Analysis
- max time kernel
134s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 04:28
Behavioral task
behavioral1
Sample
2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261007-e36amsbx51
- SHA256 16f55081b5d6d84dfb4d98419f9420df62763bba03bff9f8fb4bb5870dd21de2
- MD5 23809839b2a2bffcbeba5bac886bd5ad
- SHA1 2cd165da0ec84c7b0132828099603ab7ff74fa25
- SHA512 825f96f66c7cb630011ae97f72de13abadda03119df2af4508c8202deb80ad293b851c5dd7e2750741ab374cd4ba623341323b32c1fe934b3490339f461cb4a6
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT0:RPjOa1NxyYtH10
- TLSH T1D515AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral1/memory/1224-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024579-13.dat family_gh0strat behavioral1/memory/6104-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024583-69.dat family_gh0strat behavioral1/memory/2120-648-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5372-628-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5040-609-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3360-590-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1544-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5648-545-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3852-533-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5140-514-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4564-495-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4900-476-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3416-440-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1036-437-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3884-420-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4884-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5924-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245b7-368.dat family_gh0strat behavioral1/memory/212-348-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245b3-345.dat family_gh0strat behavioral1/memory/4540-337-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245af-322.dat family_gh0strat behavioral1/memory/4156-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245ab-299.dat family_gh0strat behavioral1/memory/4464-291-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245a7-276.dat family_gh0strat behavioral1/memory/4856-269-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000245a3-253.dat family_gh0strat behavioral1/memory/1032-247-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002459f-230.dat family_gh0strat behavioral1/memory/4268-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002459b-207.dat family_gh0strat behavioral1/memory/5460-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024597-184.dat family_gh0strat behavioral1/memory/3296-177-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024593-161.dat family_gh0strat behavioral1/memory/5588-154-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002458f-138.dat family_gh0strat behavioral1/memory/5216-130-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002458b-115.dat family_gh0strat behavioral1/memory/5068-107-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024587-92.dat family_gh0strat behavioral1/memory/1160-84-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/6104-61-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002457f-46.dat family_gh0strat behavioral1/memory/1224-38-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002457a-22.