inyjbrycn.exe" inxtemyti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11A132B5-F52D-4447-98CA-819A7989C9AD}\stubpath = "C:\\Windows\\system32\\inbuxzyre.exe" inwmpgfnn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAAC0EE0-B2DA-424e-9FA5-E7EAFD97665F}\stubpath = "C:\\Windows\\system32\\inqrggyxc.exe" indwezqep.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB69AE06-946A-4b07-BD10-9D6B24C43A8B}\stubpath = "C:\\Windows\\system32\\inwemzvcu.exe" invqmdynu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{806BD151-D4DB-478e-9985-1D95B0D688B7}\stubpath = "C:\\Windows\\system32\\inkxmjgli.exe" inrkqhiua.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{512B87CF-6FAE-46c5-B168-EED292554EEB}\stubpath = "C:\\Windows\\system32\\inyazesml.exe" iniszdhvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A55FAEBB-282F-4472-B76C-6A88128E301B} inclzteci.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23EFFCEE-5D57-4506-BA54-BBBE44BBA158} inimbeutc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EEB00A46-C679-4fc0-9C91-CEEE6A7EE5FD}\stubpath = "C:\\Windows\\system32\\inesqmezb.exe" inhiypoew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E80574AD-B9DE-4f00-84C1-3346EF63F60B}\stubpath = "C:\\Windows\\system32\\inmlwcerc.exe" inhgwhjlo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFEA1274-F1F6-4ce2-965C-7C24E04057FA} inmzesqny.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8837179-9079-4b36-8549-1405BFA00487}\stubpath = "C:\\Windows\\system32\\inhhsffsh.exe" inlubyhti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63E2E2CB-8B8F-4caf-8371-2BD076A5FE9A}\stubpath = "C:\\Windows\\system32\\inbbkvfva.exe" ingtvpopk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E162D1D6-EBD2-442a-8A52-EBFA1BC85926}\stubpath = "C:\\Windows\\system32\\inpkfxleq.exe" inuinrlrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD86D499-C4C2-4647-BA07-286F5773511F} inboqtqar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EAD64249-F40F-4bcf-9A0A-C20515C614BD}\stubpath = "C:\\Windows\\system32\\inirveqyf.exe" intndtuwg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98EAAEA8-8A26-47ca-87E9-4D4C98F32492}\stubpath = "C:\\Windows\\system32\\invshckbs.exe" intikurgv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02118A57-73E2-4127-BFBB-1F77B206AB3C}\stubpath = "C:\\Windows\\system32\\invrckwrg.exe" intsuvkkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18958F77-EF19-478b-BA29-6EBAAC4DA2E5} inarenvge.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3580C9B-FC1E-4e52-AB6E-C5434E3E2D7B} injwylczx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11D5C64A-D1D9-4ebf-A91C-B868182E7AE7} injfdlthy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A3AE95A-1352-4a5c-AEFC-7595C488A5C8}\stubpath = "C:\\Windows\\system32\\inpdohnmo.exe" inkbytnkt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9052C8F-3BCD-43c9-B3A6-DD3C9E5592D2} inatwyxqd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BECC9156-B09C-473d-956C-D2F1A7AE610A} injhulmow.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0324CD04-4163-4fb2-BD1C-01CFB80BA122}\stubpath = "C:\\Windows\\system32\\inmnccutj.exe" inmibthrw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E86E6CA4-7CDE-4393-A343-F8C98FE020BC} inkuaczqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE48E612-E000-4b5c-A05E-195B7579AB8F}\stubpath = "C:\\Windows\\system32\\inmayveeq.exe" inkwblfyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9C3C1D9B-4460-429a-B8D6-C5291AB510E4} innptoush.