Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/10/2026, 06:03
Behavioral task
behavioral1
Sample
2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261007-gr9vsstv2l
- SHA256 4c165db7b3a2250af5c35f1d837a145d2ef435c5bee576631718af5f96855510
- MD5 14964e46e90e4561e0997978f2dbaedf
- SHA1 15072469f940f559a529bf2a4dc56aded537c6af
- SHA512 7cdf3369dd15fbf88fe39291cb17ac5d2ee15ca7d438eea7f18275157fcc0267874e3c05d80d02ed09933e19088b561e0554a4f9e388eb4693dccc2250a41c72
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTw:RPjOa1NxyYtH1w
- TLSH T19315AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 50 IoCs
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x001200000001e549-13.dat family_gh0strat behavioral1/files/0x0009000000024396-22.dat family_gh0strat behavioral1/memory/3824-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024463-161.dat family_gh0strat behavioral1/files/0x000700000002446b-206.dat family_gh0strat behavioral1/memory/3848-654-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3128-646-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/812-611-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1392-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2968-590-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2584-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3940-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1624-533-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3024-515-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2520-496-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2552-476-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/920-440-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5032-437-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3812-419-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/5020-400-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4344-381-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024487-368.dat family_gh0strat behavioral1/memory/4336-360-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024483-345.dat family_gh0strat behavioral1/memory/4564-337-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002447f-322.dat family_gh0strat behavioral1/memory/2156-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002447b-299.dat family_gh0strat behavioral1/memory/1148-291-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024477-276.dat family_gh0strat behavioral1/memory/3476-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024473-253.dat family_gh0strat behavioral1/memory/2256-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002446f-230.dat family_gh0strat behavioral1/memory/4328-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3460-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024467-184.dat family_gh0strat behavioral1/memory/4160-176-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3396-153-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002445f-138.dat family_gh0strat behavioral1/memory/804-130-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002445b-115.dat family_gh0strat behavioral1/memory/680-100-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024457-92.dat family_gh0strat behavioral1/memory/1824-84-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024453-69.dat family_gh0strat behavioral1/memory/3824-61-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002444f-46.dat family_gh0strat behavioral1/memory/2328-32-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8EA5C4E-5CAA-4d05-A5D4-EE4A34966608}\stubpath = "C:\\Windows\\system32\\inffidabk.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD044C7F-5F6B-4a8c-AAB8-079C67400D1B} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{044CDDB9-C68F-47d1-AD78-88BD3EDDA064}\stubpath = "C:\\Windows\\system32\\inbpocqfb.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42B6422E-C473-4327-89BE-314A8C999988} inclwgwbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C0024B9-C963-4851-AEBB-6E574361BCA7} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E380B17-BA7D-4ecb-92C8-D6B79BA16606}\stubpath = "C:\\Windows\\system32\\inxbxjcyj.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EFDE12B-0C68-474e-B761-DC58ED5054F5} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12D28518-1B4D-443c-BD04-C12B54EDD931}\stubpath = "C:\\Windows\\system32\\inklecpuc.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00418975-02D9-4cbb-BF2C-6EB60C674493}\stubpath = "C:\\Windows\\system32\\inknedlyl.exe" injyqkarh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{416AD0BA-1D83-4775-BAFB-16233FD42B16} indqsmlmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA56E364-F786-49a9-9F4D-5F16AB6FB938}\stubpath = "C:\\Windows\\system32\\injztsuvk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D354DA03-AE32-45d6-B721-990FDE833706}\stubpath = "C:\\Windows\\system32\\indfsjnkl.