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E8FF206-18AA-478e-916C-A48AA0CA9E28}\stubpath = "C:\\Windows\\system32\\inbofjghq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8BE3537-8D2A-43f4-ABAB-D85B0824B85A}\stubpath = "C:\\Windows\\system32\\inqtvunam.exe" inrngsnzc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D10B22B-C710-4da2-AE69-2513255D321C} inljswfrz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90B4440D-40A9-48a2-A07C-133297FDBD5C}\stubpath = "C:\\Windows\\system32\\inexlaczi.exe" inhjrgabu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E6EE1F8-3AE4-4049-9F9F-CA7FC3CCC047} iniszaxor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E071868-EEAB-4f57-8F8C-4CE7256A345D}\stubpath = "C:\\Windows\\system32\\incibocxs.exe" inhfnbzwf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B3F904D-DD8F-4977-8FF9-4646C4310E3C}\stubpath = "C:\\Windows\\system32\\inxccitip.exe" indpzjglj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96C575E6-C220-4f8b-8DC4-99324C25FE1E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E582A58-B388-48e3-8498-6C86B00A64B3} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27DDFCCE-B529-4548-BD07-74AD33991E7F} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BC9FBD70-D94E-4c6d-AAC9-0334A29B4F48}\stubpath = "C:\\Windows\\system32\\inhyqlaum.exe" injtvdfif.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B3413DD-3FAA-49e6-A277-3E2D166E9F35} inxkpvpwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FBD1BB9-AFF9-492a-A59C-992452A467E9} inwtyvsvp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EE99EAD-779F-4e31-B5D0-1511B594EFE6} inimthpzj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E52CBCA-AD55-4379-A7F8-26E4B53E1C1E}\stubpath = "C:\\Windows\\system32\\inbdhuahl.exe" inqbcmcsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED16B4FD-1611-4a8b-AE15-9817ABC3253E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA045700-1814-48ff-8571-A4BC55067A5E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E3A9D00-B4B9-4077-958D-A41D2CD41679} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33442749-7C5D-4e25-BE80-1E6A5FBCA004}\stubpath = "C:\\Windows\\system32\\inbpxnjbw.exe" inbobfwma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6FB2D7F-1FC3-4ee2-ABD5-7B8E5D85120A}\stubpath = "C:\\Windows\\system32\\inuydrpyf.exe" inpprolqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F208C3F3-2B79-430a-96B7-7DE699EA4017} inmrhdpxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3302360-4814-4eb3-86D9-7F058259F4DF}\stubpath = "C:\\Windows\\system32\\inquqvwfg.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0351348-33EB-41c0-A7C2-664803F00B79} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DF56175-A78B-4356-A362-840A197E4EFD}\stubpath = "C:\\Windows\\system32\\ineclnqam.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0108EE9-B7BE-418e-9755-5DD1894E87E8}\stubpath = "C:\\Windows\\system32\\incncncbd.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{030BD4F1-16F3-442b-BA83-895839F28BF7}\stubpath = "C:\\Windows\\system32\\inwsdlxsh.exe" incanalcr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B41F2F54-DF08-43c3-8A10-DFA77E2E148D} inmxdfsdw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FF1B931-1520-4fe9-B2FB-CC9E8E23322E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CDE9E330-1F8F-492b-A5DE-069F5C4EA4F1} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56482B31-4F93-4044-83B6-8E59D1249F3B}\stubpath = "C:\\Windows\\system32\\inzprbebn.exe" inqxvmprs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF33F9DF-927C-4d0e-81D0-E2F1B5D13047} inndiulal.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD830385-7BE9-4fbb-BAEF-0D7AF3C99367} inwonikuc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D051387-379E-4691-B4B1-B4AE3C6708DD}\stubpath = "C:\\Windows\\system32\\inmbydanh.exe" inkwlklan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87C87722-9CFB-42b3-A3AC-28F3BD61748B}\stubpath = "C:\\Windows\\system32\\inpfkwncn.exe" intlkfhrk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{078D1F2B-F816-4e25-B7B3-E7AB22CAC432}\stubpath = "C:\\Windows\\system32\\inendwupi.