Analysis
- max time kernel
91s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 04:28
Behavioral task
behavioral1
Sample
2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261007-e36amsbx51
- SHA256 16f55081b5d6d84dfb4d98419f9420df62763bba03bff9f8fb4bb5870dd21de2
- MD5 23809839b2a2bffcbeba5bac886bd5ad
- SHA1 2cd165da0ec84c7b0132828099603ab7ff74fa25
- SHA512 825f96f66c7cb630011ae97f72de13abadda03119df2af4508c8202deb80ad293b851c5dd7e2750741ab374cd4ba623341323b32c1fe934b3490339f461cb4a6
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT0:RPjOa1NxyYtH10
- TLSH T1D515AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/5140-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c513-14.dat family_gh0strat behavioral2/files/0x000c00000001c517-20.dat family_gh0strat behavioral2/memory/5140-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c51d-42.dat family_gh0strat behavioral2/files/0x000c00000001c521-65.dat family_gh0strat behavioral2/files/0x000c00000001c526-87.dat family_gh0strat behavioral2/files/0x000c00000001c533-153.dat family_gh0strat behavioral2/files/0x000c00000001c537-175.dat family_gh0strat behavioral2/files/0x000c00000001c55a-351.dat family_gh0strat behavioral2/memory/4268-553-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1672-625-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5484-607-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1420-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5112-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3784-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2036-517-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5304-499-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5464-481-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3260-463-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4500-445-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3452-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6088-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2928-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2152-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4200-355-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4676-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c556-329.dat family_gh0strat behavioral2/files/0x000c00000001c551-310.dat family_gh0strat behavioral2/memory/436-309-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4368-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c54d-285.dat family_gh0strat behavioral2/memory/5072-267-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c548-263.dat family_gh0strat behavioral2/memory/3440-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c544-241.dat family_gh0strat behavioral2/memory/3860-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c53f-219.dat family_gh0strat behavioral2/files/0x000c00000001c53b-200.dat family_gh0strat behavioral2/memory/2220-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5456-179-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1776-157-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2552-135-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c52f-131.dat family_gh0strat behavioral2/memory/708-113-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c52a-109.dat family_gh0strat behavioral2/memory/6072-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5600-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5288-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2733C36-F89E-4ca0-B484-3D4CE65FB8B3}\stubpath = "C:\\Windows\\system32\\inlgisalg.exe" inljhllwj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB639BB0-3CB7-4085-A4F3-F29D14ECF0FC}\stubpath = "C:\\Windows\\system32\\inlsmacbt.exe" invhwkmle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BFB0169-7E0E-4630-B3E1-4C71DF1E1BF2}\stubpath = "C:\\Windows\\system32\\inyaereiz.exe" inutvwllh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{87B70FF0-CBD5-4d54-B02F-0B6B73B41B00} inuydrpyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66A38456-94A8-4c35-87FF-3E73CC5801C9} inihodrxd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A60A2B33-E1B0-4845-A0EE-0BB02DAF01F8}\stubpath = "C:\\Windows\\system32\\inipelkjl.exe" inhxamofz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{262BEA23-8ACA-490c-BC52-D543E6ECC5A6}\stubpath = "C:\\Windows\\system32\\innfvgmpg.exe" infauwnfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F98239F-8824-439a-8907-721C9DA5EE76}\stubpath = "C:\\Windows\\system32\\iniuxcykh.exe" inckagkpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51C3BD3D-ADF2-4e1d-888C-3CB83927EE23}\stubpath = "C:\\Windows\\system32\\inkptwycw.exe" inlisltat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5477EC3D-6A63-43da-85E4-FA26BBAB6B97}\stubpath = "C:\\Windows\\system32\\indskelwb.exe" invuwaxma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACC25963-06D4-49ea-92C8-348EBE85E6A0}\stubpath = "C:\\Windows\\system32\\inytomigo.exe" injqkgmph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F71D6A55-6D23-48c5-B790-A3ABEA9A8F30}\stubpath = "C:\\Windows\\system32\\inttrrtqn.exe" insdtdypv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{262BEA23-8ACA-490c-BC52-D543E6ECC5A6} infauwnfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{171DB812-5085-4db0-B306-91803235DA37}\stubpath = "C:\\Windows\\system32\\inmbpckft.exe" invawifmu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{882B18FB-E6E6-4fa5-9B26-40CE8A43343B} invhauplr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88BCC8E5-16FE-458f-BDE2-F15575B907FB} iniowtbls.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6931EB7-27CF-4ab9-B712-2287E7C831F4} inmsuirlm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{66202958-257F-465b-B4DB-CF3D50BFDB1F}\stubpath = "C:\\Windows\\system32\\inumafjdj.exe" ineeenyiy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF18D2BA-0D75-47c2-87BF-7442E4630150}\stubpath = "C:\\Windows\\system32\\inbymawrk.exe" innqmfdal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06ADFEF9-6B49-4ed3-8C24-5F077F23324A}\stubpath = "C:\\Windows\\system32\\inefvqvoa.exe" inuakpshs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3072C80-6999-421e-B725-BF810A14E454} inemiltdh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE4833A2-F6EE-479c-94DA-FA9AA49F6C73} inuisngbw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28ECEAD0-16A9-483d-8444-9CE5EA360A4B} inwhpwale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{002A90A3-E2C9-4f43-9303-CB5EA72D448E} inlgphgbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7A00B21-1DBF-44ee-BD54-D28FCFA459A4}\stubpath = "C:\\Windows\\system32\\inycykdza.exe" invecggre.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{757A20E1-E4CB-4e45-99F5-23F53B2036A4} inuprpjqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C157D8D2-2F40-4f5c-A68A-D7E86FFF2DA9}\stubpath = "C:\\Windows\\system32\\intsuvkkg.exe" indvjzcoq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{331C82E6-8620-4282-A742-4AF72CC5856D}\stubpath = "C:\\Windows\\system32\\insjarhdx.exe" intxcqoxe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3378CE3-4BC1-4d36-94C5-7292485EC582} inzbahzkq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05D5E31D-1C28-47a2-814B-E5B99F936C21}\stubpath = "C:\\Windows\\system32\\infniwngs.exe" inpiqqmhr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{724DAB68-DB50-4406-AA12-19DD6D90FB4D}\stubpath = "C:\\Windows\\system32\\infhmqtvt.exe" inpdraxym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2849E31-8F36-4927-A504-0F6FBC4ACBBF}\stubpath = "C:\\Windows\\system32\\invhwkmle.exe" inomzqrdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DA3903D-5215-46e8-B771-3A17CB2E0709}\stubpath = "C:\\Windows\\system32\\injrhdzvq.exe" inddmxhxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FC6E6B7-F2D3-49fb-89A6-C7122C341C63} inncprues.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F13E8CC4-695A-4849-9BEF-BCB43FBA1FB0}\stubpath = "C:\\Windows\\system32\\inaqgiwze.exe" inycopaqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E162D662-6CC6-4318-9618-6787626EF27A} invatpnbv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{330C90D9-DD48-4c97-B295-17EA72BDCAD8}\stubpath = "C:\\Windows\\system32\\inlqjfngp.exe" inliirakg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D7DF2B5-C8E2-41d1-92A5-3924478B45C6} insrzztuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22307090-7850-479a-8D62-E5CA8E360DE9}\stubpath = "C:\\Windows\\system32\\ingfvhjng.exe" ingerepgv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2ED00E26-EEB4-4048-A5CA-22C5B4E7915F}\stubpath = "C:\\Windows\\system32\\injlxlxig.exe" ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B6D53A1-7FE5-4b86-8B62-09654159764D} inrfpuysy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3990C3B6-3442-45a1-BDE9-0666BF0B8EAC} inqzaupvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4BDBA38E-EAAC-4c61-B0F4-FD92EB3733D4}\stubpath = "C:\\Windows\\system32\\inuiybnpg.exe" intlkfhrk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AE22DCC-8E99-47a2-97FD-A8355DBFD0ED}\stubpath = "C:\\Windows\\system32\\insvsctst.exe" ingxqnxqy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24593DC9-5842-45d9-804A-B42BCDE41017}\stubpath = "C:\\Windows\\system32\\insylvfcw.exe" inxqlnlfy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E705079-63CB-497b-96A4-D6922E64FC19}\stubpath = "C:\\Windows\\system32\\inniombtb.exe" inrbvqwap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C27B7B7-62F3-4c1d-B8F3-C3CD44217102}\stubpath = "C:\\Windows\\system32\\inemwygil.exe" inhpdyhbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9BFE6C5-3364-4614-9036-8ABEEB81FFD2}\stubpath = "C:\\Windows\\system32\\inqzaupvo.exe" inlmosntr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{397692A1-D6A4-4292-8872-8CD08E05D21A} inhfbqsjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1C1AC24-AE62-4382-B01A-9295AFB3A793}\stubpath = "C:\\Windows\\system32\\inkdlvlhw.exe" inkdxsoui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C24E513-35C6-4333-A467-67DBBAA4271A}\stubpath = "C:\\Windows\\system32\\inpiqqmhr.exe" inwicolxs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB2007AF-EF35-4d16-BFA4-34BF60533822} innikicxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B1CBAF4-5BFB-4558-A41E-8BAFB4BB17FC} inrvvttvs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BF3DE7D-B054-465d-B200-527ECE45C4F4} inbaqtkjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F22E4173-BE33-4e71-A8C3-691FBEDFF467} inyfydwsq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B2BA7C0C-8B4D-4b09-8F00-8D59FF841FD2}\stubpath = "C:\\Windows\\system32\\inkdxsoui.exe" inooqnkpm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6FD7178-0A07-45f8-98D3-EADABF001555} insnxovkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BAD5B061-4A4B-4023-A044-1D875757A477} inxkpvpwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79202C44-B2EA-458f-BC46-37056E49FE34} inbjwysrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{061AFF19-D20A-4ee8-8FE0-6A058268A77F}\stubpath = "C:\\Windows\\system32\\inogwahsa.exe" injyqkarh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D762CD25-C2BB-40bf-A481-08815E8293D5}\stubpath = "C:\\Windows\\system32\\inocokdvj.exe" inphclvql.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B70569DE-13AF-409b-B557-28A31709FCB3} inwyzbftn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A884D2C-6710-4af4-AB6E-139F24403DEB} iniwaqpwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9B50804-E8C3-46e3-9A5A-A65A349F2E5F} inrnisxfb.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c00000001b834-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5288 inaexuhtj.exe 5600 insohtodl.exe 6072 inbuxzyre.exe 708 incgzwjvl.exe 2552 inmtnbdcu.exe 1776 inrdysgih.exe 5456 inhwoipfi.exe 2220 inpleqlxa.exe 3860 inqtvunam.exe 3440 inetlfmxc.exe 5072 inxiaqxbm.exe 4368 inoavpdfe.exe 436 invrckwrg.exe 4676 ingiuiufd.exe 4200 inmprqjiy.exe 2152 inqcxrfhg.exe 2928 infumgnyd.exe 6088 inyjbrycn.exe 3452 inortslka.exe 4500 inazpsjiq.exe 3260 ingtgabri.exe 5464 inldtepix.exe 5304 inuqbjvqf.exe 2036 inzvgovkd.exe 3784 inykznpoh.exe 4268 inwmpgfnn.exe 5112 inomzqrdt.exe 1420 invhwkmle.exe 5484 inlsmacbt.exe 1672 inpsutmlb.exe 4456 insezthji.exe 1360 inxhvtpha.exe 428 inigtklnv.exe 1044 inpbwqegf.exe 3960 infdqdofu.exe 4972 inbfyviuk.exe 3344 innqsrkjz.exe 1664 inbqiycju.exe 4152 insbquvhx.exe 5036 inhiypoew.exe 2824 inbjwysrs.exe 2408 inqjpgzht.exe 2080 insrzztuj.exe 2292 inyorihpp.exe 4128 inxtemyti.exe 4396 inaikwkwh.exe 3204 inknedlyl.exe 248 innlypqcs.exe 3088 indwztgsi.exe 2144 injyqkarh.exe 4196 inogwahsa.exe 5824 insvxwpco.exe 1956 inwixlnmf.exe 5628 injmdckxk.exe 2288 intpaiupe.exe 6104 inqgdzfrf.exe 4348 ingwzqpxx.exe 2360 innuocedv.exe 2536 inniyteex.exe 5724 indtwnmuu.exe 560 injfqeotx.exe 3944 inxnqhgoo.exe 4276 inesqmezb.exe 4704 ingvetxyk.exe - Loads dropped DLL 64 IoCs
