Analysis
- max time kernel
75s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 10:31
Behavioral task
behavioral1
Sample
2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261002-mkf7sswhrd
- SHA256 94dec071c9e50330ec6d742727f95e2cd196acf22156e9efd411cadec3b8516e
- MD5 7f8bfbcb4e2a3ee553567f4fa8453638
- SHA1 6ef0d807722e79d1eca2f4894c5df092146b5187
- SHA512 04935f66fd9fd19eedce9670306c04279e6bd286ddaa384243bdfc66a2581d779820c8ffef70df8121fa8d8042d9b1996a5410b4434c1ba7dbecf1968600c1c0
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT/:RPjOa1NxyYtH1/
- TLSH T11E15AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/4604-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c518-13.dat family_gh0strat behavioral2/files/0x000d00000001c51c-19.dat family_gh0strat behavioral2/memory/4604-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c522-36.dat family_gh0strat behavioral2/memory/4512-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c527-63.dat family_gh0strat behavioral2/memory/788-66-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c52b-86.dat family_gh0strat behavioral2/files/0x000d00000001c52e-107.dat family_gh0strat behavioral2/files/0x000d00000001c53a-172.dat family_gh0strat behavioral2/files/0x000d00000001c55d-284.dat family_gh0strat behavioral2/memory/4304-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4460-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6100-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2928-624-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3276-587-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1880-569-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2664-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5496-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4192-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/824-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2760-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3220-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4552-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4784-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3692-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2052-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c569-350.dat family_gh0strat behavioral2/memory/5216-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c565-328.dat family_gh0strat behavioral2/memory/2472-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c561-306.dat family_gh0strat behavioral2/memory/2040-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5640-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c559-262.dat family_gh0strat behavioral2/memory/3620-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c555-240.dat family_gh0strat behavioral2/memory/1944-221-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c542-218.dat family_gh0strat behavioral2/memory/3100-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c53e-195.dat family_gh0strat behavioral2/memory/1352-177-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4532-155-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c536-151.dat family_gh0strat behavioral2/memory/400-133-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c532-129.dat family_gh0strat behavioral2/memory/2416-111-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2492-89-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F53EB579-7516-464c-86DF-919E6FC865F2}\stubpath = "C:\\Windows\\system32\\ingwobgus.exe" inckekwln.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29759E3F-4A78-4f3c-901C-E2CCCF711B2B}\stubpath = "C:\\Windows\\system32\\invhwkmle.exe" injwnoaqy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E526A7B2-0E5B-4e81-999E-10A5D1FEFE0B}\stubpath = "C:\\Windows\\system32\\inortslka.exe" ingoxeawx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5680F0AD-3824-43c4-9717-38373EF3C2EC}\stubpath = "C:\\Windows\\system32\\invnbgkek.exe" incgncjih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{762F8541-325E-486b-8F7D-DA983325ECB4}\stubpath = "C:\\Windows\\system32\\inniyteex.exe" inrfpuysy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30644DE1-1183-4b6f-8234-441008E534E0}\stubpath = "C:\\Windows\\system32\\inktojpiu.exe" inixpjqgj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{813D160D-2913-4f65-B080-D8DEB1D52383} inhzrfkoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3508F7E6-CE6A-4721-8117-D3A3D7792603} inodqsvft.