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6F45730-1D38-4fb2-AB8D-6201513D93C9}\stubpath = "C:\\Windows\\system32\\inpsutmlb.exe" intsuvkkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A33829B-E92C-4937-88E3-F4D72524DB0D}\stubpath = "C:\\Windows\\system32\\ineltpsko.exe" inmzdngio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E42D3CDA-2043-4379-BFBD-B7188CD8F8C2}\stubpath = "C:\\Windows\\system32\\injzxbybw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98F40E38-8DFC-4132-B2CD-02C0B284BDB0}\stubpath = "C:\\Windows\\system32\\inxnewqnc.exe" inzyhfjju.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B388B5E8-1600-4fe8-AAB4-AF536F37EC16} ineykmuaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B715C592-C992-40bd-82BE-FC00C6066BB1} ingpzupnj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D6F05F9-8F08-4967-96E1-297AD0AF8326} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7695828D-BAFA-4810-BFB5-6895B303439C} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{486A4B58-C4E8-4bcf-8FF7-15635D947A34}\stubpath = "C:\\Windows\\system32\\injkbdgln.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A16F1738-CFFD-4374-B58D-FD3CD2965FFF}\stubpath = "C:\\Windows\\system32\\inbkooyol.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{394987F5-CA59-4b85-9065-16AD500A067C} inpfkwncn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EC1115B-21EB-43b0-B092-36265AF27771}\stubpath = "C:\\Windows\\system32\\invspsmvj.exe" inhfvpqff.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4E1FEB9-6F9F-4aca-98E0-F3C956EC7861} innhouwkt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC80D79A-B7A3-4ecb-8712-95CE18FD022E} injhepyti.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{691DB307-C810-4f75-9EFD-8B5DD3BA47DC} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A055934-CEE0-44c3-97E6-14AED692592E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{859CAB95-253F-4187-ADF9-FC30CBD30C61} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B020773B-95DC-4d27-974A-BE9AFC7B61DD} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01CF1624-000E-46a8-A50A-65CC294D6DF4}\stubpath = "C:\\Windows\\system32\\inipneahj.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2477D17-CEE1-4016-AA4D-23482F21B275} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20EFFFB6-AC6B-4283-BB6D-088A3FAC149D}\stubpath = "C:\\Windows\\system32\\inzvprwjx.exe" inzrzcjpi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4585DD81-3FC5-45f2-83A5-39029D615F94} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF5DDA43-1224-4d07-80FC-976C1C94D8AE}\stubpath = "C:\\Windows\\system32\\indajuknb.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCC0A2A5-414A-4f51-8D1A-385BF0044602}\stubpath = "C:\\Windows\\system32\\inatwyxqd.exe" inuqbjvqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFDB6AD9-B9F9-4059-8108-D9560A6CCD99}\stubpath = "C:\\Windows\\system32\\inxrycagn.exe" inuwftrhn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8EE6149-C8ED-4484-95E6-0BB39EDD4889} inzbahzkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B858BF6E-DFE4-420f-91F6-A0867B52051A} inktojpiu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F3F3D613-FFEF-41b3-AE68-A634C7816047} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06E0FE3D-C4C9-4b8d-A0C3-50972B554E95}\stubpath = "C:\\Windows\\system32\\indlyubtu.exe" inxitdtqe.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x001c000000023876-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 6104 incgzwjvl.exe 1160 inmeufqjy.exe 5068 inpbwqegf.exe 5216 inrdysgih.exe 5588 inugvjlkd.exe 3296 inwixlnmf.exe 5460 inzloqpih.exe 4268 inmtnbdcu.exe 1032 inoavpdfe.exe 4856 inazpsjiq.exe 4464 inetlfmxc.exe 4156 injyqkarh.exe 4540 inldtepix.exe 212 innfvgrkz.exe 5924 intpaiupe.exe 4884 intfuikjc.exe 3884 invhwkmle.exe 3416 inixpjqgj.exe 1036 inzkcszdo.exe 4900 inhwnltjf.exe 4564 inaphxbit.exe 5140 invrckwrg.exe 3852 inxtemyti.exe 5648 inwhpwale.exe 1544 inyjbrycn.exe 3360 inknedlyl.exe 5040 inogwahsa.exe 5372 incrjzdkv.exe 2120 inbqostfv.exe 2948 inzvgovkd.exe 3276 ingvetxyk.exe 5064 inpleqlxa.exe 5020 inrngsnzc.exe 4416 inqtvunam.exe 2092 insvxwpco.exe 5124 inbrulkss.exe 5112 ineuxonvv.exe 5928 inykznpoh.exe 4880 inlsmacbt.exe 1636 inwmpgfnn.exe 4964 inqcxrfhg.exe 5036 indskelwb.exe 2932 ingvnhoze.exe 4600 inahuhbcs.exe 4516 injmdckxk.exe 4188 inxsdoolp.exe 4460 inbmkzbqa.exe 440 inadbobmd.exe 5340 infumgnyd.exe 712 intcrvwiy.exe 3780 iniqzgcyz.exe 1832 inyegrpfl.exe 2756 insohtodl.exe 2084 inuqbjvqf.exe 4648 inatwyxqd.exe 2176 indwztgsi.exe 4660 inpqffxwb.exe 1692 inxrqyyst.exe 740 innqsrkjz.exe 5844 incwvxbyn.exe 2100 inqklaasr.exe 2432 inmnccutj.exe 4692 inhfsfaqh.exe 3976 inkbaivic.exe - Loads dropped DLL 64 IoCs