pid Process 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 5288 inaexuhtj.exe 5288 inaexuhtj.exe 5600 insohtodl.exe 5600 insohtodl.exe 6072 inbuxzyre.exe 6072 inbuxzyre.exe 708 incgzwjvl.exe 708 incgzwjvl.exe 2552 inmtnbdcu.exe 2552 inmtnbdcu.exe 1776 inrdysgih.exe 1776 inrdysgih.exe 5456 inhwoipfi.exe 5456 inhwoipfi.exe 2220 inpleqlxa.exe 2220 inpleqlxa.exe 3860 inqtvunam.exe 3860 inqtvunam.exe 3440 inetlfmxc.exe 3440 inetlfmxc.exe 5072 inxiaqxbm.exe 5072 inxiaqxbm.exe 4368 inoavpdfe.exe 4368 inoavpdfe.exe 436 invrckwrg.exe 436 invrckwrg.exe 4676 ingiuiufd.exe 4676 ingiuiufd.exe 4200 inmprqjiy.exe 4200 inmprqjiy.exe 2152 inqcxrfhg.exe 2152 inqcxrfhg.exe 2928 infumgnyd.exe 2928 infumgnyd.exe 6088 inyjbrycn.exe 6088 inyjbrycn.exe 3452 inortslka.exe 3452 inortslka.exe 4500 inazpsjiq.exe 4500 inazpsjiq.exe 3260 ingtgabri.exe 3260 ingtgabri.exe 5464 inldtepix.exe 5464 inldtepix.exe 5304 inuqbjvqf.exe 5304 inuqbjvqf.exe 2036 inzvgovkd.exe 2036 inzvgovkd.exe 3784 inykznpoh.exe 3784 inykznpoh.exe 4268 inwmpgfnn.exe 4268 inwmpgfnn.exe 5112 inomzqrdt.exe 5112 inomzqrdt.exe 1420 invhwkmle.exe 1420 invhwkmle.exe 5484 inlsmacbt.exe 5484 inlsmacbt.exe 1672 inpsutmlb.exe 1672 inpsutmlb.exe 4456 insezthji.exe 4456 insezthji.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\incehxwfd.exe_lang.ini inhegsgsd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfdlthy.exe File created C:\Windows\SysWOW64\inkiqzgcy.exe inimthpzj.exe File opened for modification C:\Windows\SysWOW64\inyoeaukm.exe_lang.ini iniqjgqjr.exe File opened for modification C:\Windows\SysWOW64\inqcxrfhg.exe_lang.ini inmprqjiy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrxixhwa.exe File created C:\Windows\SysWOW64\intekobge.exe inbsbjtei.exe File opened for modification C:\Windows\SysWOW64\inuwftrhn.exe_lang.ini invqlwhhe.exe File created C:\Windows\SysWOW64\inktojpiu.exe inclpwksm.exe File opened for modification C:\Windows\SysWOW64\inhztqfaz.exe_lang.ini inhfnbzwf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingwgsygq.exe File opened for modification C:\Windows\SysWOW64\incgnutgo.exe_lang.ini inyxynpgc.exe File opened for modification C:\Windows\SysWOW64\inogwahsa.exe_lang.ini injyqkarh.exe File created C:\Windows\SysWOW64\inpdimgmm.exe indqsmlmh.exe File opened for modification C:\Windows\SysWOW64\invqlwhhe.exe_lang.ini inhgwhjlo.exe File created C:\Windows\SysWOW64\innjrlbrs.exe incldxuje.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invdmeyvk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inytvinyt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvnieka.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzjlpkqo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlsmacbt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indpalewk.exe File created C:\Windows\SysWOW64\incrjzdkv.exe ingfvhjng.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingvnhoze.exe File created C:\Windows\SysWOW64\incajnuiq.exe inckxztas.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuydrpyf.exe File created C:\Windows\SysWOW64\indzyzoqh.exe inazojdaz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmbpckft.exe File created C:\Windows\SysWOW64\invqlwhhe.exe inhgwhjlo.exe File created C:\Windows\SysWOW64\inrkqhiua.exe incybtpgq.exe File created C:\Windows\SysWOW64\inkdxsoui.exe inooqnkpm.exe File created C:\Windows\SysWOW64\inpiqqmhr.exe inwicolxs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insxoqkwb.exe File opened for modification C:\Windows\SysWOW64\inceohcod.exe_lang.ini inzpesupo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbbmmbxa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqrgtvyi.exe File created C:\Windows\SysWOW64\inwuyycww.exe inzewkdpr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invzesqzg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inncprues.exe File created C:\Windows\SysWOW64\innezovdr.exe invkhejgd.exe File opened for modification C:\Windows\SysWOW64\inotqnqky.exe_lang.ini intojzuff.exe File created C:\Windows\SysWOW64\inowqgwxz.exe inhoiekzn.exe File opened for modification C:\Windows\SysWOW64\inpgijgkr.exe_lang.ini inifasoed.exe File created C:\Windows\SysWOW64\intpaiupe.exe injmdckxk.exe File opened for modification C:\Windows\SysWOW64\inbnjcuis.exe_lang.ini inzloqpih.