Analysis
- max time kernel
75s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 19:34
Behavioral task
behavioral1
Sample
2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260930-yaastaytdv
- SHA256 52c84b448bf2b951d52fa2aace3d343630b3eceb343b7d36db9b482ae03ca317
- MD5 70e7034bcc97ad94cb29769170dd3887
- SHA1 42282a75d0cd6904c65cead734de5b1b5c962889
- SHA512 05ca16fea96faf3dff3fc95d10be8d15566209ddd453124ef0996588178004f3f4290e2eb2487859a1d0a0f2151d2fb737ff01e3d200f36560a3bf79e484a063
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTv:RPjOa1NxyYtH1v
- TLSH T18015AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/4648-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c406-20.dat family_gh0strat behavioral2/memory/4648-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c40a-31.dat family_gh0strat behavioral2/files/0x000d00000001c40b-39.dat family_gh0strat behavioral2/memory/4128-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c40f-65.dat family_gh0strat behavioral2/files/0x000d00000001c422-86.dat family_gh0strat behavioral2/memory/3560-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1980-103-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c426-109.dat family_gh0strat behavioral2/memory/4252-114-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5172-136-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c42e-154.dat family_gh0strat behavioral2/files/0x000d00000001c432-176.dat family_gh0strat behavioral2/files/0x000d00000001c43e-242.dat family_gh0strat behavioral2/files/0x000d00000001c442-263.dat family_gh0strat behavioral2/memory/4772-334-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6024-356-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4076-446-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2476-464-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4156-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4440-590-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4832-572-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3848-554-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3300-536-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4896-518-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2140-500-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4056-482-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1568-427-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2732-409-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2088-392-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1068-374-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c45d-352.dat family_gh0strat behavioral2/files/0x000d00000001c459-330.dat family_gh0strat behavioral2/memory/1872-312-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c455-308.dat family_gh0strat behavioral2/memory/5356-290-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c446-286.dat family_gh0strat behavioral2/memory/476-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1216-246-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4372-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c43a-220.dat family_gh0strat behavioral2/files/0x000d00000001c436-201.dat family_gh0strat behavioral2/memory/3108-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/976-180-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5444-158-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c42a-132.dat family_gh0strat behavioral2/memory/4128-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7835D61-867A-4f96-A783-64FBD5BC140D}\stubpath = "C:\\Windows\\system32\\inqgyjlgf.exe" inzavthnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4A0D7E7-8338-4641-A8BB-9A2043946601} inbaqtkjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6054C7EF-6B5D-40e2-ACF9-F578AED1EE53} inionprva.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42EEB333-56C9-4ee4-B55B-0D672D90114A}\stubpath = "C:\\Windows\\system32\\inczeboin.exe" indzyzoqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6478B64-4934-46b9-92B5-528F871948C7}\stubpath = "C:\\Windows\\system32\\inuytzxmg.exe" inrfvkmdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75E702CA-8346-43f4-94E9-874ADE69A5D8}\stubpath = "C:\\Windows\\system32\\inucuflpc.exe" invdmeyvk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27AFD70A-7333-4a85-B3CC-C22E90B62017}\stubpath = "C:\\Windows\\system32\\inijzqpfx.exe" inihodrxd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{13FBB86C-76D0-4ab8-9B70-932DEC03F0BD} infrgispe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7835D61-867A-4f96-A783-64FBD5BC140D} inzavthnp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C78B8D00-10E7-4bfd-B142-52AB50655B70} inuqbjvqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A8CD6A0-DBB8-4a8e-B3FB-D49A45C1F657}\stubpath = "C:\\Windows\\system32\\inbbkvfva.exe" inrhnxdft.