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21EA5720-B313-4ccb-A37A-93531B01A325} incjmswjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7358030-B93D-48c2-8B8B-8B71FF41E205} inniombtb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{849A8069-6491-4009-9D44-A0169CB0BDA3}\stubpath = "C:\\Windows\\system32\\inrfvkmdx.exe" inuypzsaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21636EC6-9390-437e-8262-ED824B409C28}\stubpath = "C:\\Windows\\system32\\inbgwtosr.exe" intaefpaj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0784D361-FC9B-4d97-AFE5-6CB2F969948A} inluopbfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7003E414-C9C4-44bb-9E02-E3F89BC91E88}\stubpath = "C:\\Windows\\system32\\inasgqvzt.exe" inenraymu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C6130BF-1EB3-4468-8235-3B1A8B5E7AA8} inkmpnlpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4C8BE14-46FF-4ce2-80B9-3A123BFA55FF} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD2B6814-7E50-4d01-83C6-FBD4944EB494} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64AB6E9B-3182-400b-ABEC-48BE73C2A365}\stubpath = "C:\\Windows\\system32\\inirveqyf.exe" incbskfog.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E37D728F-8BB2-4544-9C5D-24418F027922} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{17841706-2115-4fcd-B3D5-2C2369E77C75} innezovdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD036554-3998-44b6-9F28-5A1D9EB8369E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F36BFBA-B6E9-4501-81C2-493BE98E44FF} inxuxrboe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F83F353A-0BA0-437f-B96B-99C9AD013B32}\stubpath = "C:\\Windows\\system32\\inwyoarng.exe" inspmpjxs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ACC403AA-B622-4a27-896E-239CE0CB525E} inyfydwsq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{272822AD-55BC-4d7e-8A90-E012AD962EAD} inbjwysrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4684A3FE-FB3C-428b-9E87-71EB0FE2D9B2} inznwqrda.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{618DED04-E4BD-4c5b-8B50-3756F01B0A4C} infagddmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35FFA292-7243-428c-B653-7794612A4A81}\stubpath = "C:\\Windows\\system32\\innqewfyl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F327A62-3EB4-4bef-93C5-6FB382A7D4FF}\stubpath = "C:\\Windows\\system32\\inqnnretv.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC8C07DB-A35B-422f-BEDF-B880DD5D9187} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A23CE634-1931-4b6f-96A3-559CEE06689B} infcpjolj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11EA8677-F4AA-4d56-ACB4-45C3E4FCD03B} inphclvql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5457B8A-63C8-4686-9980-9A90BBE9ED73}\stubpath = "C:\\Windows\\system32\\indbaqtlt.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E374FD0-5CB6-41cf-9C1F-44006222307C}\stubpath = "C:\\Windows\\system32\\indeoeuxa.exe" inlbjrbai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CE8FFD2-BD7B-4022-8F01-635144545261}\stubpath = "C:\\Windows\\system32\\insdtdypv.exe" inisucehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53C9BAF5-0689-45c6-8E70-C3FEB424D513}\stubpath = "C:\\Windows\\system32\\injhepyti.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7503835-652B-4dcd-8CA8-4AA8306AE1AF}\stubpath = "C:\\Windows\\system32\\inurycdnz.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADD26964-E353-408e-A449-6AC96E113500} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A1604A5-640C-4ecf-9435-319A8D62FC2D} inbaqtkjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{265F041D-E8F9-4286-BA5F-DD44F13DB990} inoqoipvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75B52A7E-CC00-459b-8A1E-D5D69B035BDF} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{135B2BCB-EE36-46b2-9F86-EED9FA5F80BF} inaivxrqr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D894474-971A-478a-A117-906DC33F930C}\stubpath = "C:\\Windows\\system32\\infhrodsv.exe" innbxlquo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2AF52F8A-5DD6-405a-8C4C-481BA2E8ADD1}\stubpath = "C:\\Windows\\system32\\inthmqkqb.exe" indpalewk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39A236B1-346C-4654-A982-26EA46FF34CE} inqzaupvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B06EEBD3-61FE-4f32-B352-B6090BDD6219} inqrggyxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07CED435-7EEF-4851-AF18-42FC09BB47C7} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5ADC18A-B2FB-4c31-B003-C4C6D6703FB1}\stubpath = "C:\\Windows\\system32\\inmzvnrrl.