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmkoozmm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inihodrxd.exe File created C:\Windows\SysWOW64\inqofiykl.exe inffohdws.exe File opened for modification C:\Windows\SysWOW64\injfiqaer.exe_lang.ini inscoqhzp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingdjrovg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrvyeyxs.exe File created C:\Windows\SysWOW64\inxiaqxbm.exe inetlfmxc.exe File opened for modification C:\Windows\SysWOW64\inbsfowhf.exe_lang.ini inhwnltjf.exe File opened for modification C:\Windows\SysWOW64\incajnuiq.exe_lang.ini inckxztas.exe File opened for modification C:\Windows\SysWOW64\inkuaczqt.exe_lang.ini inaouaylq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incsdfhkz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infmbihgy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inypsuvxw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injausioy.exe File opened for modification C:\Windows\SysWOW64\inugvjlkd.exe_lang.ini ingtvpopk.exe File created C:\Windows\SysWOW64\indpalewk.exe intsuvkkg.exe File created C:\Windows\SysWOW64\inhzrfkoi.exe injsnioht.exe File created C:\Windows\SysWOW64\insulctjf.exe incbrdfjw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuwftrhn.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzhuwqpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language instvzuyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmjqbyiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqgyjlgf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inleuzbus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inghrhxds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdpokcq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztjzmib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inskscibo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indjvakex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyadmti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtkzjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indkgfezw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwldhtuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inergdafx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inifasoed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injhulmow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inngbnczn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqlzpgys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwfngdng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqfeufhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inltfhpes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intfcjrzb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incajnuiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyzbftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqofiykl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkwkupid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkvggzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inncqdlgu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkuzhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkuaczqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlvgkyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwonikuc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfnbzwf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqcxrfhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhzufqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqnbrgit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmhxsddw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmrhdpxe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkvbdqbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhyqlaum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insulijat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomzqrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incanalcr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxuxrboe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxavmale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inffruvhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innrmsqfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyxynpgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inumafjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogwahsa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniombtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzbahzkq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invpovkyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inycopaqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intnjpska.