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BDC1D294-4B98-4dd0-92BB-58C8BEBD329E}\stubpath = "C:\\Windows\\system32\\injvkjzkm.exe" inmhxsddw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{308460F2-4AE1-4ae2-AAC1-06E66512FC73}\stubpath = "C:\\Windows\\system32\\inowmiavg.exe" inbmmjnwc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3027214-8639-40c4-B295-467C38251CC1} inkesnbrx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A27243CF-1ACD-438c-8C1F-D7A68EC45A3C}\stubpath = "C:\\Windows\\system32\\inuizasnp.exe" ingatvyvf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E3FAB1F-59FA-49b8-BBAE-FAAADA0A147E} inhxamofz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CAD04E3-6BFC-4b1d-B732-077695361125}\stubpath = "C:\\Windows\\system32\\inscqyokc.exe" inzkzjyci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FF2396B-5271-4c1b-AF03-6247683E905B}\stubpath = "C:\\Windows\\system32\\ineuxonvv.exe" inazpsjiq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F6A8B23-30B5-4638-9FE7-219F615D6FEF} insaljfpw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC1A9826-0820-41c1-A21A-31A6FAAE85B0} initcmsrt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2D2354B-05F1-4785-A0A7-D5E7157EF87A} innezahdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{431E9A3E-7F38-4c6d-BED4-B8D7B9E9C5D1}\stubpath = "C:\\Windows\\system32\\inxdmghfn.exe" iniqgcwmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7207FB25-7C0B-4c26-BF8D-30E44E721371}\stubpath = "C:\\Windows\\system32\\invdmeyvk.exe" invlbrhjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C968CFF3-608E-4114-B720-E911A0158F4E}\stubpath = "C:\\Windows\\system32\\inthmqkqb.exe" inqtvunam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A652222F-8D89-4ace-BE8D-F534293EFC6B}\stubpath = "C:\\Windows\\system32\\injhulmow.exe" inyufnzuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{520B1BF2-269B-49a1-BE4C-E4BB5C4B33C5} inrshhzyd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{261BAFA9-ACB7-4ff0-B71C-62D0465EB082}\stubpath = "C:\\Windows\\system32\\inbpxnjbw.exe" inrjcgagg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B24090E0-C280-4f79-965B-CC6915C3EEFD}\stubpath = "C:\\Windows\\system32\\inykmqjhq.exe" ingoxeawx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CB8A357-700B-4a8d-87D6-547EF79CBA77}\stubpath = "C:\\Windows\\system32\\indcsegkx.exe" inaqgiwze.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA7557B7-BD59-411a-A5F3-C3FE26C20D22}\stubpath = "C:\\Windows\\system32\\inctpigdo.exe" inoioprby.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE18C8C4-08D9-4881-8485-AACD51CF2AFC}\stubpath = "C:\\Windows\\system32\\inuvxhdct.exe" inlnqnzon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A603FEE8-7CD4-4e6e-BACD-6086A8BDF856}\stubpath = "C:\\Windows\\system32\\inmkxopbr.exe" intmsjkwc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33859608-C26C-4f64-8576-88B56B2C088B}\stubpath = "C:\\Windows\\system32\\inyufnzuj.exe" inzhuwqpq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C6DF845-DB13-43ef-8EC6-419EBB4EB941} insgwlney.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C5CBDD1-C864-44de-8884-AE78829F2299} inxujybfr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F604C708-7B28-4994-B641-557AEA1676F4}\stubpath = "C:\\Windows\\system32\\inibjtjzf.exe" intidlctm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEC97FF4-B7C5-4307-A564-B2157DB968C6} inmgmynpz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00107714-6A64-4c59-B2F6-0080C98AB88B} invuwaxma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1766F864-67CC-449f-8522-92BE24EFE8BC}\stubpath = "C:\\Windows\\system32\\indskelwb.exe" inqzfhsqg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C6B9D4B-7799-49b2-A9D6-99D9535BD68D} indtfhlye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B33B7B5-F8F9-476b-AA49-8B372C5DD510}\stubpath = "C:\\Windows\\system32\\inrvkfwvq.exe" injbpivej.