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{288C0887-C427-444b-9992-C0AFE70355FE}\stubpath = "C:\\Windows\\system32\\inkveoutv.exe" infrfqjpo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{405A1501-7AF8-4393-B5D6-7C3E623BCFDE}\stubpath = "C:\\Windows\\system32\\inwmpgfnn.exe" injyqkarh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B4BAFAE-CFAB-41f8-9FA8-10E72C5DCE2A}\stubpath = "C:\\Windows\\system32\\intetdxsy.exe" inujlcwuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E1414709-66FE-402f-B35D-20E396A18A29}\stubpath = "C:\\Windows\\system32\\inzfhvydh.exe" inumafjdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D335280-9E67-467a-BAE6-F53FE5A42E12}\stubpath = "C:\\Windows\\system32\\incxuerhz.exe" injidfpid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BB6530EB-5DE3-4abb-9024-D0C5E049072B}\stubpath = "C:\\Windows\\system32\\inlolxmlm.exe" inkesnbrx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{543E3C99-2339-4810-AA6B-937782430D04} inmhxsddw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB69AE06-946A-4b07-BD10-9D6B24C43A8B} invqmdynu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D37696F1-692A-4a48-8B03-2DDCA6EA78C6}\stubpath = "C:\\Windows\\system32\\inhomdgwi.exe" initcmsrt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2D39481-463C-4eea-9302-35B61526B514}\stubpath = "C:\\Windows\\system32\\infvqbbup.exe" ingoxeawx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36799E98-EC11-4d81-94C0-BB33BF1B4639} ineugyxhj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4D56277-24AE-48d3-BF23-D729BC161466} inxitdtqe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C834BF4-1645-46fc-840A-4E1CD0326FB0}\stubpath = "C:\\Windows\\system32\\inbdhuahl.exe" invqlrkwy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6648C24C-4302-4119-BBFE-66E0D658704F}\stubpath = "C:\\Windows\\system32\\invecggre.exe" inorbpnrr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE24205C-312C-41d7-BF1A-FEEE07060C4D}\stubpath = "C:\\Windows\\system32\\inrcangym.exe" infvqbbup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1548F3E0-99C1-4dc8-9B07-16AB9DAB2FD0} inbjwysrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4CBEC8E-315F-482b-90CC-D6D35D576005} inckxztas.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EA1A603-4367-4f5a-94C9-B74694EF734D} inhzrfkoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{474D1030-28C3-478d-9F2A-7594C559EECC} inooxsntm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EFE6247-1284-41a8-B6AD-744FAB6AA7A0}\stubpath = "C:\\Windows\\system32\\inebgydau.exe" inpdohnmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F1895C0-A96E-41f1-A0BB-FA3AC0462B5A} inrxixhwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BA2469C-AF99-414f-84E0-4A67BBDC931B} innfvgrkz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E11E7CC-6CF5-451b-A9F8-16E5A8CD0D9B}\stubpath = "C:\\Windows\\system32\\incehxwfd.exe" inkdbjsnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3F167299-71CB-413c-8853-D1F9AAE874B2} inpprolqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1D0821F-1250-4709-AB08-4EE49EABB768}\stubpath = "C:\\Windows\\system32\\inqpqfsux.exe" inniucjdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69BD9660-95D8-4c3f-9841-1F178FD01CCB}\stubpath = "C:\\Windows\\system32\\inyctgpxi.exe" inebgydau.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D5927D9-57FB-4e71-8452-4455D6CC8FD0}\stubpath = "C:\\Windows\\system32\\innhouwkt.exe" inzjlpkqo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72191287-8D88-4429-96F8-3800E061AECF} inscqyokc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CEDD4E2-CC90-4556-8372-7224D8E0BC7C}\stubpath = "C:\\Windows\\system32\\ineuxonvv.exe" inaivxrqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27BCCAEA-604F-45ae-AC31-B0242B58B41F} inrmslxzd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79346C98-260B-4271-A5EA-3FF08D0867A3}\stubpath = "C:\\Windows\\system32\\injyixbhg.exe" insaljfpw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{49E4307B-29A2-4f14-A71E-AAFA27446805} inenraymu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28C866C5-50CB-45df-A795-77FAE286AE9D}\stubpath = "C:\\Windows\\system32\\inzewkdpr.exe" injdwyyif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B1CD912-0C93-4328-B297-1349AB4E1FE8}\stubpath = "C:\\Windows\\system32\\inwtdautu.exe" iniqgcwmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{839C9B92-0C4A-476c-8699-A9A8B7E1F843}\stubpath = "C:\\Windows\\system32\\inaphxbit.exe" inahuhbcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FFA031F-9AE2-4f58-9894-19FDB3945129}\stubpath = "C:\\Windows\\system32\\insgwlney.exe" inrhnxdft.