pid Process 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 6104 incgzwjvl.exe 6104 incgzwjvl.exe 1160 inmeufqjy.exe 1160 inmeufqjy.exe 5068 inpbwqegf.exe 5068 inpbwqegf.exe 5216 inrdysgih.exe 5216 inrdysgih.exe 5588 inugvjlkd.exe 5588 inugvjlkd.exe 3296 inwixlnmf.exe 3296 inwixlnmf.exe 5460 inzloqpih.exe 5460 inzloqpih.exe 4268 inmtnbdcu.exe 4268 inmtnbdcu.exe 1032 inoavpdfe.exe 1032 inoavpdfe.exe 4856 inazpsjiq.exe 4856 inazpsjiq.exe 4464 inetlfmxc.exe 4464 inetlfmxc.exe 4156 injyqkarh.exe 4156 injyqkarh.exe 4540 inldtepix.exe 4540 inldtepix.exe 212 innfvgrkz.exe 212 innfvgrkz.exe 5924 intpaiupe.exe 5924 intpaiupe.exe 4884 intfuikjc.exe 4884 intfuikjc.exe 3884 invhwkmle.exe 3884 invhwkmle.exe 3416 inixpjqgj.exe 3416 inixpjqgj.exe 1036 inzkcszdo.exe 1036 inzkcszdo.exe 4900 inhwnltjf.exe 4900 inhwnltjf.exe 4564 inaphxbit.exe 4564 inaphxbit.exe 5140 invrckwrg.exe 5140 invrckwrg.exe 3852 inxtemyti.exe 3852 inxtemyti.exe 5648 inwhpwale.exe 5648 inwhpwale.exe 1544 inyjbrycn.exe 1544 inyjbrycn.exe 3360 inknedlyl.exe 3360 inknedlyl.exe 5040 inogwahsa.exe 5040 inogwahsa.exe 5372 incrjzdkv.exe 5372 incrjzdkv.exe 2120 inbqostfv.exe 2120 inbqostfv.exe 2948 inzvgovkd.exe 2948 inzvgovkd.exe 3276 ingvetxyk.exe 3276 ingvetxyk.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inpdimgmm.exe File opened for modification C:\Windows\SysWOW64\intojzuff.exe_lang.ini inwtixaeq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineltpsko.exe File created C:\Windows\SysWOW64\inihalmwh.exe Process not Found File opened for modification C:\Windows\SysWOW64\inobnyxly.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inhiypoew.exe_lang.ini inefvmlzb.exe File created C:\Windows\SysWOW64\inocokdvj.exe inpnehxjk.exe File created C:\Windows\SysWOW64\insywlfel.exe ingkycsra.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuypzsaf.exe File created C:\Windows\SysWOW64\innezovdr.exe invqlrkwy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkxmjgli.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkietvme.exe File created C:\Windows\SysWOW64\inwgmmfga.exe innxqyiqa.exe File created C:\Windows\SysWOW64\inbjibmnx.exe inhodptkg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inyrmomgz.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat ininzqfqh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyctgpxi.exe File created C:\Windows\SysWOW64\injprzfoi.exe inemiltdh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\ingejxcqy.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ingbhjxqx.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inbmmjnwc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inztjzmib.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzjwmbpr.exe File created C:\Windows\SysWOW64\inxqlnlfy.exe invmsakfo.exe File created C:\Windows\SysWOW64\inbsebpqb.exe inntiwzzb.exe File created C:\Windows\SysWOW64\inkbaivic.exe inhfsfaqh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingiuiufd.exe File opened for modification C:\Windows\SysWOW64\invfrxfpk.exe_lang.ini inbjdjvkm.exe File created C:\Windows\SysWOW64\inybxrfcy.exe Process not Found File created C:\Windows\SysWOW64\inmqlrpew.exe iniszaxor.exe File opened for modification C:\Windows\SysWOW64\inuonujxj.exe_lang.ini inymotxgz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inooxsntm.exe File created C:\Windows\SysWOW64\inkhtihxi.exe inpdimgmm.exe File created C:\Windows\SysWOW64\inkesnbrx.exe inwfngdng.exe File created C:\Windows\SysWOW64\inztkqidm.exe inyepukgs.exe File created C:\Windows\SysWOW64\infpibkqn.exe inmroafou.exe File created C:\Windows\SysWOW64\intphcved.exe innhouwkt.exe File created C:\Windows\SysWOW64\inesltdsz.exe inkdpokcq.exe File created C:\Windows\SysWOW64\indsqcrxx.