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inetgedis.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpnlpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inidwdyvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdxsoui.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 5288 inaexuhtj.exe 5288 inaexuhtj.exe 5600 insohtodl.exe 5600 insohtodl.exe 6072 inbuxzyre.exe 6072 inbuxzyre.exe 708 incgzwjvl.exe 708 incgzwjvl.exe 2552 inmtnbdcu.exe 2552 inmtnbdcu.exe 1776 inrdysgih.exe 1776 inrdysgih.exe 5456 inhwoipfi.exe 5456 inhwoipfi.exe 2220 inpleqlxa.exe 2220 inpleqlxa.exe 3860 inqtvunam.exe 3860 inqtvunam.exe 3440 inetlfmxc.exe 3440 inetlfmxc.exe 5072 inxiaqxbm.exe 5072 inxiaqxbm.exe 4368 inoavpdfe.exe 4368 inoavpdfe.exe 436 invrckwrg.exe 436 invrckwrg.exe 4676 ingiuiufd.exe 4676 ingiuiufd.exe 4200 inmprqjiy.exe 4200 inmprqjiy.exe 2152 inqcxrfhg.exe 2152 inqcxrfhg.exe 2928 infumgnyd.exe 2928 infumgnyd.exe 6088 inyjbrycn.exe 6088 inyjbrycn.exe 3452 inortslka.exe 3452 inortslka.exe 4500 inazpsjiq.exe 4500 inazpsjiq.exe 3260 ingtgabri.exe 3260 ingtgabri.exe 5464 inldtepix.exe 5464 inldtepix.exe 5304 inuqbjvqf.exe 5304 inuqbjvqf.exe 2036 inzvgovkd.exe 2036 inzvgovkd.exe 3784 inykznpoh.exe 3784 inykznpoh.exe 4268 inwmpgfnn.exe 4268 inwmpgfnn.exe 5112 inomzqrdt.exe 5112 inomzqrdt.exe 1420 invhwkmle.exe 1420 invhwkmle.exe 5484 inlsmacbt.exe 5484 inlsmacbt.exe 1672 inpsutmlb.exe 1672 inpsutmlb.exe 4456 insezthji.exe 4456 insezthji.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 5288 inaexuhtj.exe Token: SeDebugPrivilege 5600 insohtodl.exe Token: SeDebugPrivilege 6072 inbuxzyre.exe Token: SeDebugPrivilege 708 incgzwjvl.exe Token: SeDebugPrivilege 2552 inmtnbdcu.exe Token: SeDebugPrivilege 1776 inrdysgih.exe Token: SeDebugPrivilege 5456 inhwoipfi.exe Token: SeDebugPrivilege 2220 inpleqlxa.exe Token: SeDebugPrivilege 3860 inqtvunam.exe Token: SeDebugPrivilege 3440 inetlfmxc.exe Token: SeDebugPrivilege 5072 inxiaqxbm.exe Token: SeDebugPrivilege 4368 inoavpdfe.exe Token: SeDebugPrivilege 436 invrckwrg.exe Token: SeDebugPrivilege 4676 ingiuiufd.exe Token: SeDebugPrivilege 4200 inmprqjiy.exe Token: SeDebugPrivilege 2152 inqcxrfhg.exe Token: SeDebugPrivilege 2928 infumgnyd.exe Token: SeDebugPrivilege 6088 inyjbrycn.exe Token: SeDebugPrivilege 3452 inortslka.exe Token: SeDebugPrivilege 4500 inazpsjiq.exe Token: SeDebugPrivilege 3260 ingtgabri.exe Token: SeDebugPrivilege 5464 inldtepix.exe Token: SeDebugPrivilege 5304 inuqbjvqf.exe Token: SeDebugPrivilege 2036 inzvgovkd.exe Token: SeDebugPrivilege 3784 inykznpoh.exe Token: SeDebugPrivilege 4268 inwmpgfnn.exe Token: SeDebugPrivilege 5112 inomzqrdt.exe Token: SeDebugPrivilege 1420 invhwkmle.exe Token: SeDebugPrivilege 5484 inlsmacbt.exe Token: SeDebugPrivilege 1672 inpsutmlb.exe Token: SeDebugPrivilege 4456 insezthji.exe Token: SeDebugPrivilege 1360 inxhvtpha.exe Token: SeDebugPrivilege 428 inigtklnv.exe Token: SeDebugPrivilege 1044 inpbwqegf.exe Token: SeDebugPrivilege 3960 infdqdofu.exe Token: SeDebugPrivilege 4972 inbfyviuk.exe Token: SeDebugPrivilege 3344 innqsrkjz.exe Token: SeDebugPrivilege 1664 inbqiycju.exe Token: SeDebugPrivilege 4152 insbquvhx.exe Token: SeDebugPrivilege 5036 inhiypoew.exe Token: SeDebugPrivilege 2824 inbjwysrs.exe Token: SeDebugPrivilege 2408 inqjpgzht.exe Token: SeDebugPrivilege 2080 insrzztuj.exe Token: SeDebugPrivilege 2292 inyorihpp.exe Token: SeDebugPrivilege 4128 inxtemyti.exe Token: SeDebugPrivilege 4396 inaikwkwh.exe Token: SeDebugPrivilege 3204 inknedlyl.exe Token: SeDebugPrivilege 248 innlypqcs.exe Token: SeDebugPrivilege 3088 indwztgsi.exe Token: SeDebugPrivilege 2144 injyqkarh.exe Token: SeDebugPrivilege 4196 inogwahsa.exe Token: SeDebugPrivilege 5824 insvxwpco.exe Token: SeDebugPrivilege 1956 inwixlnmf.exe Token: SeDebugPrivilege 5628 injmdckxk.exe Token: SeDebugPrivilege 2288 intpaiupe.exe Token: SeDebugPrivilege 6104 inqgdzfrf.exe Token: SeDebugPrivilege 4348 ingwzqpxx.exe Token: SeDebugPrivilege 2360 innuocedv.exe Token: SeDebugPrivilege 2536 inniyteex.exe Token: SeDebugPrivilege 5724 indtwnmuu.exe Token: SeDebugPrivilege 560 injfqeotx.exe Token: SeDebugPrivilege 3944 inxnqhgoo.exe Token: SeDebugPrivilege 4276 inesqmezb.