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000500000000053e-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 6044 invhwkmle.exe 2692 inpleqlxa.exe 1404 inetlfmxc.exe 3100 inzloqpih.exe 5624 inqtvunam.exe 6056 inzvgovkd.exe 4060 inlsmacbt.exe 3396 inbqiycju.exe 4320 indtwnmuu.exe 4788 inqmfrmyb.exe 1864 incrjzdkv.exe 3188 incgzwjvl.exe 4240 inogwahsa.exe 2760 inugvjlkd.exe 6004 inigtklnv.exe 4744 incanalcr.exe 2856 inwixlnmf.exe 4504 innqsrkjz.exe 1844 indskelwb.exe 4952 inaikwkwh.exe 1120 insohtodl.exe 3464 infumgnyd.exe 4624 inmprqjiy.exe 264 inruwvobn.exe 2072 indwztgsi.exe 2544 inldtepix.exe 5760 inbpxnjbw.exe 4696 ingvnhoze.exe 3376 intsuvkkg.exe 4580 invrckwrg.exe 988 inixpjqgj.exe 1068 innuocedv.exe 1764 insezthji.exe 5636 infslrijv.exe 5956 injwnoaqy.exe 5096 inxtemyti.exe 3444 inyjbrycn.exe 5152 inoavpdfe.exe 5488 incvyzsfr.exe 4248 inlofemzm.exe 1116 inbaqtkjr.exe 5784 inxjymong.exe 6060 inortslka.exe 4972 inatwyxqd.exe 2264 ingvetxyk.exe 4268 inuqbjvqf.exe 4868 intfuikjc.exe 5616 injyqkarh.exe 2244 inwmpgfnn.exe 924 inbuxzyre.exe 6020 inykznpoh.exe 3216 indxawycz.exe 1532 inbjudnts.exe 1228 inutvwllh.exe 2572 incsvmltt.exe 3636 inxrqyyst.exe 5852 innlypqcs.exe 4860 inhfsfaqh.exe 5180 injhulmow.exe 5448 insvxwpco.exe 1092 inaexuhtj.exe 1500 inghxondz.exe 1112 inrlmbbts.exe 5948 inhwoipfi.exe - Loads dropped DLL 64 IoCs
pid Process 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe 6044 invhwkmle.exe 6044 invhwkmle.exe 2692 inpleqlxa.exe 2692 inpleqlxa.exe 1404 inetlfmxc.exe 1404 inetlfmxc.exe 3100 inzloqpih.exe 3100 inzloqpih.exe 5624 inqtvunam.exe 5624 inqtvunam.exe 6056 inzvgovkd.exe 6056 inzvgovkd.exe 4060 inlsmacbt.exe 4060 inlsmacbt.exe 3396 inbqiycju.exe 3396 inbqiycju.exe 4320 indtwnmuu.exe 4320 indtwnmuu.exe 4788 inqmfrmyb.exe 4788 inqmfrmyb.exe 1864 incrjzdkv.exe 1864 incrjzdkv.exe 3188 incgzwjvl.exe 3188 incgzwjvl.exe 4240 inogwahsa.exe 4240 inogwahsa.exe 2760 inugvjlkd.exe 2760 inugvjlkd.exe 6004 inigtklnv.exe 6004 inigtklnv.exe 4744 incanalcr.exe 4744 incanalcr.exe 2856 inwixlnmf.exe 2856 inwixlnmf.exe 4504 innqsrkjz.exe 4504 innqsrkjz.exe 1844 indskelwb.exe 1844 indskelwb.exe 4952 inaikwkwh.exe 4952 inaikwkwh.exe 1120 insohtodl.exe 1120 insohtodl.exe 3464 infumgnyd.exe 3464 infumgnyd.exe 4624 inmprqjiy.exe 4624 inmprqjiy.exe 264 inruwvobn.exe 264 inruwvobn.exe 2072 indwztgsi.exe 2072 indwztgsi.exe 2544 inldtepix.exe 2544 inldtepix.exe 5760 inbpxnjbw.exe 5760 inbpxnjbw.exe 4696 ingvnhoze.exe 4696 ingvnhoze.exe 3376 intsuvkkg.exe 3376 intsuvkkg.exe 4580 invrckwrg.exe 4580 invrckwrg.exe 988 inixpjqgj.exe 988 inixpjqgj.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inhgncqwc.exe File opened for modification C:\Windows\SysWOW64\inetlfmxc.exe_lang.ini inpleqlxa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbuxzyre.exe File opened for modification C:\Windows\SysWOW64\innikicxv.exe_lang.ini inyvsxuru.exe File created C:\Windows\SysWOW64\inivlaoql.exe iniwaqpwa.exe File opened for modification C:\Windows\SysWOW64\inxqcxpkg.exe_lang.ini inrtkbsie.exe File opened for modification C:\Windows\SysWOW64\inotqnqky.exe_lang.ini inonisjqf.exe File created C:\Windows\SysWOW64\inoioprby.exe inmbpckft.exe File created C:\Windows\SysWOW64\inlhagxpk.exe inctpigdo.exe File created C:\Windows\SysWOW64\inigtklnv.exe inugvjlkd.exe File created C:\Windows\SysWOW64\inrfpuysy.exe innoddvuk.exe File created C:\Windows\SysWOW64\inbjwysrs.exe inxrycagn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoxdfqoe.exe File created C:\Windows\SysWOW64\inuinrlrc.exe inijzqpfx.exe File opened for modification C:\Windows\SysWOW64\infmbpvbz.exe_lang.ini inikbvtjp.exe File created C:\Windows\SysWOW64\indbxwxmz.exe infsuonoj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innusjmop.