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE9D8E44-9C64-4f35-86EC-249737CEA2E1} inquussur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3CCF86C-14E1-4dca-B9A9-101C6F4C798D}\stubpath = "C:\\Windows\\system32\\inrcscxou.exe" iniszaxor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9782E6A-9650-4a77-BD33-DFAF131FB148} injmdckxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5E19E55-1FD5-47be-BE63-251300CA8536} inzkcszdo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C7C1431-4E40-4a8a-BC75-51ECDE7FF08F}\stubpath = "C:\\Windows\\system32\\inqzfhsqg.exe" ingvnhoze.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0DE22C0-84B1-436e-8195-3282FF11EC2B}\stubpath = "C:\\Windows\\system32\\infhrodsv.exe" inkwblfyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCD1B513-AC01-49b2-94E2-F91B0488CB8E} inucuflpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D96B2C6E-CABB-4b92-A636-84303C9334E2}\stubpath = "C:\\Windows\\system32\\inxtemyti.exe" inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7560508-D1F1-49c5-BC83-4ABAE03B2414}\stubpath = "C:\\Windows\\system32\\intuwvzao.exe" inrcscxou.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8519EE8-3E43-40c7-8D5F-593790E4DE7F} inmgmynpz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{209719CA-D0EC-4bc0-BBDD-A11132E48BFC}\stubpath = "C:\\Windows\\system32\\inlsmacbt.exe" inqgdzfrf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60B80B30-5AD3-45e2-B0C0-BAE2E255ADC0}\stubpath = "C:\\Windows\\system32\\inknedlyl.exe" intcrvwiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C50FE55-4A4A-427e-8D2F-8629E2A2AF3E}\stubpath = "C:\\Windows\\system32\\iniizepdz.exe" inpkvggzd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{255AF6F0-3634-4cb7-8EF9-9B0E7DE636CB} inqklaasr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5EE0E15-ADEA-433c-AB67-C0EBF0C6BBB3}\stubpath = "C:\\Windows\\system32\\inhzpfbvl.exe" inljswfrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1F3CE28-D2BF-4ec4-BDC0-64A2F5DA17D8} incvdypdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45149580-F2BC-477b-842A-86EA94DD31CF} inpleqlxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0BE0598-1C14-4d14-A1A2-37864BF191E6}\stubpath = "C:\\Windows\\system32\\inipelkjl.exe" indzyzoqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{530F36A6-339A-4b2a-ACEA-F112E6890A98}\stubpath = "C:\\Windows\\system32\\inkmpmynm.exe" inokiqcye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0DE22C0-84B1-436e-8195-3282FF11EC2B} inkwblfyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5650B4C1-C262-4ad4-BC9A-5B086F0AE27E} inlmnyysj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53F82A02-E73C-4d40-902E-05CC0D1EB8B3}\stubpath = "C:\\Windows\\system32\\inckekwln.exe" inhfnbzwf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86180EB2-935D-464b-8781-E8C3838F513E} inbuxzyre.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{57F4945B-3771-4be8-9A32-B84687885D1C}\stubpath = "C:\\Windows\\system32\\inlgphgbd.exe" inlhpjpqs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E8A3608-E210-4dd7-8869-B4F97CE4977B}\stubpath = "C:\\Windows\\system32\\inwyzbftn.exe" inueaqidm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{787D4E1E-B56E-4c74-BABF-62E2D13E48C3} inhwnltjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{054A1435-705F-4f23-8B17-8C6C5C92205A}\stubpath = "C:\\Windows\\system32\\inixpjqgj.exe" inbsfowhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21F41267-BF63-499f-9CCB-D0ED9902440A} inwanaevl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D66DDA38-2772-43f8-82D3-FAD7E61B5049}\stubpath = "C:\\Windows\\system32\\inufueytz.exe" inalzlawr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82A2A76D-5A18-4e1b-A1EF-F4134406920D}\stubpath = "C:\\Windows\\system32\\indtkzjxv.exe" inrdysgih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5399E9F-F249-4b45-A0C9-8CF309DED087} inipelkjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BBE4ACC-8D8C-43fd-BA26-623ABBD372AE}\stubpath = "C:\\Windows\\system32\\insbznvcp.exe" insaljfpw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A134E440-2A5A-4ebd-9FD6-931925450E1E} ineamubie.