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inrjcgagg.exe File created C:\Windows\SysWOW64\inpkfxleq.exe inmawkptn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyluacnl.exe File opened for modification C:\Windows\SysWOW64\inkfbyhcg.exe_lang.ini inclwgwbt.exe File created C:\Windows\SysWOW64\invcsswdc.exe Process not Found File created C:\Windows\SysWOW64\inwlxfaef.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inxsdoolp.exe injmdckxk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innuocedv.exe File opened for modification C:\Windows\SysWOW64\intglbjrf.exe_lang.ini inptcowdq.exe File opened for modification C:\Windows\SysWOW64\innqmfdal.exe_lang.ini inprouzhr.exe File opened for modification C:\Windows\SysWOW64\inclwgwbt.exe_lang.ini iniujiyjl.exe File created C:\Windows\SysWOW64\inktojpiu.exe inkdlvlhw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inubnxhey.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inhgblcvj.exe File opened for modification C:\Windows\SysWOW64\inerkqvxt.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inbqostfv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzhpyfbx.exe File created C:\Windows\SysWOW64\inikbvtjp.exe injfevnir.exe File opened for modification C:\Windows\SysWOW64\inbalzxgu.exe_lang.ini inyodrton.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrnisxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infpibkqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inooxsntm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injkrqgyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infjxbrqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwfaehwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkbaivic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpeapdzu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingatvyvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzfdmqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzebhpmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqbjpnmx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invecggre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intsuvkkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbaqtkjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inufueytz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuvkxzmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoaemue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbvupzqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhqyjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineamubie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxavmale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrycagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infauwnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invhauplr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indeulkya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inygczwba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhmypep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqklaasr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniuxcykh.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 6104 incgzwjvl.exe 6104 incgzwjvl.exe 1160 inmeufqjy.exe 1160 inmeufqjy.exe 5068 inpbwqegf.exe 5068 inpbwqegf.exe 5216 inrdysgih.exe 5216 inrdysgih.exe 5588 inugvjlkd.exe 5588 inugvjlkd.exe 3296 inwixlnmf.exe 3296 inwixlnmf.exe 5460 inzloqpih.exe 5460 inzloqpih.exe 4268 inmtnbdcu.exe 4268 inmtnbdcu.exe 1032 inoavpdfe.exe 1032 inoavpdfe.exe 4856 inazpsjiq.exe 4856 inazpsjiq.exe 4464 inetlfmxc.exe 4464 inetlfmxc.exe 4156 injyqkarh.exe 4156 injyqkarh.exe 4540 inldtepix.exe 4540 inldtepix.exe 212 innfvgrkz.exe 212 innfvgrkz.exe 5924 intpaiupe.exe 5924 intpaiupe.exe 4884 intfuikjc.exe 4884 intfuikjc.exe 3884 invhwkmle.exe 3884 invhwkmle.exe 3416 inixpjqgj.exe 3416 inixpjqgj.exe 1036 inzkcszdo.exe 1036 inzkcszdo.exe 4900 inhwnltjf.exe 4900 inhwnltjf.exe 4564 inaphxbit.exe 4564 inaphxbit.exe 5140 invrckwrg.exe 5140 invrckwrg.exe 3852 inxtemyti.exe 3852 inxtemyti.exe 5648 inwhpwale.exe 5648 inwhpwale.exe 1544 inyjbrycn.exe 1544 inyjbrycn.exe 3360 inknedlyl.exe 3360 inknedlyl.exe 5040 inogwahsa.exe 5040 inogwahsa.exe 5372 incrjzdkv.exe 5372 incrjzdkv.exe 2120 inbqostfv.exe 2120 inbqostfv.exe 2948 inzvgovkd.exe 2948 inzvgovkd.exe 3276 ingvetxyk.exe 3276 ingvetxyk.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 6104 incgzwjvl.exe Token: SeDebugPrivilege 1160 inmeufqjy.exe Token: SeDebugPrivilege 5068 inpbwqegf.exe Token: SeDebugPrivilege 5216 inrdysgih.exe Token: SeDebugPrivilege 5588 inugvjlkd.exe Token: SeDebugPrivilege 3296 inwixlnmf.exe Token: SeDebugPrivilege 5460 inzloqpih.exe Token: SeDebugPrivilege 4268 inmtnbdcu.exe Token: SeDebugPrivilege 1032 inoavpdfe.exe Token: SeDebugPrivilege 4856 inazpsjiq.exe Token: SeDebugPrivilege 4464 inetlfmxc.exe Token: SeDebugPrivilege 4156 injyqkarh.exe Token: SeDebugPrivilege 4540 inldtepix.exe Token: SeDebugPrivilege 212 innfvgrkz.exe Token: SeDebugPrivilege 5924 intpaiupe.exe Token: SeDebugPrivilege 4884 intfuikjc.exe Token: SeDebugPrivilege 3884 invhwkmle.exe Token: SeDebugPrivilege 3416 inixpjqgj.exe Token: SeDebugPrivilege 1036 inzkcszdo.exe Token: SeDebugPrivilege 4900 inhwnltjf.exe Token: SeDebugPrivilege 4564 inaphxbit.exe Token: SeDebugPrivilege 5140 invrckwrg.exe Token: SeDebugPrivilege 3852 inxtemyti.exe Token: SeDebugPrivilege 5648 inwhpwale.exe Token: SeDebugPrivilege 1544 inyjbrycn.exe Token: SeDebugPrivilege 3360 inknedlyl.exe Token: SeDebugPrivilege 5040 inogwahsa.exe Token: SeDebugPrivilege 5372 incrjzdkv.exe Token: SeDebugPrivilege 2120 inbqostfv.exe Token: SeDebugPrivilege 2948 inzvgovkd.exe Token: SeDebugPrivilege 3276 ingvetxyk.exe Token: SeDebugPrivilege 5064 inpleqlxa.exe Token: SeDebugPrivilege 5020 inrngsnzc.exe Token: SeDebugPrivilege 4416 inqtvunam.exe Token: SeDebugPrivilege 2092 insvxwpco.exe Token: SeDebugPrivilege 5124 inbrulkss.exe Token: SeDebugPrivilege 5112 ineuxonvv.exe Token: SeDebugPrivilege 5928 inykznpoh.exe Token: SeDebugPrivilege 4880 inlsmacbt.exe Token: SeDebugPrivilege 1636 inwmpgfnn.exe Token: SeDebugPrivilege 4964 inqcxrfhg.exe Token: SeDebugPrivilege 5036 indskelwb.exe Token: SeDebugPrivilege 2932 ingvnhoze.exe Token: SeDebugPrivilege 4600 inahuhbcs.exe Token: SeDebugPrivilege 4516 injmdckxk.exe Token: SeDebugPrivilege 4188 inxsdoolp.exe Token: SeDebugPrivilege 4460 inbmkzbqa.exe Token: SeDebugPrivilege 440 inadbobmd.exe Token: SeDebugPrivilege 5340 infumgnyd.exe Token: SeDebugPrivilege 712 intcrvwiy.exe Token: SeDebugPrivilege 3780 iniqzgcyz.exe Token: SeDebugPrivilege 1832 inyegrpfl.exe Token: SeDebugPrivilege 2756 insohtodl.exe Token: SeDebugPrivilege 2084 inuqbjvqf.exe Token: SeDebugPrivilege 4648 inatwyxqd.exe Token: SeDebugPrivilege 2176 indwztgsi.exe Token: SeDebugPrivilege 4660 inpqffxwb.exe Token: SeDebugPrivilege 1692 inxrqyyst.exe Token: SeDebugPrivilege 740 innqsrkjz.exe Token: SeDebugPrivilege 5844 incwvxbyn.exe Token: SeDebugPrivilege 2100 inqklaasr.exe Token: SeDebugPrivilege 2432 inmnccutj.exe Token: SeDebugPrivilege 4692 inhfsfaqh.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 6104 incgzwjvl.exe 1160 inmeufqjy.exe 5068 inpbwqegf.exe 5216 inrdysgih.exe 5588 inugvjlkd.exe 3296 inwixlnmf.exe 5460 inzloqpih.exe 4268 inmtnbdcu.exe 1032 inoavpdfe.exe 4856 inazpsjiq.exe 4464 inetlfmxc.exe 4156 injyqkarh.exe 4540 inldtepix.exe 212 innfvgrkz.exe 5924 intpaiupe.exe 4884 intfuikjc.exe 3884 invhwkmle.exe 3416 inixpjqgj.exe 1036 inzkcszdo.exe 4900 inhwnltjf.exe 4564 inaphxbit.exe 5140 invrckwrg.exe 3852 inxtemyti.exe 5648 inwhpwale.exe 1544 inyjbrycn.exe 3360 inknedlyl.exe 5040 inogwahsa.