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlofemzm.exe File created C:\Windows\SysWOW64\inortslka.exe inxjymong.exe File opened for modification C:\Windows\SysWOW64\injyqkarh.exe_lang.ini intfuikjc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyiwuqi.exe File created C:\Windows\SysWOW64\inyoeaukm.exe innptoush.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwuyycww.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmzfdmqx.exe File created C:\Windows\SysWOW64\invqlwhhe.exe injwbpnkv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvgovkd.exe File created C:\Windows\SysWOW64\indxawycz.exe inykznpoh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incsvmltt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inahuhbcs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyegrpfl.exe File created C:\Windows\SysWOW64\inuloqrtx.exe inkjzlnrk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwtyvsvp.exe File opened for modification C:\Windows\SysWOW64\invaiaqlz.exe_lang.ini inpedtegi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwsdlxsh.exe File created C:\Windows\SysWOW64\inbsfowhf.exe inikojpnc.exe File opened for modification C:\Windows\SysWOW64\inionprva.exe_lang.ini inowmiavg.exe File created C:\Windows\SysWOW64\ineupaato.exe incbrdfjw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intbosajb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuwjozuo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingatvyvf.exe File created C:\Windows\SysWOW64\inuizasnp.exe inptcowdq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inortslka.exe File opened for modification C:\Windows\SysWOW64\incsnrmiw.exe_lang.ini indscwrxb.exe File opened for modification C:\Windows\SysWOW64\indeulkya.exe_lang.ini inqxvmprs.exe File created C:\Windows\SysWOW64\ingfvhjng.exe inftrnfcc.exe File opened for modification C:\Windows\SysWOW64\intxcqoxe.exe_lang.ini inarenvge.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injqftzfq.exe File created C:\Windows\SysWOW64\inhngmkjz.exe innjrlbrs.exe File created C:\Windows\SysWOW64\inxzfxryi.exe inthxpach.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inadbobmd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inczeboin.exe File created C:\Windows\SysWOW64\inqklaasr.exe inzkzjyci.exe File created C:\Windows\SysWOW64\inpwglkgm.exe inovtknpq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innuocedv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingiuiufd.exe File opened for modification C:\Windows\SysWOW64\inwsdlxsh.exe_lang.ini inrngsnzc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkivmnpx.exe File created C:\Windows\SysWOW64\inxtleici.exe incraptug.exe File created C:\Windows\SysWOW64\inhwfuyzl.exe inimbeutc.exe File opened for modification C:\Windows\SysWOW64\invpovkyk.exe_lang.ini intmsjkwc.exe File opened for modification C:\Windows\SysWOW64\inpkuzhdr.exe_lang.ini inhrtbdgd.exe File opened for modification C:\Windows\SysWOW64\inbjwysrs.exe_lang.ini inxrycagn.exe File opened for modification C:\Windows\SysWOW64\inbpxnjbw.exe_lang.ini inldtepix.exe File created C:\Windows\SysWOW64\inhsblrqs.exe inhscspdt.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indpalewk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indrzpldy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniyteex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmnccutj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkwblfyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnxzhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intxmhybx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuhmxsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inghxondz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inddmxhxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzrfkoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intekobge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfyviuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmqlrpew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innlypqcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwskdhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqpqfsux.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infdqdofu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inytozkkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrgtvyi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniqjgqjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innezovdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdmufdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inknedlyl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmxiifwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insulctjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbskfog.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzzdxxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhlazdts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inauxfdek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language initcmsrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyorihpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrycagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlaxcmgz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innjrlbrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invrckwrg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incanalcr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inahuhbcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indeulkya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inytomigo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmhxsddw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innajnacf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtnbdcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inooxsntm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvxxhec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infzzbyva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhhsffsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injkrqgyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhthtec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmktaxgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intetdxsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inphclvql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inypsuvxw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inopeewva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktbmkag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhbuwzwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhrodsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe 6044 invhwkmle.exe 6044 invhwkmle.exe 2692 inpleqlxa.exe 2692 inpleqlxa.exe 1404 inetlfmxc.exe 1404 inetlfmxc.exe 3100 inzloqpih.exe 3100 inzloqpih.exe 5624 inqtvunam.exe 5624 inqtvunam.exe 6056 inzvgovkd.exe 6056 inzvgovkd.exe 4060 inlsmacbt.exe 4060 inlsmacbt.exe 3396 inbqiycju.exe 3396 inbqiycju.exe 4320 indtwnmuu.exe 4320 indtwnmuu.exe 4788 inqmfrmyb.exe 4788 inqmfrmyb.exe 1864 incrjzdkv.exe 1864 incrjzdkv.exe 3188 incgzwjvl.exe 3188 incgzwjvl.exe 4240 inogwahsa.exe 4240 inogwahsa.exe 2760 inugvjlkd.exe 2760 inugvjlkd.exe 6004 inigtklnv.exe 6004 inigtklnv.exe 4744 incanalcr.exe 4744 incanalcr.exe 2856 inwixlnmf.exe 2856 inwixlnmf.exe 4504 innqsrkjz.exe 4504 innqsrkjz.exe 1844 indskelwb.exe 1844 indskelwb.exe 4952 inaikwkwh.exe 4952 inaikwkwh.exe 1120 insohtodl.exe 1120 insohtodl.exe 3464 infumgnyd.exe 3464 infumgnyd.exe 4624 inmprqjiy.exe 4624 inmprqjiy.exe 264 inruwvobn.exe 264 inruwvobn.exe 2072 indwztgsi.exe 2072 indwztgsi.exe 2544 inldtepix.exe 2544 inldtepix.exe 5760 inbpxnjbw.exe 5760 inbpxnjbw.exe 4696 ingvnhoze.exe 4696 ingvnhoze.exe 3376 intsuvkkg.exe 3376 intsuvkkg.exe 4580 invrckwrg.exe 4580 invrckwrg.exe 988 inixpjqgj.exe 988 inixpjqgj.