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C670E360-8111-4e48-82B8-A653B587C83B} indryibnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2A704C6F-72F7-4829-8C66-DB3CAE830A95}\stubpath = "C:\\Windows\\system32\\intbosajb.exe" inisucehe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3D3B3D14-06F6-4b0e-881D-97836842AEFF} inlgphgbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24793E2F-2ED1-468f-8DAE-36BE7F7A6735} inwsdlxsh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4EFC919-E1C1-4889-9B75-5F32A70E005C} inatybwnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F90E24B-0B2A-401c-8D24-BE87DDEF4620}\stubpath = "C:\\Windows\\system32\\inochlfll.exe" inligcrtk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E995BF8-93C1-4d4a-80A0-DC19141D70C5}\stubpath = "C:\\Windows\\system32\\inycopaqa.exe" inahuhbcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D444FA93-E495-42aa-99AC-7DC913128CE9}\stubpath = "C:\\Windows\\system32\\innptoush.exe" inirmhzng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CBCAB4A-1A6F-4643-9EDE-33DC9949BB8D}\stubpath = "C:\\Windows\\system32\\ineupaato.exe" inmjhdsul.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5935B980-7191-4ab7-A785-C12B00DA7462} indcsegkx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{397C64AF-FC92-4c35-BB8F-1E9258D14CC2} ingtgabri.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFB62B41-E1B1-4afd-B15F-9AF1A95CE60C}\stubpath = "C:\\Windows\\system32\\inrxixhwa.exe" inyufnzuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27A8A785-D90A-40d3-82ED-B2DE462210FF}\stubpath = "C:\\Windows\\system32\\inbuzcxoc.exe" insacfcod.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5AFEA21-3FA1-4f23-B148-3E4E96A1A033} inkietvme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5AFEA21-3FA1-4f23-B148-3E4E96A1A033}\stubpath = "C:\\Windows\\system32\\inljswfrz.exe" inkietvme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0BBEBAF-0DA3-4b08-BE3D-9969E65FB988}\stubpath = "C:\\Windows\\system32\\inqgdzfrf.exe" inoavpdfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{522DDA1F-DDAF-413b-9DFC-F2B501653400} inqjpgzht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42ABCD6E-1663-4a07-8AEC-4887D7EBBB4F}\stubpath = "C:\\Windows\\system32\\inrngsnzc.exe" indvjzcoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E6EB049-0BF5-469b-A86A-980268249F0C}\stubpath = "C:\\Windows\\system32\\inenraymu.exe" ingtjmoji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32598AEB-B54E-4f91-81AD-BC34BEA0062E} inngbnczn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3ACF9F37-6DE6-4016-A540-0E624C467037}\stubpath = "C:\\Windows\\system32\\inpsutmlb.exe" invdmeyvk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7CBB1DB-5E41-4466-ADFD-12CB46B2B9F2}\stubpath = "C:\\Windows\\system32\\inczeboin.exe" inacgtgkr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE2223DF-B803-457e-A6B5-4E8AB650250B}\stubpath = "C:\\Windows\\system32\\ingtjmoji.exe" inbobfwma.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000019cb7-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4512 insohtodl.exe 788 inmtnbdcu.exe 2492 inugvjlkd.exe 2416 inwsdlxsh.exe 400 indhxkwmb.exe 4532 inqcxrfhg.exe 1352 inwhpwale.exe 3100 innuocedv.exe 1944 inbuxzyre.exe 3620 inmprqjiy.exe 5640 inatwyxqd.exe 2040 injyqkarh.exe 2472 inbqiycju.exe 5216 inaexuhtj.exe 2052 inoavpdfe.exe 3692 inqgdzfrf.exe 4784 inlsmacbt.exe 4552 inruwvobn.exe 3220 intcrvwiy.exe 4304 inknedlyl.exe 2760 inpfzcyeq.exe 824 inkbaivic.exe 4192 incanalcr.exe 4460 ingiuiufd.exe 5496 inqmfrmyb.exe 2664 indskelwb.exe 1880 inykznpoh.exe 3276 injwnoaqy.exe 6100 invhwkmle.exe 2928 inpleqlxa.exe 6008 inuqbjvqf.exe 3968 inyjbrycn.exe 6032 inqtvunam.exe 2260 inzvgovkd.exe 5360 innqsrkjz.exe 3980 inecpcnet.exe 5188 incgzwjvl.exe 4556 inaphxbit.exe 3136 ingoxeawx.exe 4760 inortslka.exe 2068 inxtemyti.exe 1088 inzloqpih.exe 5328 inbpxnjbw.exe 2220 inxiaqxbm.exe 4876 intpaiupe.exe 3372 indtwnmuu.exe 4444 inmeufqjy.exe 1184 inopeewva.exe 120 infgwnmcy.exe 8 inetlfmxc.exe 5724 inldtepix.exe 896 inlvjosms.exe 4108 inbmkzbqa.exe 2292 inhwoipfi.exe 2204 ingtvpopk.exe 3520 infdqdofu.exe 5020 ingvzmksi.exe 1672 incvyzsfr.exe 1688 injhulmow.exe 4340 intfuikjc.exe 6040 inaikwkwh.exe 2112 invrckwrg.exe 5012 inxjymong.exe 2796 infvqbbup.exe - Loads dropped DLL 64 IoCs