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C105987E-D01E-407f-B01D-01D17A3C7461}\stubpath = "C:\\Windows\\system32\\infudswxj.exe" inwgusogd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EF8B067-5182-4759-B627-161E29751D88} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{131B1192-B3E3-4fc8-B74B-2F03B2DA2D70}\stubpath = "C:\\Windows\\system32\\infvypoww.exe" indwztgsi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A4CF200-FB11-440b-8567-34F2DFB8ADD3} insfkvqkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1F54BF74-9A14-4b03-B653-B1E66F1FADDD} invatpnbv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{46A4E70E-2C2D-4bc5-A75F-1397E60F02EF}\stubpath = "C:\\Windows\\system32\\inyzokcmk.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF25F327-4D78-41d2-A039-1F559D78B1F1}\stubpath = "C:\\Windows\\system32\\invbgzwir.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{178103EB-3EA1-4342-96B3-C4E660EEADA1}\stubpath = "C:\\Windows\\system32\\inivlaoql.exe" indfkortr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABCFCACA-AFF9-43c0-9A9D-2BCC21384B20}\stubpath = "C:\\Windows\\system32\\inltysmya.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AFED11F-847E-42d1-82B7-FEE88F9CFC06} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3AD652FA-0E76-4741-A3A8-368544C3587F}\stubpath = "C:\\Windows\\system32\\inwtzamwg.exe" infpibkqn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E073FD1-5B2C-4e02-AF9D-0DAEBB9B0811} inekvuoko.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00080000000004eb-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3824 inbqiycju.exe 1824 indskelwb.exe 680 invhwkmle.exe 804 inykznpoh.exe 3396 inqmfrmyb.exe 4160 inpsutmlb.exe 3460 inqcxrfhg.exe 4328 insezthji.exe 2256 indtwnmuu.exe 3476 inhwoipfi.exe 1148 inkzrlbas.exe 2156 inmeufqjy.exe 4564 insohtodl.exe 4336 inuqbjvqf.exe 4344 inxtemyti.exe 5020 inzvgovkd.exe 3812 inbfyviuk.exe 920 inpleqlxa.exe 5032 inrngsnzc.exe 2552 inrdysgih.exe 2520 intfuikjc.exe 3024 inwixlnmf.exe 1624 ingwzqpxx.exe 3940 innqsrkjz.exe 2584 invuwaxma.exe 2968 insvxwpco.exe 812 inbrulkss.exe 1392 inopeewva.exe 3848 inixpjqgj.exe 3128 inlsmacbt.exe 4476 innuocedv.exe 980 inyorihpp.exe 2832 inbaqtkjr.exe 3512 inlvjosms.exe 820 ingtgabri.exe 4292 inilcbjwj.exe 216 inmtnbdcu.exe 3868 inpbwqegf.exe 3656 inazpsjiq.exe 5024 inugvjlkd.exe 3716 ineuxonvv.exe 2240 injyqkarh.exe 732 inknedlyl.exe 5164 inogwahsa.exe 5252 inqklaasr.exe 5344 inetlfmxc.exe 5436 ingvnhoze.exe 5532 inkbaivic.exe 5620 injmdckxk.exe 5704 innfvgrkz.exe 5808 incanalcr.exe 5896 inecpcnet.exe 5988 inhfsfaqh.exe 6080 inahuhbcs.exe 3676 inefvmlzb.exe 4220 inlofemzm.exe 2124 injkrqgyq.exe 1396 incrjzdkv.exe 2276 infumgnyd.exe 2828 inxhvtpha.exe 4132 inyjbrycn.exe 1508 inhwnltjf.exe 4856 injwnoaqy.exe 3832 innlypqcs.exe - Loads dropped DLL 64 IoCs
pid Process 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 3824 inbqiycju.exe 3824 inbqiycju.exe 1824 indskelwb.exe 1824 indskelwb.exe 680 invhwkmle.exe 680 invhwkmle.exe 804 inykznpoh.exe 804 inykznpoh.exe 3396 inqmfrmyb.exe 3396 inqmfrmyb.exe 4160 inpsutmlb.exe 4160 inpsutmlb.exe 3460 inqcxrfhg.exe 3460 inqcxrfhg.exe 4328 insezthji.exe 4328 insezthji.exe 2256 indtwnmuu.exe 2256 indtwnmuu.exe 3476 inhwoipfi.exe 3476 inhwoipfi.exe 1148 inkzrlbas.exe 1148 inkzrlbas.exe 2156 inmeufqjy.exe 2156 inmeufqjy.exe 4564 insohtodl.exe 4564 insohtodl.exe 4336 inuqbjvqf.exe 4336 inuqbjvqf.exe 4344 inxtemyti.exe 4344 inxtemyti.exe 5020 inzvgovkd.exe 5020 inzvgovkd.exe 3812 inbfyviuk.exe 3812 inbfyviuk.exe 920 inpleqlxa.exe 920 inpleqlxa.exe 5032 inrngsnzc.exe 5032 inrngsnzc.exe 2552 inrdysgih.exe 2552 inrdysgih.exe 2520 intfuikjc.exe 2520 intfuikjc.exe 3024 inwixlnmf.exe 3024 inwixlnmf.exe 1624 ingwzqpxx.exe 1624 ingwzqpxx.exe 3940 innqsrkjz.exe 3940 innqsrkjz.exe 2584 invuwaxma.exe 2584 invuwaxma.exe 2968 insvxwpco.exe 2968 insvxwpco.exe 812 inbrulkss.exe 812 inbrulkss.exe 1392 inopeewva.exe 1392 inopeewva.exe 3848 inixpjqgj.exe 3848 inixpjqgj.exe 3128 inlsmacbt.exe 3128 inlsmacbt.exe 4476 innuocedv.exe 4476 innuocedv.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\intfcjrzb.exe_lang.ini ineltpsko.exe File created C:\Windows\SysWOW64\inwxsplcy.exe inswsewhq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\insvxwpco.exe invuwaxma.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqofiykl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxqlnlfy.exe File opened for modification C:\Windows\SysWOW64\inytomigo.exe_lang.ini inbpjipes.exe File created C:\Windows\SysWOW64\inyxgeiit.exe inkdxsoui.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\infuacfhw.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\intxedkzb.exe Process not Found File created C:\Windows\SysWOW64\incbrcegj.exe inrtwgusw.exe File opened for modification C:\Windows\SysWOW64\inrvkfwvq.exe_lang.ini inufueytz.exe File opened for modification C:\Windows\SysWOW64\inwbpkebv.exe_lang.ini iniaooxbd.exe File opened for modification C:\Windows\SysWOW64\inqgtiysg.