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 6104 1224 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 90 PID 6104 wrote to memory of 1160 6104 incgzwjvl.exe 91 PID 1160 wrote to memory of 5068 1160 inmeufqjy.exe 92 PID 5068 wrote to memory of 5216 5068 inpbwqegf.exe 93 PID 5216 wrote to memory of 5588 5216 inrdysgih.exe 94 PID 5588 wrote to memory of 3296 5588 inugvjlkd.exe 95 PID 3296 wrote to memory of 5460 3296 inwixlnmf.exe 96 PID 5460 wrote to memory of 4268 5460 inzloqpih.exe 97 PID 4268 wrote to memory of 1032 4268 inmtnbdcu.exe 98 PID 1032 wrote to memory of 4856 1032 inoavpdfe.exe 99 PID 4856 wrote to memory of 4464 4856 inazpsjiq.exe 100 PID 4464 wrote to memory of 4156 4464 inetlfmxc.exe 101 PID 4156 wrote to memory of 4540 4156 injyqkarh.exe 102 PID 4540 wrote to memory of 212 4540 inldtepix.exe 103 PID 212 wrote to memory of 5924 212 innfvgrkz.exe 104 PID 5924 wrote to memory of 4884 5924 intpaiupe.exe 105 PID 4884 wrote to memory of 3884 4884 intfuikjc.exe 106 PID 3884 wrote to memory of 3416 3884 invhwkmle.exe 107 PID 3416 wrote to memory of 1036 3416 inixpjqgj.exe 108 PID 1036 wrote to memory of 4900 1036 inzkcszdo.exe 109 PID 4900 wrote to memory of 4564 4900 inhwnltjf.exe 110 PID 4564 wrote to memory of 5140 4564 inaphxbit.exe 111 PID 5140 wrote to memory of 3852 5140 invrckwrg.exe 112 PID 3852 wrote to memory of 5648 3852 inxtemyti.exe 113 PID 5648 wrote to memory of 1544 5648 inwhpwale.exe 114 PID 1544 wrote to memory of 3360 1544 inyjbrycn.exe 115 PID 3360 wrote to memory of 5040 3360 inknedlyl.exe 116 PID 5040 wrote to memory of 5372 5040 inogwahsa.exe 117 PID 5372 wrote to memory of 2120 5372 incrjzdkv.exe 118 PID 2120 wrote to memory of 2948 2120 inbqostfv.exe 119 PID 2948 wrote to memory of 3276 2948 inzvgovkd.exe 120 PID 3276 wrote to memory of 5064 3276 ingvetxyk.exe 121 PID 5064 wrote to memory of 5020 5064 inpleqlxa.exe 122 PID 5020 wrote to memory of 4416 5020 inrngsnzc.exe 123 PID 4416 wrote to memory of 2092 4416 inqtvunam.exe 124 PID 2092 wrote to memory of 5124 2092 insvxwpco.exe 125 PID 5124 wrote to memory of 5112 5124 inbrulkss.exe 126 PID 5112 wrote to memory of 5928 5112 ineuxonvv.exe 127 PID 5928 wrote to memory of 4880 5928 inykznpoh.exe 128 PID 4880 wrote to memory of 1636 4880 inlsmacbt.exe 129 PID 1636 wrote to memory of 4964 1636 inwmpgfnn.exe 130 PID 4964 wrote to memory of 5036 4964 inqcxrfhg.exe 131 PID 5036 wrote to memory of 2932 5036 indskelwb.exe 132 PID 2932 wrote to memory of 4600 2932 ingvnhoze.exe 133 PID 4600 wrote to memory of 4516 4600 inahuhbcs.exe 134 PID 4516 wrote to memory of 4188 4516 injmdckxk.exe 135 PID 4188 wrote to memory of 4460 4188 inxsdoolp.exe 136 PID 4460 wrote to memory of 440 4460 inbmkzbqa.exe 137 PID 440 wrote to memory of 5340 440 inadbobmd.exe 138 PID 5340 wrote to memory of 712 5340 infumgnyd.exe 139 PID 712 wrote to memory of 3780 712 intcrvwiy.exe 140 PID 3780 wrote to memory of 1832 3780 iniqzgcyz.exe 141 PID 1832 wrote to memory of 2756 1832 inyegrpfl.exe 142 PID 2756 wrote to memory of 2084 2756 insohtodl.exe 143 PID 2084 wrote to memory of 4648 2084 inuqbjvqf.exe 144 PID 4648 wrote to memory of 2176 4648 inatwyxqd.exe 145 PID 2176 wrote to memory of 4660 2176 indwztgsi.exe 146 PID 4660 wrote to memory of 1692 4660 inpqffxwb.exe 147 PID 1692 wrote to memory of 740 1692 inxrqyyst.exe 148 PID 740 wrote to memory of 5844 740 innqsrkjz.exe 149 PID 5844 wrote to memory of 2100 5844 incwvxbyn.exe 150 PID 2100 wrote to memory of 2432 2100 inqklaasr.exe 151 PID 2432 wrote to memory of 4692 2432 inmnccutj.exe 152 PID 4692 wrote to memory of 3976 4692 inhfsfaqh.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe34⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\system32\inyegrpfl.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe55⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe66⤵