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 6044 invhwkmle.exe Token: SeDebugPrivilege 2692 inpleqlxa.exe Token: SeDebugPrivilege 1404 inetlfmxc.exe Token: SeDebugPrivilege 3100 inzloqpih.exe Token: SeDebugPrivilege 5624 inqtvunam.exe Token: SeDebugPrivilege 6056 inzvgovkd.exe Token: SeDebugPrivilege 4060 inlsmacbt.exe Token: SeDebugPrivilege 3396 inbqiycju.exe Token: SeDebugPrivilege 4320 indtwnmuu.exe Token: SeDebugPrivilege 4788 inqmfrmyb.exe Token: SeDebugPrivilege 1864 incrjzdkv.exe Token: SeDebugPrivilege 3188 incgzwjvl.exe Token: SeDebugPrivilege 4240 inogwahsa.exe Token: SeDebugPrivilege 2760 inugvjlkd.exe Token: SeDebugPrivilege 6004 inigtklnv.exe Token: SeDebugPrivilege 4744 incanalcr.exe Token: SeDebugPrivilege 2856 inwixlnmf.exe Token: SeDebugPrivilege 4504 innqsrkjz.exe Token: SeDebugPrivilege 1844 indskelwb.exe Token: SeDebugPrivilege 4952 inaikwkwh.exe Token: SeDebugPrivilege 1120 insohtodl.exe Token: SeDebugPrivilege 3464 infumgnyd.exe Token: SeDebugPrivilege 4624 inmprqjiy.exe Token: SeDebugPrivilege 264 inruwvobn.exe Token: SeDebugPrivilege 2072 indwztgsi.exe Token: SeDebugPrivilege 2544 inldtepix.exe Token: SeDebugPrivilege 5760 inbpxnjbw.exe Token: SeDebugPrivilege 4696 ingvnhoze.exe Token: SeDebugPrivilege 3376 intsuvkkg.exe Token: SeDebugPrivilege 4580 invrckwrg.exe Token: SeDebugPrivilege 988 inixpjqgj.exe Token: SeDebugPrivilege 1068 innuocedv.exe Token: SeDebugPrivilege 1764 insezthji.exe Token: SeDebugPrivilege 5636 infslrijv.exe Token: SeDebugPrivilege 5956 injwnoaqy.exe Token: SeDebugPrivilege 5096 inxtemyti.exe Token: SeDebugPrivilege 3444 inyjbrycn.exe Token: SeDebugPrivilege 5152 inoavpdfe.exe Token: SeDebugPrivilege 5488 incvyzsfr.exe Token: SeDebugPrivilege 4248 inlofemzm.exe Token: SeDebugPrivilege 1116 inbaqtkjr.exe Token: SeDebugPrivilege 5784 inxjymong.exe Token: SeDebugPrivilege 6060 inortslka.exe Token: SeDebugPrivilege 4972 inatwyxqd.exe Token: SeDebugPrivilege 2264 ingvetxyk.exe Token: SeDebugPrivilege 4268 inuqbjvqf.exe Token: SeDebugPrivilege 4868 intfuikjc.exe Token: SeDebugPrivilege 5616 injyqkarh.exe Token: SeDebugPrivilege 2244 inwmpgfnn.exe Token: SeDebugPrivilege 924 inbuxzyre.exe Token: SeDebugPrivilege 6020 inykznpoh.exe Token: SeDebugPrivilege 3216 indxawycz.exe Token: SeDebugPrivilege 1532 inbjudnts.exe Token: SeDebugPrivilege 1228 inutvwllh.exe Token: SeDebugPrivilege 2572 incsvmltt.exe Token: SeDebugPrivilege 3636 inxrqyyst.exe Token: SeDebugPrivilege 5852 innlypqcs.exe Token: SeDebugPrivilege 4860 inhfsfaqh.exe Token: SeDebugPrivilege 5180 injhulmow.exe Token: SeDebugPrivilege 5448 insvxwpco.exe Token: SeDebugPrivilege 1092 inaexuhtj.exe Token: SeDebugPrivilege 1500 inghxondz.exe Token: SeDebugPrivilege 1112 inrlmbbts.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe 6044 invhwkmle.exe 2692 inpleqlxa.exe 1404 inetlfmxc.exe 3100 inzloqpih.exe 5624 inqtvunam.exe 6056 inzvgovkd.exe 4060 inlsmacbt.exe 3396 inbqiycju.exe 4320 indtwnmuu.exe 4788 inqmfrmyb.exe 1864 incrjzdkv.exe 3188 incgzwjvl.exe 4240 inogwahsa.exe 2760 inugvjlkd.exe 6004 inigtklnv.exe 4744 incanalcr.exe 2856 inwixlnmf.exe 4504 innqsrkjz.exe 1844 indskelwb.exe 4952 inaikwkwh.exe 1120 insohtodl.exe 3464 infumgnyd.exe 4624 inmprqjiy.exe 264 inruwvobn.exe 2072 indwztgsi.exe 2544 inldtepix.exe 5760 inbpxnjbw.