pid Process 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe 4512 insohtodl.exe 4512 insohtodl.exe 788 inmtnbdcu.exe 788 inmtnbdcu.exe 2492 inugvjlkd.exe 2492 inugvjlkd.exe 2416 inwsdlxsh.exe 2416 inwsdlxsh.exe 400 indhxkwmb.exe 400 indhxkwmb.exe 4532 inqcxrfhg.exe 4532 inqcxrfhg.exe 1352 inwhpwale.exe 1352 inwhpwale.exe 3100 innuocedv.exe 3100 innuocedv.exe 1944 inbuxzyre.exe 1944 inbuxzyre.exe 3620 inmprqjiy.exe 3620 inmprqjiy.exe 5640 inatwyxqd.exe 5640 inatwyxqd.exe 2040 injyqkarh.exe 2040 injyqkarh.exe 2472 inbqiycju.exe 2472 inbqiycju.exe 5216 inaexuhtj.exe 5216 inaexuhtj.exe 2052 inoavpdfe.exe 2052 inoavpdfe.exe 3692 inqgdzfrf.exe 3692 inqgdzfrf.exe 4784 inlsmacbt.exe 4784 inlsmacbt.exe 4552 inruwvobn.exe 4552 inruwvobn.exe 3220 intcrvwiy.exe 3220 intcrvwiy.exe 4304 inknedlyl.exe 4304 inknedlyl.exe 2760 inpfzcyeq.exe 2760 inpfzcyeq.exe 824 inkbaivic.exe 824 inkbaivic.exe 4192 incanalcr.exe 4192 incanalcr.exe 4460 ingiuiufd.exe 4460 ingiuiufd.exe 5496 inqmfrmyb.exe 5496 inqmfrmyb.exe 2664 indskelwb.exe 2664 indskelwb.exe 1880 inykznpoh.exe 1880 inykznpoh.exe 3276 injwnoaqy.exe 3276 injwnoaqy.exe 6100 invhwkmle.exe 6100 invhwkmle.exe 2928 inpleqlxa.exe 2928 inpleqlxa.exe 6008 inuqbjvqf.exe 6008 inuqbjvqf.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inbsbjtei.exe inuhmcksg.exe File opened for modification C:\Windows\SysWOW64\iniqgcwmo.exe_lang.ini inknhvqeu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injmdckxk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmhxsddw.exe File created C:\Windows\SysWOW64\inmlwcerc.exe inniyteex.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkietvme.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbaqtkjr.exe File opened for modification C:\Windows\SysWOW64\inclpwksm.exe_lang.ini infrfqjpo.exe File opened for modification C:\Windows\SysWOW64\inttrrtqn.exe_lang.ini inmkoozmm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incsvmltt.exe File created C:\Windows\SysWOW64\inazpsjiq.exe inxrqyyst.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inocokdvj.exe File created C:\Windows\SysWOW64\iniizepdz.exe inpkvggzd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat iniizepdz.exe File created C:\Windows\SysWOW64\inionprva.exe inixomukg.exe File opened for modification C:\Windows\SysWOW64\inbnjcuis.exe_lang.ini ingvfeugi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injausioy.exe File opened for modification C:\Windows\SysWOW64\ineuxonvv.exe_lang.ini innlypqcs.exe File opened for modification C:\Windows\SysWOW64\inadbobmd.exe_lang.ini injfqeotx.exe File created C:\Windows\SysWOW64\indkgfezw.exe inktojpiu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inboqtdrp.exe File opened for modification C:\Windows\SysWOW64\inhrtbdgd.exe_lang.ini injyiwuqi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpdlvxfh.exe File opened for modification C:\Windows\SysWOW64\incqysiyz.exe_lang.ini infhrodsv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invrckwrg.exe File created C:\Windows\SysWOW64\inhwfuyzl.exe inionprva.exe File created C:\Windows\SysWOW64\inzfhvydh.exe innswqwhw.exe File created C:\Windows\SysWOW64\inuinrlrc.exe inljyapnv.exe File opened for modification C:\Windows\SysWOW64\indkgfezw.exe_lang.ini inktojpiu.exe File opened for modification C:\Windows\SysWOW64\inkuaczqt.exe_lang.ini injvkjzkm.exe File created C:\Windows\SysWOW64\inxnqhgoo.exe innbxlquo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzloqpih.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjudnts.exe File created C:\Windows\SysWOW64\injkrqgyq.exe inlaxcmgz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrlmbbts.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmzfdmqx.exe File created C:\Windows\SysWOW64\inzprbebn.exe invshckbs.exe File opened for modification C:\Windows\SysWOW64\inuisngbw.exe_lang.ini innezahdx.exe File created C:\Windows\SysWOW64\indpalewk.exe inogwahsa.exe File opened for modification C:\Windows\SysWOW64\inixomukg.exe_lang.ini inzjwmbpr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inczeboin.exe File opened for modification C:\Windows\SysWOW64\indwztgsi.exe_lang.ini inqdhyock.exe File created C:\Windows\SysWOW64\insbznvcp.exe insaljfpw.exe File opened for modification C:\Windows\SysWOW64\inrurbsrs.exe_lang.ini incajnuiq.exe File created C:\Windows\SysWOW64\inmkimmxk.exe invgvfzue.exe File created C:\Windows\SysWOW64\inczogbkc.exe inuzplcxm.exe File created C:\Windows\SysWOW64\ingtvpopk.exe inhwoipfi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injsnioht.exe File created C:\Windows\SysWOW64\insezthji.exe invnbgkek.