- Drops file in System32 directory
PID:1964 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe67⤵PID:4468
-
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe68⤵PID:1104
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe69⤵PID:4180
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe70⤵PID:412
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe71⤵PID:728
-
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe72⤵PID:5144
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe73⤵PID:5432
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe74⤵PID:4732
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe75⤵PID:1248
-
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe76⤵PID:4860
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe77⤵PID:5592
-
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe78⤵PID:4028
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe79⤵PID:4060
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe80⤵PID:368
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe81⤵PID:5620
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe82⤵PID:4612
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe83⤵PID:4140
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe84⤵PID:2456
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe85⤵PID:4368
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe86⤵PID:3288
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe87⤵PID:4724
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4352 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe89⤵PID:540
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe90⤵PID:3044
-
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe91⤵PID:2068
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe92⤵PID:3536
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe93⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe94⤵PID:6056
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe95⤵PID:5564
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe96⤵PID:5436
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe97⤵PID:2236
-
C:\Windows\SysWOW64\injyiwuqi.exeC:\Windows\system32\injyiwuqi.exe98⤵PID:3392
-
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe99⤵PID:4372
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe100⤵PID:4492
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe101⤵PID:3212
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe102⤵PID:1532
-
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe103⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1608 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe104⤵PID:216
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe105⤵PID:4328
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe106⤵PID:5772
-
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe107⤵PID:5912
-
C:\Windows\SysWOW64\invbdruwx.exeC:\Windows\system32\invbdruwx.exe108⤵PID:1548
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe109⤵PID:6000
-
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe110⤵PID:4256
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe111⤵PID:4544
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe112⤵PID:6088
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe113⤵PID:1096
-
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe114⤵PID:2808
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe115⤵
- Drops file in System32 directory
PID:1944 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe116⤵PID:5944
-
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe117⤵PID:5812
-
C:\Windows\SysWOW64\inbnjcuis.exeC:\Windows\system32\inbnjcuis.exe118⤵PID:3472
-
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe119⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe120⤵PID:2988
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe121⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-