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07CBDD6A-1217-4821-A11A-CBE60080342D} insfkvqkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2A4A548-BD03-4c96-A76A-FF7F686AC782} inzloqpih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C05AE55-45F4-4d7a-A72F-026F45E55EE2}\stubpath = "C:\\Windows\\system32\\inxitdtqe.exe" inyegrpfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58E450AA-D8FC-4801-86C3-57AF5D576406}\stubpath = "C:\\Windows\\system32\\invzzdxxz.exe" inzjwmbpr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18E31B48-FBE0-4cc5-A9CB-D8351CB63898}\stubpath = "C:\\Windows\\system32\\inzyhfjju.exe" invowdwcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50866383-3DC6-4acc-8336-6E70CA0585CE}\stubpath = "C:\\Windows\\system32\\inhhujgdi.exe" indxighng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBB60F0A-BCFB-4534-8212-11BD6CBFE670} inogxmhdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3D59BD9-2D35-4107-B159-494CC23AA58A}\stubpath = "C:\\Windows\\system32\\inbobfwma.exe" indlvgkyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FEF9F65-3F7D-48ae-B6ED-EB94E2705B76} inwtwqazn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C50F0B8-D4C4-42f7-AE24-F515C242B8B1} inlgisalg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB95C28E-97A4-4c84-BAE0-3C88122782BD}\stubpath = "C:\\Windows\\system32\\inlaxcmgz.exe" inecpcnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D438662-8EEC-4534-AD52-9C405EF733B0} infzicqlp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCD2A6E0-22F1-448a-B0B7-BF5AA21BBCFC}\stubpath = "C:\\Windows\\system32\\inypsuvxw.exe" intchxupt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A06C29EF-4264-4c83-9238-E3AAC51FC1DF} indskelwb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{733A6CD4-43AC-4fa3-A4DC-3654B82E80BB}\stubpath = "C:\\Windows\\system32\\incxuerhz.exe" inbkyszdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE5351EE-637C-4002-97FD-39B4AA7855D8} inoyifzki.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD5FE03A-9E93-4e33-AFAC-12AA80CCCF32} ingfvhjng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF73EF6C-878A-4371-85D4-6D6899686165}\stubpath = "C:\\Windows\\system32\\infyeupzm.exe" inpkuzhdr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCBFD8C3-0F8D-4ae1-986E-2132F3384178}\stubpath = "C:\\Windows\\system32\\iniqgcwmo.exe" intqwjtdz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9BF51928-E706-4ae1-88AE-DC5FCDFA3CF7}\stubpath = "C:\\Windows\\system32\\injflluak.exe" invatpnbv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B10D53AA-84EF-408c-9271-AD5630BF2179} inxtemyti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C6B9D4B-7799-49b2-A9D6-99D9535BD68D}\stubpath = "C:\\Windows\\system32\\inmwcesvx.exe" indtfhlye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06DF5225-0C32-49b3-913C-A69106949AD2} inorbpnrr.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000600000001b85a-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1980 inmeufqjy.exe 4128 inxtemyti.exe 3560 inmtnbdcu.exe 4252 insvxwpco.exe 5172 inaexuhtj.exe 5444 innfvgrkz.exe 976 inbuxzyre.exe 3108 incgzwjvl.exe 4372 inqcxrfhg.exe 1216 indwztgsi.exe 476 inhwnltjf.exe 5356 inrdysgih.exe 1872 inyjbrycn.exe 4772 inoavpdfe.exe 6024 incvyzsfr.exe 1068 inlsmacbt.exe 2088 inyorihpp.exe 2732 invhwkmle.exe 1568 inmprqjiy.exe 4076 incrjzdkv.exe 2476 inhwoipfi.exe 4056 inortslka.exe 2140 inugvjlkd.exe 4896 inzloqpih.exe 3300 inuqbjvqf.exe 3848 inzvgovkd.exe 4832 indhxkwmb.exe 4440 inbqiycju.exe 4156 indtwnmuu.exe 6104 inqmfrmyb.exe 2044 inadbobmd.exe 4540 ingtgabri.exe 2688 inutvwllh.exe 788 inatwyxqd.exe 5552 inbfyviuk.exe 4784 inrngsnzc.exe 4688 intfuikjc.exe 3308 injlxlxig.exe 992 intpaiupe.exe 4236 inasgqvzt.exe 5116 inetlfmxc.exe 4788 injyqkarh.exe 4376 inogwahsa.exe 3416 inbrulkss.exe 2924 inykznpoh.exe 3768 inpsutmlb.exe 3412 inqgdzfrf.exe 4556 inzkcszdo.exe 2516 inaphxbit.exe 4776 inopeewva.exe 5588 inkzrlbas.exe 4672 inljyapnv.exe 4392 inbqostfv.exe 5252 ingvetxyk.exe 3892 inlhzufqa.exe 3856 inmnccutj.exe 3392 intmsjkwc.exe 3680 inmkxopbr.exe 2060 ingvnhoze.exe 5008 innuocedv.exe 2280 inrcangym.exe 5912 inaikwkwh.exe 2904 inzkzjyci.exe 4428 inscqyokc.exe - Loads dropped DLL 64 IoCs