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyteppma.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incbrdfjw.exe File opened for modification C:\Windows\SysWOW64\incjmswjo.exe_lang.ini inujqmuoe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insaljfpw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineamubie.exe File opened for modification C:\Windows\SysWOW64\inumafjdj.exe_lang.ini inhjvjvge.exe File created C:\Windows\SysWOW64\infudswxj.exe inlmosntr.exe File opened for modification C:\Windows\SysWOW64\infvypoww.exe_lang.ini inbjwysrs.exe File created C:\Windows\SysWOW64\intglbjrf.exe iniqzgcyz.exe File created C:\Windows\SysWOW64\innajnacf.exe inwtixaeq.exe File opened for modification C:\Windows\SysWOW64\inboqtqar.exe_lang.ini incjmswjo.exe File created C:\Windows\SysWOW64\inuvxhdct.exe inmrhdpxe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkmpmynm.exe File created C:\Windows\SysWOW64\inkbaivic.exe inpfzcyeq.exe File opened for modification C:\Windows\SysWOW64\inakrpgjz.exe_lang.ini inbjudnts.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqgiwze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczogbkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injdwyyif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineupaato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indbxwxmz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgaoyjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvqvoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrdysgih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqzaupvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invpovkyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniaooxbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwnltjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intmsjkwc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inenraymu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzprbebn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsbjtei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indxawycz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inakrpgjz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwmpgfnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkjzlnrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inauxfdek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infgwnmcy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpnehxjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuydrpyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqxbfmkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inefvmlzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkfxleq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incwvxbyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingerepgv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhgwhjlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inesqmezb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indpalewk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injausioy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invuwaxma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrfvkmdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inueaqidm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvfndjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjwysrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inquussur.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingoxeawx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injsnioht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insgwlney.