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 5288 inaexuhtj.exe 5600 insohtodl.exe 6072 inbuxzyre.exe 708 incgzwjvl.exe 2552 inmtnbdcu.exe 1776 inrdysgih.exe 5456 inhwoipfi.exe 2220 inpleqlxa.exe 3860 inqtvunam.exe 3440 inetlfmxc.exe 5072 inxiaqxbm.exe 4368 inoavpdfe.exe 436 invrckwrg.exe 4676 ingiuiufd.exe 4200 inmprqjiy.exe 2152 inqcxrfhg.exe 2928 infumgnyd.exe 6088 inyjbrycn.exe 3452 inortslka.exe 4500 inazpsjiq.exe 3260 ingtgabri.exe 5464 inldtepix.exe 5304 inuqbjvqf.exe 2036 inzvgovkd.exe 3784 inykznpoh.exe 4268 inwmpgfnn.exe 5112 inomzqrdt.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5140 wrote to memory of 5288 5140 2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 5288 wrote to memory of 5600 5288 inaexuhtj.exe 90 PID 5600 wrote to memory of 6072 5600 insohtodl.exe 91 PID 6072 wrote to memory of 708 6072 inbuxzyre.exe 92 PID 708 wrote to memory of 2552 708 incgzwjvl.exe 93 PID 2552 wrote to memory of 1776 2552 inmtnbdcu.exe 94 PID 1776 wrote to memory of 5456 1776 inrdysgih.exe 95 PID 5456 wrote to memory of 2220 5456 inhwoipfi.exe 96 PID 2220 wrote to memory of 3860 2220 inpleqlxa.exe 97 PID 3860 wrote to memory of 3440 3860 inqtvunam.exe 98 PID 3440 wrote to memory of 5072 3440 inetlfmxc.exe 99 PID 5072 wrote to memory of 4368 5072 inxiaqxbm.exe 100 PID 4368 wrote to memory of 436 4368 inoavpdfe.exe 101 PID 436 wrote to memory of 4676 436 invrckwrg.exe 102 PID 4676 wrote to memory of 4200 4676 ingiuiufd.exe 103 PID 4200 wrote to memory of 2152 4200 inmprqjiy.exe 104 PID 2152 wrote to memory of 2928 2152 inqcxrfhg.exe 105 PID 2928 wrote to memory of 6088 2928 infumgnyd.exe 106 PID 6088 wrote to memory of 3452 6088 inyjbrycn.exe 107 PID 3452 wrote to memory of 4500 3452 inortslka.exe 108 PID 4500 wrote to memory of 3260 4500 inazpsjiq.exe 109 PID 3260 wrote to memory of 5464 3260 ingtgabri.exe 110 PID 5464 wrote to memory of 5304 5464 inldtepix.exe 111 PID 5304 wrote to memory of 2036 5304 inuqbjvqf.exe 112 PID 2036 wrote to memory of 3784 2036 inzvgovkd.exe 113 PID 3784 wrote to memory of 4268 3784 inykznpoh.exe 114 PID 4268 wrote to memory of 5112 4268 inwmpgfnn.exe 115 PID 5112 wrote to memory of 1420 5112 inomzqrdt.exe 116 PID 1420 wrote to memory of 5484 1420 invhwkmle.exe 117 PID 5484 wrote to memory of 1672 5484 inlsmacbt.exe 118 PID 1672 wrote to memory of 4456 1672 inpsutmlb.exe 119 PID 4456 wrote to memory of 1360 4456 insezthji.exe 120 PID 1360 wrote to memory of 428 1360 inxhvtpha.exe 121 PID 428 wrote to memory of 1044 428 inigtklnv.exe 122 PID 1044 wrote to memory of 3960 1044 inpbwqegf.exe 123 PID 3960 wrote to memory of 4972 3960 infdqdofu.exe 124 PID 4972 wrote to memory of 3344 4972 inbfyviuk.exe 125 PID 3344 wrote to memory of 1664 3344 innqsrkjz.exe 126 PID 1664 wrote to memory of 4152 1664 inbqiycju.exe 127 PID 4152 wrote to memory of 5036 4152 insbquvhx.exe 128 PID 5036 wrote to memory of 2824 5036 inhiypoew.exe 129 PID 2824 wrote to memory of 2408 2824 inbjwysrs.exe 130 PID 2408 wrote to memory of 2080 2408 inqjpgzht.exe 131 PID 2080 wrote to memory of 2292 2080 insrzztuj.exe 132 PID 2292 wrote to memory of 4128 2292 inyorihpp.exe 133 PID 4128 wrote to memory of 4396 4128 inxtemyti.exe 134 PID 4396 wrote to memory of 3204 4396 inaikwkwh.exe 135 PID 3204 wrote to memory of 248 3204 inknedlyl.exe 136 PID 248 wrote to memory of 3088 248 innlypqcs.exe 137 PID 3088 wrote to memory of 2144 3088 indwztgsi.exe 138 PID 2144 wrote to memory of 4196 2144 injyqkarh.exe 139 PID 4196 wrote to memory of 5824 4196 inogwahsa.exe 140 PID 5824 wrote to memory of 1956 5824 insvxwpco.exe 141 PID 1956 wrote to memory of 5628 1956 inwixlnmf.exe 142 PID 5628 wrote to memory of 2288 5628 injmdckxk.exe 143 PID 2288 wrote to memory of 6104 2288 intpaiupe.exe 144 PID 6104 wrote to memory of 4348 6104 inqgdzfrf.exe 145 PID 4348 wrote to memory of 2360 4348 ingwzqpxx.exe 146 PID 2360 wrote to memory of 2536 2360 innuocedv.exe 147 PID 2536 wrote to memory of 5724 2536 inniyteex.exe 148 PID 5724 wrote to memory of 560 5724 indtwnmuu.exe 149 PID 560 wrote to memory of 3944 560 injfqeotx.exe 150 PID 3944 wrote to memory of 4276 3944 inxnqhgoo.exe 151 PID 4276 wrote to memory of 4704 4276 inesqmezb.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_23809839b2a2bffcbeba5bac886bd5ad_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe28⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe42⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe65⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe66⤵PID:4768