pid Process 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe 1980 inmeufqjy.exe 1980 inmeufqjy.exe 4128 inxtemyti.exe 4128 inxtemyti.exe 3560 inmtnbdcu.exe 3560 inmtnbdcu.exe 4252 insvxwpco.exe 4252 insvxwpco.exe 5172 inaexuhtj.exe 5172 inaexuhtj.exe 5444 innfvgrkz.exe 5444 innfvgrkz.exe 976 inbuxzyre.exe 976 inbuxzyre.exe 3108 incgzwjvl.exe 3108 incgzwjvl.exe 4372 inqcxrfhg.exe 4372 inqcxrfhg.exe 1216 indwztgsi.exe 1216 indwztgsi.exe 476 inhwnltjf.exe 476 inhwnltjf.exe 5356 inrdysgih.exe 5356 inrdysgih.exe 1872 inyjbrycn.exe 1872 inyjbrycn.exe 4772 inoavpdfe.exe 4772 inoavpdfe.exe 6024 incvyzsfr.exe 6024 incvyzsfr.exe 1068 inlsmacbt.exe 1068 inlsmacbt.exe 2088 inyorihpp.exe 2088 inyorihpp.exe 2732 invhwkmle.exe 2732 invhwkmle.exe 1568 inmprqjiy.exe 1568 inmprqjiy.exe 4076 incrjzdkv.exe 4076 incrjzdkv.exe 2476 inhwoipfi.exe 2476 inhwoipfi.exe 4056 inortslka.exe 4056 inortslka.exe 2140 inugvjlkd.exe 2140 inugvjlkd.exe 4896 inzloqpih.exe 4896 inzloqpih.exe 3300 inuqbjvqf.exe 3300 inuqbjvqf.exe 3848 inzvgovkd.exe 3848 inzvgovkd.exe 4832 indhxkwmb.exe 4832 indhxkwmb.exe 4440 inbqiycju.exe 4440 inbqiycju.exe 4156 indtwnmuu.exe 4156 indtwnmuu.exe 6104 inqmfrmyb.exe 6104 inqmfrmyb.exe 2044 inadbobmd.exe 2044 inadbobmd.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ingvnhoze.exe_lang.ini inmkxopbr.exe File created C:\Windows\SysWOW64\intcrvwiy.exe inbjwysrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injqftzfq.exe File opened for modification C:\Windows\SysWOW64\inbmyhvlc.exe_lang.ini inmjhdsul.exe File opened for modification C:\Windows\SysWOW64\injfdlthy.exe_lang.ini inczogbkc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invatpnbv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injdwyyif.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhhsffsh.exe File opened for modification C:\Windows\SysWOW64\inikojpnc.exe_lang.ini inuytzxmg.exe File opened for modification C:\Windows\SysWOW64\indskelwb.exe_lang.ini inqzfhsqg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indbxwxmz.exe File created C:\Windows\SysWOW64\inucuflpc.exe invdmeyvk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insezthji.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineupaato.exe File opened for modification C:\Windows\SysWOW64\invspsmvj.exe_lang.ini inwemzvcu.exe File created C:\Windows\SysWOW64\indxighng.exe innoaemue.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineeenyiy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbuzcxoc.exe File created C:\Windows\SysWOW64\inqjpgzht.exe inckxztas.exe File opened for modification C:\Windows\SysWOW64\inzrcejxv.exe_lang.ini inpriaela.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrngsnzc.exe File opened for modification C:\Windows\SysWOW64\inumafjdj.exe_lang.ini inhzpfbvl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infmbpvbz.exe File opened for modification C:\Windows\SysWOW64\inkivmnpx.exe_lang.ini inhjvjvge.exe File opened for modification C:\Windows\SysWOW64\invmdukgq.exe_lang.ini insaljfpw.exe File opened for modification C:\Windows\SysWOW64\injrhdzvq.exe_lang.ini incraptug.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inktbmkag.exe File opened for modification C:\Windows\SysWOW64\invlhtipl.exe_lang.ini inotqnqky.exe File created C:\Windows\SysWOW64\injwbpnkv.exe inhhujgdi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlnqnzon.exe File created C:\Windows\SysWOW64\invlbrhjx.exe inucxmxol.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injzuzsez.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbmkzbqa.exe File created C:\Windows\SysWOW64\inowqgwxz.exe inipelkjl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intuwvzao.exe File created C:\Windows\SysWOW64\infdqdofu.exe inqnbrgit.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaqceivb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwemzvcu.exe File opened for modification C:\Windows\SysWOW64\inazojdaz.exe_lang.ini inenraymu.exe File created C:\Windows\SysWOW64\inatwyxqd.exe inutvwllh.exe File created C:\Windows\SysWOW64\insavkvmj.exe inbhrywnq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyufnzuj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhomdgwi.exe File created C:\Windows\SysWOW64\indtfhlye.exe inuloqrtx.exe File opened for modification C:\Windows\SysWOW64\ingugrwmi.exe_lang.ini inqxvmprs.exe File opened for modification C:\Windows\SysWOW64\innezovdr.exe_lang.ini inucuflpc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indwztgsi.exe File created C:\Windows\SysWOW64\intsuvkkg.exe inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlifzicq.exe File created C:\Windows\SysWOW64\inuhmcksg.exe injavkrnv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infmbihgy.exe File opened for modification C:\Windows\SysWOW64\intndtuwg.exe_lang.ini inivlaoql.exe File created C:\Windows\SysWOW64\inrvqwujd.exe incbzwztd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjwysrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infhthtec.exe File created C:\Windows\SysWOW64\inxuxrboe.exe inoropope.