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzydrlkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzolinkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvqbbup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineuxonvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insohtodl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqtvunam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyaereiz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbrcegj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbpvbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtjmoji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inufueytz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injrhdzvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgusiod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwldhtuf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe 4512 insohtodl.exe 4512 insohtodl.exe 788 inmtnbdcu.exe 788 inmtnbdcu.exe 2492 inugvjlkd.exe 2492 inugvjlkd.exe 2416 inwsdlxsh.exe 2416 inwsdlxsh.exe 400 indhxkwmb.exe 400 indhxkwmb.exe 4532 inqcxrfhg.exe 4532 inqcxrfhg.exe 1352 inwhpwale.exe 1352 inwhpwale.exe 3100 innuocedv.exe 3100 innuocedv.exe 1944 inbuxzyre.exe 1944 inbuxzyre.exe 3620 inmprqjiy.exe 3620 inmprqjiy.exe 5640 inatwyxqd.exe 5640 inatwyxqd.exe 2040 injyqkarh.exe 2040 injyqkarh.exe 2472 inbqiycju.exe 2472 inbqiycju.exe 5216 inaexuhtj.exe 5216 inaexuhtj.exe 2052 inoavpdfe.exe 2052 inoavpdfe.exe 3692 inqgdzfrf.exe 3692 inqgdzfrf.exe 4784 inlsmacbt.exe 4784 inlsmacbt.exe 4552 inruwvobn.exe 4552 inruwvobn.exe 3220 intcrvwiy.exe 3220 intcrvwiy.exe 4304 inknedlyl.exe 4304 inknedlyl.exe 2760 inpfzcyeq.exe 2760 inpfzcyeq.exe 824 inkbaivic.exe 824 inkbaivic.exe 4192 incanalcr.exe 4192 incanalcr.exe 4460 ingiuiufd.exe 4460 ingiuiufd.exe 5496 inqmfrmyb.exe 5496 inqmfrmyb.exe 2664 indskelwb.exe 2664 indskelwb.exe 1880 inykznpoh.exe 1880 inykznpoh.exe 3276 injwnoaqy.exe 3276 injwnoaqy.exe 6100 invhwkmle.exe 6100 invhwkmle.exe 2928 inpleqlxa.exe 2928 inpleqlxa.exe 6008 inuqbjvqf.exe 6008 inuqbjvqf.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 4512 insohtodl.exe Token: SeDebugPrivilege 788 inmtnbdcu.exe Token: SeDebugPrivilege 2492 inugvjlkd.exe Token: SeDebugPrivilege 2416 inwsdlxsh.exe Token: SeDebugPrivilege 400 indhxkwmb.exe Token: SeDebugPrivilege 4532 inqcxrfhg.exe Token: SeDebugPrivilege 1352 inwhpwale.exe Token: SeDebugPrivilege 3100 innuocedv.exe Token: SeDebugPrivilege 1944 inbuxzyre.exe Token: SeDebugPrivilege 3620 inmprqjiy.exe Token: SeDebugPrivilege 5640 inatwyxqd.exe Token: SeDebugPrivilege 2040 injyqkarh.exe Token: SeDebugPrivilege 2472 inbqiycju.exe Token: SeDebugPrivilege 5216 inaexuhtj.exe Token: SeDebugPrivilege 2052 inoavpdfe.exe Token: SeDebugPrivilege 3692 inqgdzfrf.exe Token: SeDebugPrivilege 4784 inlsmacbt.exe Token: SeDebugPrivilege 4552 inruwvobn.exe Token: SeDebugPrivilege 3220 intcrvwiy.exe Token: SeDebugPrivilege 4304 inknedlyl.exe Token: SeDebugPrivilege 2760 inpfzcyeq.exe Token: SeDebugPrivilege 824 inkbaivic.exe Token: SeDebugPrivilege 4192 incanalcr.exe Token: SeDebugPrivilege 4460 ingiuiufd.exe Token: SeDebugPrivilege 5496 inqmfrmyb.exe Token: SeDebugPrivilege 2664 indskelwb.exe Token: SeDebugPrivilege 1880 inykznpoh.exe Token: SeDebugPrivilege 3276 injwnoaqy.exe Token: SeDebugPrivilege 6100 invhwkmle.exe Token: SeDebugPrivilege 2928 inpleqlxa.exe Token: SeDebugPrivilege 6008 inuqbjvqf.exe Token: SeDebugPrivilege 3968 inyjbrycn.exe Token: SeDebugPrivilege 6032 inqtvunam.exe Token: SeDebugPrivilege 2260 inzvgovkd.exe Token: SeDebugPrivilege 5360 innqsrkjz.exe Token: SeDebugPrivilege 3980 inecpcnet.exe Token: SeDebugPrivilege 5188 incgzwjvl.exe Token: SeDebugPrivilege 4556 inaphxbit.exe Token: SeDebugPrivilege 3136 ingoxeawx.exe Token: SeDebugPrivilege 4760 inortslka.exe Token: SeDebugPrivilege 2068 inxtemyti.exe Token: SeDebugPrivilege 1088 inzloqpih.exe Token: SeDebugPrivilege 5328 inbpxnjbw.exe Token: SeDebugPrivilege 2220 inxiaqxbm.exe Token: SeDebugPrivilege 4876 intpaiupe.exe Token: SeDebugPrivilege 3372 indtwnmuu.exe Token: SeDebugPrivilege 4444 inmeufqjy.exe Token: SeDebugPrivilege 1184 inopeewva.exe Token: SeDebugPrivilege 120 infgwnmcy.exe Token: SeDebugPrivilege 8 inetlfmxc.exe Token: SeDebugPrivilege 5724 inldtepix.exe Token: SeDebugPrivilege 896 inlvjosms.exe Token: SeDebugPrivilege 4108 inbmkzbqa.exe Token: SeDebugPrivilege 2292 inhwoipfi.exe Token: SeDebugPrivilege 2204 ingtvpopk.exe Token: SeDebugPrivilege 3520 infdqdofu.exe Token: SeDebugPrivilege 5020 ingvzmksi.exe Token: SeDebugPrivilege 1672 incvyzsfr.exe Token: SeDebugPrivilege 1688 injhulmow.exe Token: SeDebugPrivilege 4340 intfuikjc.exe Token: SeDebugPrivilege 6040 inaikwkwh.exe Token: SeDebugPrivilege 2112 invrckwrg.exe Token: SeDebugPrivilege 5012 inxjymong.