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe67⤵PID:4708
-
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe68⤵PID:5760
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe69⤵PID:5308
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe70⤵
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe71⤵PID:2464
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe72⤵PID:2964
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe73⤵PID:4740
-
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe74⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5864 -
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe75⤵
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe76⤵PID:256
-
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe77⤵PID:3724
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe78⤵PID:1980
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe79⤵PID:1252
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe80⤵PID:2892
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe81⤵PID:4904
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe82⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe83⤵PID:4620
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe84⤵PID:5360
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe85⤵PID:1712
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe86⤵PID:3328
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe87⤵PID:5976
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe88⤵PID:3492
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe89⤵
- Drops file in System32 directory
PID:2044 -
C:\Windows\SysWOW64\inbnjcuis.exeC:\Windows\system32\inbnjcuis.exe90⤵PID:3816
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe91⤵
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe92⤵PID:2300
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe93⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5136 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe94⤵PID:2860
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe95⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5660 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe96⤵PID:4300
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4780 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe98⤵PID:2652
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe99⤵
- Drops file in System32 directory
PID:5272 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe100⤵PID:2800
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe101⤵
- System Location Discovery: System Language Discovery
PID:3648 -
C:\Windows\SysWOW64\inxavmale.exeC:\Windows\system32\inxavmale.exe102⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe103⤵PID:5996
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe104⤵PID:2804
-
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe105⤵PID:2740
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe106⤵PID:5280
-
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe107⤵PID:4532
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe108⤵PID:5068
-
C:\Windows\SysWOW64\inrlmbbts.exeC:\Windows\system32\inrlmbbts.exe109⤵PID:1592
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe110⤵PID:5056
-
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe111⤵PID:260
-
C:\Windows\SysWOW64\inijzqpfx.exeC:\Windows\system32\inijzqpfx.exe112⤵PID:1132
-
C:\Windows\SysWOW64\indvjzcoq.exeC:\Windows\system32\indvjzcoq.exe113⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1432 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe114⤵
- Drops file in System32 directory
PID:1740 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe115⤵
- Drops file in System32 directory
PID:6076 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe116⤵PID:1920
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe117⤵PID:3768
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe118⤵PID:1300
-
C:\Windows\SysWOW64\inetcrvwi.exeC:\Windows\system32\inetcrvwi.exe119⤵PID:1320
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe120⤵PID:5872
-
C:\Windows\SysWOW64\inisglpjp.exeC:\Windows\system32\inisglpjp.exe121⤵PID:6128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-