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkdbjsnc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innqaomqq.exe File opened for modification C:\Windows\SysWOW64\innxkgbub.exe_lang.ini inxujybfr.exe File created C:\Windows\SysWOW64\invnbgkek.exe inahuhbcs.exe File opened for modification C:\Windows\SysWOW64\inpljrdzf.exe_lang.ini insavkvmj.exe File created C:\Windows\SysWOW64\inivxkbyw.exe innbxlquo.exe File opened for modification C:\Windows\SysWOW64\invwyxcqk.exe_lang.ini inddmxhxc.exe File created C:\Windows\SysWOW64\inzolinkh.exe intwamnoz.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoxdfqoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogxmhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwemzvcu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inctpigdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inindltah.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhrmfavc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlnqnzon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbzwztd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuzcxoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhxjlpig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgaoyjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmlwcerc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inluxxpmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztjzmib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwezqep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmibthrw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqdmufdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqxvmprs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innptoush.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invdmeyvk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlubyhti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkcszdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowmiavg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invshckbs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmrhdpxe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhpjpqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuknjca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inortslka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbrulkss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxsdoolp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuloqrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inarenvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgisalg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insahbdsg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpljrdzf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkzjyci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indbxwxmz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbrdfjw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwskdhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inazojdaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzwrvbus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaikwkwh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbaqtkjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injbpivej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuisngbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invatpnbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlvgkyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvqvoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inesqmezb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtkzjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuydrpyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indqsmlmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfbqsjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniucjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innfajbav.