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 6044 4728 2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 6044 wrote to memory of 2692 6044 invhwkmle.exe 90 PID 2692 wrote to memory of 1404 2692 inpleqlxa.exe 91 PID 1404 wrote to memory of 3100 1404 inetlfmxc.exe 92 PID 3100 wrote to memory of 5624 3100 inzloqpih.exe 93 PID 5624 wrote to memory of 6056 5624 inqtvunam.exe 94 PID 6056 wrote to memory of 4060 6056 inzvgovkd.exe 95 PID 4060 wrote to memory of 3396 4060 inlsmacbt.exe 96 PID 3396 wrote to memory of 4320 3396 inbqiycju.exe 97 PID 4320 wrote to memory of 4788 4320 indtwnmuu.exe 98 PID 4788 wrote to memory of 1864 4788 inqmfrmyb.exe 99 PID 1864 wrote to memory of 3188 1864 incrjzdkv.exe 100 PID 3188 wrote to memory of 4240 3188 incgzwjvl.exe 101 PID 4240 wrote to memory of 2760 4240 inogwahsa.exe 102 PID 2760 wrote to memory of 6004 2760 inugvjlkd.exe 103 PID 6004 wrote to memory of 4744 6004 inigtklnv.exe 104 PID 4744 wrote to memory of 2856 4744 incanalcr.exe 105 PID 2856 wrote to memory of 4504 2856 inwixlnmf.exe 106 PID 4504 wrote to memory of 1844 4504 innqsrkjz.exe 107 PID 1844 wrote to memory of 4952 1844 indskelwb.exe 108 PID 4952 wrote to memory of 1120 4952 inaikwkwh.exe 109 PID 1120 wrote to memory of 3464 1120 insohtodl.exe 110 PID 3464 wrote to memory of 4624 3464 infumgnyd.exe 111 PID 4624 wrote to memory of 264 4624 inmprqjiy.exe 112 PID 264 wrote to memory of 2072 264 inruwvobn.exe 113 PID 2072 wrote to memory of 2544 2072 indwztgsi.exe 114 PID 2544 wrote to memory of 5760 2544 inldtepix.exe 115 PID 5760 wrote to memory of 4696 5760 inbpxnjbw.exe 116 PID 4696 wrote to memory of 3376 4696 ingvnhoze.exe 117 PID 3376 wrote to memory of 4580 3376 intsuvkkg.exe 118 PID 4580 wrote to memory of 988 4580 invrckwrg.exe 119 PID 988 wrote to memory of 1068 988 inixpjqgj.exe 120 PID 1068 wrote to memory of 1764 1068 innuocedv.exe 121 PID 1764 wrote to memory of 5636 1764 insezthji.exe 122 PID 5636 wrote to memory of 5956 5636 infslrijv.exe 123 PID 5956 wrote to memory of 5096 5956 injwnoaqy.exe 124 PID 5096 wrote to memory of 3444 5096 inxtemyti.exe 125 PID 3444 wrote to memory of 5152 3444 inyjbrycn.exe 126 PID 5152 wrote to memory of 5488 5152 inoavpdfe.exe 127 PID 5488 wrote to memory of 4248 5488 incvyzsfr.exe 128 PID 4248 wrote to memory of 1116 4248 inlofemzm.exe 129 PID 1116 wrote to memory of 5784 1116 inbaqtkjr.exe 130 PID 5784 wrote to memory of 6060 5784 inxjymong.exe 131 PID 6060 wrote to memory of 4972 6060 inortslka.exe 132 PID 4972 wrote to memory of 2264 4972 inatwyxqd.exe 133 PID 2264 wrote to memory of 4268 2264 ingvetxyk.exe 134 PID 4268 wrote to memory of 4868 4268 inuqbjvqf.exe 135 PID 4868 wrote to memory of 5616 4868 intfuikjc.exe 136 PID 5616 wrote to memory of 2244 5616 injyqkarh.exe 137 PID 2244 wrote to memory of 924 2244 inwmpgfnn.exe 138 PID 924 wrote to memory of 6020 924 inbuxzyre.exe 139 PID 6020 wrote to memory of 3216 6020 inykznpoh.exe 140 PID 3216 wrote to memory of 1532 3216 indxawycz.exe 141 PID 1532 wrote to memory of 1228 1532 inbjudnts.exe 142 PID 1228 wrote to memory of 2572 1228 inutvwllh.exe 143 PID 2572 wrote to memory of 3636 2572 incsvmltt.exe 144 PID 3636 wrote to memory of 5852 3636 inxrqyyst.exe 145 PID 5852 wrote to memory of 4860 5852 innlypqcs.exe 146 PID 4860 wrote to memory of 5180 4860 inhfsfaqh.exe 147 PID 5180 wrote to memory of 5448 5180 injhulmow.exe 148 PID 5448 wrote to memory of 1092 5448 insvxwpco.exe 149 PID 1092 wrote to memory of 1500 1092 inaexuhtj.exe 150 PID 1500 wrote to memory of 1112 1500 inghxondz.exe 151 PID 1112 wrote to memory of 5948 1112 inrlmbbts.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_8aee9950e8976ad20a91f20ce8e5cdd8_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe30⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe37⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe49⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe50⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe60⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\inrlmbbts.exeC:\Windows\system32\inrlmbbts.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe65⤵
- Executes dropped EXE
PID:5948 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe66⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe67⤵
- Drops file in System32 directory
PID:2256 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe68⤵PID:4508