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe 4512 insohtodl.exe 788 inmtnbdcu.exe 2492 inugvjlkd.exe 2416 inwsdlxsh.exe 400 indhxkwmb.exe 4532 inqcxrfhg.exe 1352 inwhpwale.exe 3100 innuocedv.exe 1944 inbuxzyre.exe 3620 inmprqjiy.exe 5640 inatwyxqd.exe 2040 injyqkarh.exe 2472 inbqiycju.exe 5216 inaexuhtj.exe 2052 inoavpdfe.exe 3692 inqgdzfrf.exe 4784 inlsmacbt.exe 4552 inruwvobn.exe 3220 intcrvwiy.exe 4304 inknedlyl.exe 2760 inpfzcyeq.exe 824 inkbaivic.exe 4192 incanalcr.exe 4460 ingiuiufd.exe 5496 inqmfrmyb.exe 2664 indskelwb.exe 1880 inykznpoh.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4604 wrote to memory of 4512 4604 2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe 88 PID 4512 wrote to memory of 788 4512 insohtodl.exe 90 PID 788 wrote to memory of 2492 788 inmtnbdcu.exe 91 PID 2492 wrote to memory of 2416 2492 inugvjlkd.exe 92 PID 2416 wrote to memory of 400 2416 inwsdlxsh.exe 93 PID 400 wrote to memory of 4532 400 indhxkwmb.exe 94 PID 4532 wrote to memory of 1352 4532 inqcxrfhg.exe 95 PID 1352 wrote to memory of 3100 1352 inwhpwale.exe 96 PID 3100 wrote to memory of 1944 3100 innuocedv.exe 97 PID 1944 wrote to memory of 3620 1944 inbuxzyre.exe 98 PID 3620 wrote to memory of 5640 3620 inmprqjiy.exe 99 PID 5640 wrote to memory of 2040 5640 inatwyxqd.exe 100 PID 2040 wrote to memory of 2472 2040 injyqkarh.exe 101 PID 2472 wrote to memory of 5216 2472 inbqiycju.exe 102 PID 5216 wrote to memory of 2052 5216 inaexuhtj.exe 103 PID 2052 wrote to memory of 3692 2052 inoavpdfe.exe 104 PID 3692 wrote to memory of 4784 3692 inqgdzfrf.exe 105 PID 4784 wrote to memory of 4552 4784 inlsmacbt.exe 106 PID 4552 wrote to memory of 3220 4552 inruwvobn.exe 107 PID 3220 wrote to memory of 4304 3220 intcrvwiy.exe 108 PID 4304 wrote to memory of 2760 4304 inknedlyl.exe 109 PID 2760 wrote to memory of 824 2760 inpfzcyeq.exe 110 PID 824 wrote to memory of 4192 824 inkbaivic.exe 111 PID 4192 wrote to memory of 4460 4192 incanalcr.exe 112 PID 4460 wrote to memory of 5496 4460 ingiuiufd.exe 113 PID 5496 wrote to memory of 2664 5496 inqmfrmyb.exe 114 PID 2664 wrote to memory of 1880 2664 indskelwb.exe 115 PID 1880 wrote to memory of 3276 1880 inykznpoh.exe 116 PID 3276 wrote to memory of 6100 3276 injwnoaqy.exe 117 PID 6100 wrote to memory of 2928 6100 invhwkmle.exe 118 PID 2928 wrote to memory of 6008 2928 inpleqlxa.exe 119 PID 6008 wrote to memory of 3968 6008 inuqbjvqf.exe 120 PID 3968 wrote to memory of 6032 3968 inyjbrycn.exe 121 PID 6032 wrote to memory of 2260 6032 inqtvunam.exe 122 PID 2260 wrote to memory of 5360 2260 inzvgovkd.exe 123 PID 5360 wrote to memory of 3980 5360 innqsrkjz.exe 124 PID 3980 wrote to memory of 5188 3980 inecpcnet.exe 125 PID 5188 wrote to memory of 4556 5188 incgzwjvl.exe 126 PID 4556 wrote to memory of 3136 4556 inaphxbit.exe 127 PID 3136 wrote to memory of 4760 3136 ingoxeawx.exe 128 PID 4760 wrote to memory of 2068 4760 inortslka.exe 129 PID 2068 wrote to memory of 1088 2068 inxtemyti.exe 130 PID 1088 wrote to memory of 5328 1088 inzloqpih.exe 131 PID 5328 wrote to memory of 2220 5328 inbpxnjbw.exe 132 PID 2220 wrote to memory of 4876 2220 inxiaqxbm.exe 133 PID 4876 wrote to memory of 3372 4876 intpaiupe.exe 134 PID 3372 wrote to memory of 4444 3372 indtwnmuu.exe 135 PID 4444 wrote to memory of 1184 4444 inmeufqjy.exe 136 PID 1184 wrote to memory of 120 1184 inopeewva.exe 137 PID 120 wrote to memory of 8 120 infgwnmcy.exe 138 PID 8 wrote to memory of 5724 8 inetlfmxc.exe 139 PID 5724 wrote to memory of 896 5724 inldtepix.exe 140 PID 896 wrote to memory of 4108 896 inlvjosms.exe 141 PID 4108 wrote to memory of 2292 4108 inbmkzbqa.exe 142 PID 2292 wrote to memory of 2204 2292 inhwoipfi.exe 143 PID 2204 wrote to memory of 3520 2204 ingtvpopk.exe 144 PID 3520 wrote to memory of 5020 3520 infdqdofu.exe 145 PID 5020 wrote to memory of 1672 5020 ingvzmksi.exe 146 PID 1672 wrote to memory of 1688 1672 incvyzsfr.exe 147 PID 1688 wrote to memory of 4340 1688 injhulmow.exe 148 PID 4340 wrote to memory of 6040 4340 intfuikjc.exe 149 PID 6040 wrote to memory of 2112 6040 inaikwkwh.exe 150 PID 2112 wrote to memory of 5012 2112 invrckwrg.exe 151 PID 5012 wrote to memory of 2796 5012 inxjymong.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f8bfbcb4e2a3ee553567f4fa8453638_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe16⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe17⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe20⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe31⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe40⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe41⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe66⤵