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztkqidm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbbkvfva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingatvyvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhhujgdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inamdunku.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe 1980 inmeufqjy.exe 1980 inmeufqjy.exe 4128 inxtemyti.exe 4128 inxtemyti.exe 3560 inmtnbdcu.exe 3560 inmtnbdcu.exe 4252 insvxwpco.exe 4252 insvxwpco.exe 5172 inaexuhtj.exe 5172 inaexuhtj.exe 5444 innfvgrkz.exe 5444 innfvgrkz.exe 976 inbuxzyre.exe 976 inbuxzyre.exe 3108 incgzwjvl.exe 3108 incgzwjvl.exe 4372 inqcxrfhg.exe 4372 inqcxrfhg.exe 1216 indwztgsi.exe 1216 indwztgsi.exe 476 inhwnltjf.exe 476 inhwnltjf.exe 5356 inrdysgih.exe 5356 inrdysgih.exe 1872 inyjbrycn.exe 1872 inyjbrycn.exe 4772 inoavpdfe.exe 4772 inoavpdfe.exe 6024 incvyzsfr.exe 6024 incvyzsfr.exe 1068 inlsmacbt.exe 1068 inlsmacbt.exe 2088 inyorihpp.exe 2088 inyorihpp.exe 2732 invhwkmle.exe 2732 invhwkmle.exe 1568 inmprqjiy.exe 1568 inmprqjiy.exe 4076 incrjzdkv.exe 4076 incrjzdkv.exe 2476 inhwoipfi.exe 2476 inhwoipfi.exe 4056 inortslka.exe 4056 inortslka.exe 2140 inugvjlkd.exe 2140 inugvjlkd.exe 4896 inzloqpih.exe 4896 inzloqpih.exe 3300 inuqbjvqf.exe 3300 inuqbjvqf.exe 3848 inzvgovkd.exe 3848 inzvgovkd.exe 4832 indhxkwmb.exe 4832 indhxkwmb.exe 4440 inbqiycju.exe 4440 inbqiycju.exe 4156 indtwnmuu.exe 4156 indtwnmuu.exe 6104 inqmfrmyb.exe 6104 inqmfrmyb.exe 2044 inadbobmd.exe 2044 inadbobmd.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 1980 inmeufqjy.exe Token: SeDebugPrivilege 4128 inxtemyti.exe Token: SeDebugPrivilege 3560 inmtnbdcu.exe Token: SeDebugPrivilege 4252 insvxwpco.exe Token: SeDebugPrivilege 5172 inaexuhtj.exe Token: SeDebugPrivilege 5444 innfvgrkz.exe Token: SeDebugPrivilege 976 inbuxzyre.exe Token: SeDebugPrivilege 3108 incgzwjvl.exe Token: SeDebugPrivilege 4372 inqcxrfhg.exe Token: SeDebugPrivilege 1216 indwztgsi.exe Token: SeDebugPrivilege 476 inhwnltjf.exe Token: SeDebugPrivilege 5356 inrdysgih.exe Token: SeDebugPrivilege 1872 inyjbrycn.exe Token: SeDebugPrivilege 4772 inoavpdfe.exe Token: SeDebugPrivilege 6024 incvyzsfr.exe Token: SeDebugPrivilege 1068 inlsmacbt.exe Token: SeDebugPrivilege 2088 inyorihpp.exe Token: SeDebugPrivilege 2732 invhwkmle.exe Token: SeDebugPrivilege 1568 inmprqjiy.exe Token: SeDebugPrivilege 4076 incrjzdkv.exe Token: SeDebugPrivilege 2476 inhwoipfi.exe Token: SeDebugPrivilege 4056 inortslka.exe Token: SeDebugPrivilege 2140 inugvjlkd.exe Token: SeDebugPrivilege 4896 inzloqpih.exe Token: SeDebugPrivilege 3300 inuqbjvqf.exe Token: SeDebugPrivilege 3848 inzvgovkd.exe Token: SeDebugPrivilege 4832 indhxkwmb.exe Token: SeDebugPrivilege 4440 inbqiycju.exe Token: SeDebugPrivilege 4156 indtwnmuu.exe Token: SeDebugPrivilege 6104 inqmfrmyb.exe Token: SeDebugPrivilege 2044 inadbobmd.exe Token: SeDebugPrivilege 4540 ingtgabri.exe Token: SeDebugPrivilege 2688 inutvwllh.exe Token: SeDebugPrivilege 788 inatwyxqd.exe Token: SeDebugPrivilege 5552 inbfyviuk.exe Token: SeDebugPrivilege 4784 inrngsnzc.exe Token: SeDebugPrivilege 4688 intfuikjc.exe Token: SeDebugPrivilege 3308 injlxlxig.exe Token: SeDebugPrivilege 992 intpaiupe.exe Token: SeDebugPrivilege 4236 inasgqvzt.exe Token: SeDebugPrivilege 5116 inetlfmxc.exe Token: SeDebugPrivilege 4788 injyqkarh.exe Token: SeDebugPrivilege 4376 inogwahsa.exe Token: SeDebugPrivilege 3416 inbrulkss.exe Token: SeDebugPrivilege 2924 inykznpoh.exe Token: SeDebugPrivilege 3768 inpsutmlb.exe Token: SeDebugPrivilege 3412 inqgdzfrf.exe Token: SeDebugPrivilege 4556 inzkcszdo.exe Token: SeDebugPrivilege 2516 inaphxbit.exe Token: SeDebugPrivilege 4776 inopeewva.exe Token: SeDebugPrivilege 5588 inkzrlbas.exe Token: SeDebugPrivilege 4672 inljyapnv.exe Token: SeDebugPrivilege 4392 inbqostfv.exe Token: SeDebugPrivilege 5252 ingvetxyk.exe Token: SeDebugPrivilege 3892 inlhzufqa.exe Token: SeDebugPrivilege 3856 inmnccutj.exe Token: SeDebugPrivilege 3392 intmsjkwc.exe Token: SeDebugPrivilege 3680 inmkxopbr.exe Token: SeDebugPrivilege 2060 ingvnhoze.exe Token: SeDebugPrivilege 5008 innuocedv.exe Token: SeDebugPrivilege 2280 inrcangym.exe Token: SeDebugPrivilege 5912 inaikwkwh.exe Token: SeDebugPrivilege 2904 inzkzjyci.