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe69⤵
- System Location Discovery: System Language Discovery
PID:5124 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe70⤵PID:4492
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe71⤵
- Drops file in System32 directory
PID:1436 -
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe72⤵PID:5596
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe73⤵PID:4740
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe74⤵PID:4372
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe75⤵PID:2364
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe76⤵PID:2376
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe77⤵
- System Location Discovery: System Language Discovery
PID:5952 -
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe78⤵PID:5484
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe79⤵PID:2000
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe80⤵
- System Location Discovery: System Language Discovery
PID:6000 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe81⤵PID:2860
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5260 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe83⤵PID:5864
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe84⤵PID:5840
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe85⤵
- System Location Discovery: System Language Discovery
PID:4936 -
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe86⤵PID:5844
-
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe87⤵PID:3044
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5892 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe89⤵PID:2996
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe90⤵PID:2124
-
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe91⤵PID:5724
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe92⤵PID:5764
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe93⤵PID:4416
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe94⤵PID:4768
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe95⤵PID:2792
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe96⤵
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe98⤵PID:1972
-
C:\Windows\SysWOW64\indscwrxb.exeC:\Windows\system32\indscwrxb.exe99⤵
- Drops file in System32 directory
PID:4052 -
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe100⤵PID:3576
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe101⤵PID:5088
-
C:\Windows\SysWOW64\iniizepdz.exeC:\Windows\system32\iniizepdz.exe102⤵PID:4136
-
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe103⤵PID:1724
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe104⤵PID:4736
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe105⤵PID:3404
-
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe106⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe107⤵PID:2784
-
C:\Windows\SysWOW64\invnbgkek.exeC:\Windows\system32\invnbgkek.exe108⤵PID:4584
-
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe109⤵PID:2288
-
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe110⤵PID:1296
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe111⤵PID:4488
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe112⤵
- Drops file in System32 directory
PID:2908 -
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe113⤵PID:1180
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe114⤵
- System Location Discovery: System Language Discovery
PID:3260 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe115⤵PID:548
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe116⤵PID:6084
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe117⤵PID:1516
-
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe118⤵PID:2752
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe119⤵PID:3784
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe120⤵PID:1372
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe121⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-