- System Location Discovery: System Language Discovery
PID:3472 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe67⤵PID:5420
-
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe68⤵PID:5920
-
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe69⤵PID:3984
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe70⤵PID:2240
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe71⤵PID:5356
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe72⤵PID:6080
-
C:\Windows\SysWOW64\inowmiavg.exeC:\Windows\system32\inowmiavg.exe73⤵PID:1384
-
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe74⤵PID:3028
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe75⤵PID:2516
-
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe77⤵PID:5852
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe78⤵
- Drops file in System32 directory
PID:3592 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe79⤵
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe80⤵PID:4124
-
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe81⤵PID:5984
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:2360 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe83⤵
- System Location Discovery: System Language Discovery
PID:1616 -
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe84⤵PID:1472
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe85⤵PID:4164
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe86⤵
- Drops file in System32 directory
PID:5448 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe87⤵
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe88⤵PID:3256
-
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe89⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4740 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe90⤵PID:4848
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe91⤵PID:3648
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe92⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe93⤵PID:2892
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe94⤵PID:3496
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe95⤵PID:5540
-
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe96⤵PID:5244
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe97⤵PID:2436
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe98⤵PID:4772
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe99⤵PID:5840
-
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe100⤵PID:6132
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe101⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5916 -
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe102⤵
- Drops file in System32 directory
PID:3992 -
C:\Windows\SysWOW64\inktbmkag.exeC:\Windows\system32\inktbmkag.exe103⤵PID:2332
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe104⤵PID:4692
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe105⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3296 -
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe106⤵PID:5588
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe107⤵
- Drops file in System32 directory
PID:4500 -
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe108⤵PID:2616
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe109⤵
- Drops file in System32 directory
PID:2180 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe110⤵PID:4184
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe111⤵PID:5820
-
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe112⤵PID:2784
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe113⤵PID:3580
-
C:\Windows\SysWOW64\indscwrxb.exeC:\Windows\system32\indscwrxb.exe114⤵PID:5596
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe115⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\Windows\SysWOW64\inpnehxjk.exeC:\Windows\system32\inpnehxjk.exe116⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe117⤵PID:1576
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe118⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2632 -
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe119⤵PID:3304
-
C:\Windows\SysWOW64\inarenvge.exeC:\Windows\system32\inarenvge.exe120⤵PID:5388
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe121⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-