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe 1980 inmeufqjy.exe 4128 inxtemyti.exe 3560 inmtnbdcu.exe 4252 insvxwpco.exe 5172 inaexuhtj.exe 5444 innfvgrkz.exe 976 inbuxzyre.exe 3108 incgzwjvl.exe 4372 inqcxrfhg.exe 1216 indwztgsi.exe 476 inhwnltjf.exe 5356 inrdysgih.exe 1872 inyjbrycn.exe 4772 inoavpdfe.exe 6024 incvyzsfr.exe 1068 inlsmacbt.exe 2088 inyorihpp.exe 2732 invhwkmle.exe 1568 inmprqjiy.exe 4076 incrjzdkv.exe 2476 inhwoipfi.exe 4056 inortslka.exe 2140 inugvjlkd.exe 4896 inzloqpih.exe 3300 inuqbjvqf.exe 3848 inzvgovkd.exe 4832 indhxkwmb.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 1980 4648 2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe 88 PID 1980 wrote to memory of 4128 1980 inmeufqjy.exe 89 PID 4128 wrote to memory of 3560 4128 inxtemyti.exe 90 PID 3560 wrote to memory of 4252 3560 inmtnbdcu.exe 91 PID 4252 wrote to memory of 5172 4252 insvxwpco.exe 92 PID 5172 wrote to memory of 5444 5172 inaexuhtj.exe 93 PID 5444 wrote to memory of 976 5444 innfvgrkz.exe 94 PID 976 wrote to memory of 3108 976 inbuxzyre.exe 95 PID 3108 wrote to memory of 4372 3108 incgzwjvl.exe 96 PID 4372 wrote to memory of 1216 4372 inqcxrfhg.exe 97 PID 1216 wrote to memory of 476 1216 indwztgsi.exe 98 PID 476 wrote to memory of 5356 476 inhwnltjf.exe 99 PID 5356 wrote to memory of 1872 5356 inrdysgih.exe 100 PID 1872 wrote to memory of 4772 1872 inyjbrycn.exe 101 PID 4772 wrote to memory of 6024 4772 inoavpdfe.exe 102 PID 6024 wrote to memory of 1068 6024 incvyzsfr.exe 103 PID 1068 wrote to memory of 2088 1068 inlsmacbt.exe 104 PID 2088 wrote to memory of 2732 2088 inyorihpp.exe 105 PID 2732 wrote to memory of 1568 2732 invhwkmle.exe 106 PID 1568 wrote to memory of 4076 1568 inmprqjiy.exe 107 PID 4076 wrote to memory of 2476 4076 incrjzdkv.exe 108 PID 2476 wrote to memory of 4056 2476 inhwoipfi.exe 109 PID 4056 wrote to memory of 2140 4056 inortslka.exe 110 PID 2140 wrote to memory of 4896 2140 inugvjlkd.exe 111 PID 4896 wrote to memory of 3300 4896 inzloqpih.exe 112 PID 3300 wrote to memory of 3848 3300 inuqbjvqf.exe 113 PID 3848 wrote to memory of 4832 3848 inzvgovkd.exe 114 PID 4832 wrote to memory of 4440 4832 indhxkwmb.exe 115 PID 4440 wrote to memory of 4156 4440 inbqiycju.exe 116 PID 4156 wrote to memory of 6104 4156 indtwnmuu.exe 117 PID 6104 wrote to memory of 2044 6104 inqmfrmyb.exe 118 PID 2044 wrote to memory of 4540 2044 inadbobmd.exe 119 PID 4540 wrote to memory of 2688 4540 ingtgabri.exe 120 PID 2688 wrote to memory of 788 2688 inutvwllh.exe 121 PID 788 wrote to memory of 5552 788 inatwyxqd.exe 122 PID 5552 wrote to memory of 4784 5552 inbfyviuk.exe 123 PID 4784 wrote to memory of 4688 4784 inrngsnzc.exe 124 PID 4688 wrote to memory of 3308 4688 intfuikjc.exe 125 PID 3308 wrote to memory of 992 3308 injlxlxig.exe 127 PID 992 wrote to memory of 4236 992 intpaiupe.exe 128 PID 4236 wrote to memory of 5116 4236 inasgqvzt.exe 129 PID 5116 wrote to memory of 4788 5116 inetlfmxc.exe 130 PID 4788 wrote to memory of 4376 4788 injyqkarh.exe 131 PID 4376 wrote to memory of 3416 4376 inogwahsa.exe 132 PID 3416 wrote to memory of 2924 3416 inbrulkss.exe 133 PID 2924 wrote to memory of 3768 2924 inykznpoh.exe 134 PID 3768 wrote to memory of 3412 3768 inpsutmlb.exe 135 PID 3412 wrote to memory of 4556 3412 inqgdzfrf.exe 136 PID 4556 wrote to memory of 2516 4556 inzkcszdo.exe 137 PID 2516 wrote to memory of 4776 2516 inaphxbit.exe 138 PID 4776 wrote to memory of 5588 4776 inopeewva.exe 139 PID 5588 wrote to memory of 4672 5588 inkzrlbas.exe 140 PID 4672 wrote to memory of 4392 4672 inljyapnv.exe 141 PID 4392 wrote to memory of 5252 4392 inbqostfv.exe 142 PID 5252 wrote to memory of 3892 5252 ingvetxyk.exe 143 PID 3892 wrote to memory of 3856 3892 inlhzufqa.exe 144 PID 3856 wrote to memory of 3392 3856 inmnccutj.exe 145 PID 3392 wrote to memory of 3680 3392 intmsjkwc.exe 146 PID 3680 wrote to memory of 2060 3680 inmkxopbr.exe 147 PID 2060 wrote to memory of 5008 2060 ingvnhoze.exe 148 PID 5008 wrote to memory of 2280 5008 innuocedv.exe 149 PID 2280 wrote to memory of 5912 2280 inrcangym.exe 150 PID 5912 wrote to memory of 2904 5912 inaikwkwh.exe 151 PID 2904 wrote to memory of 4428 2904 inzkzjyci.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_70e7034bcc97ad94cb29769170dd3887_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe25⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe26⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\intmsjkwc.exeC:\Windows\system32\intmsjkwc.exe58⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\inzkzjyci.exeC:\Windows\system32\inzkzjyci.exe64⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe65⤵
- Executes dropped EXE
PID:4428 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe66⤵PID:5648
-
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe67⤵PID:3288
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe68⤵PID:4904
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe69⤵PID:820
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe70⤵PID:4280
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe71⤵PID:1900
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe72⤵
- System Location Discovery: System Language Discovery
PID:996 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe73⤵
- System Location Discovery: System Language Discovery
PID:3820 -
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe74⤵
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe75⤵PID:1144
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe76⤵
- Drops file in System32 directory
PID:1828 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe77⤵PID:2680
-
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe78⤵PID:576
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe79⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5940 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe80⤵PID:2408
-
C:\Windows\SysWOW64\inkveoutv.exeC:\Windows\system32\inkveoutv.exe81⤵PID:5644
-
C:\Windows\SysWOW64\inzhuwqpq.exeC:\Windows\system32\inzhuwqpq.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2444 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe83⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:3324 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe84⤵PID:1364
-
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe85⤵
- Drops file in System32 directory
PID:4112 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe86⤵PID:4068
-
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe87⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3296 -
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe88⤵PID:4224
-
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe89⤵PID:5468
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe90⤵PID:6052
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe91⤵PID:5828
-
C:\Windows\SysWOW64\inxgusiod.exeC:\Windows\system32\inxgusiod.exe92⤵PID:4684
-
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe93⤵PID:4412
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe94⤵PID:2020
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe95⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Windows\SysWOW64\inrmslxzd.exeC:\Windows\system32\inrmslxzd.exe96⤵PID:3336
-
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe97⤵PID:2252
-
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe98⤵PID:5100
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe99⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3512 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe100⤵PID:3088
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe101⤵PID:560
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe102⤵PID:5848
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe103⤵PID:1060
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe104⤵PID:2840
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe105⤵PID:1000
-
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe106⤵PID:3440
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe107⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe108⤵PID:1480
-
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe109⤵PID:2108
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe110⤵PID:2052
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe111⤵PID:988
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe112⤵PID:5820
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe113⤵
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe114⤵PID:2704
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe115⤵PID:1140
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe116⤵PID:4088
-
C:\Windows\SysWOW64\invbdruwx.exeC:\Windows\system32\invbdruwx.exe117⤵PID:4952
-
C:\Windows\SysWOW64\inrlmbbts.exeC:\Windows\system32\inrlmbbts.exe118⤵PID:4520
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe119⤵PID:1604
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe120⤵PID:3628
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe121⤵PID:3252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-