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inyxynpgc.exe Process not Found File opened for modification C:\Windows\SysWOW64\insbwlddg.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inifltqxi.exe Process not Found File opened for modification C:\Windows\SysWOW64\inrngsnzc.exe_lang.ini inpleqlxa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infhthtec.exe File created C:\Windows\SysWOW64\invzzdxxz.exe invspsmvj.exe File created C:\Windows\SysWOW64\inxzfxryi.exe inngonulb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inqsaafql.exe Process not Found File created C:\Windows\SysWOW64\inoxlbteg.exe inmlwcerc.exe File opened for modification C:\Windows\SysWOW64\injkhlstg.exe_lang.ini inwviqlnv.exe File opened for modification C:\Windows\SysWOW64\intxxroqg.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat ingoxeawx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insulijat.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inddyhqyz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\infswsuoa.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inkbaivic.exe File created C:\Windows\SysWOW64\inzydrlkr.exe intuwvzao.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuydrpyf.exe File created C:\Windows\SysWOW64\inojxnmke.exe ineyhbpzk.exe File created C:\Windows\SysWOW64\innhtopku.exe Process not Found File opened for modification C:\Windows\SysWOW64\inybnkijx.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\incmxmtri.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inckxztas.exe incwvxbyn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuytzxmg.exe File opened for modification C:\Windows\SysWOW64\indfsjnkl.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inhfsfaqh.exe inecpcnet.exe File created C:\Windows\SysWOW64\inwrmkgem.exe instvzuyn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invfswsxy.exe File opened for modification C:\Windows\SysWOW64\inpycaeoc.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhegsgsd.exe inofbieyd.exe File created C:\Windows\SysWOW64\inesiwrli.exe inswrxvke.exe File created C:\Windows\SysWOW64\invatpnbv.exe inqbjpnmx.exe File opened for modification C:\Windows\SysWOW64\injzuzsez.exe_lang.ini indvpwggs.exe File opened for modification C:\Windows\SysWOW64\injbgrtdu.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inupalliz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxujybfr.exe File created C:\Windows\SysWOW64\inczcjnct.exe Process not Found File created C:\Windows\SysWOW64\inqkwrscb.exe Process not Found File opened for modification C:\Windows\SysWOW64\inapytoun.exe_lang.ini inatybwnb.exe File opened for modification C:\Windows\SysWOW64\incjmswjo.exe_lang.ini inakrpgjz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inueaqidm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\intrfzlnv.exe Process not Found - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inijzqpfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhgwhjlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaulrodd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxsdoolp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpuyhvwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqlzpgys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlvgkyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inctpigdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insgoyikn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbrocsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intrqbfmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inujlcwuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injrhdzvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingwzqpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indscwrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhlazdts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intvfbarj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwzdpqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfsfaqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inruwvobn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxuxrboe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbhrywnq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmoufcdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaikwkwh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtyvsvp.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 3824 inbqiycju.exe 3824 inbqiycju.exe 1824 indskelwb.exe 1824 indskelwb.exe 680 invhwkmle.exe 680 invhwkmle.exe 804 inykznpoh.exe 804 inykznpoh.exe 3396 inqmfrmyb.exe 3396 inqmfrmyb.exe 4160 inpsutmlb.exe 4160 inpsutmlb.exe 3460 inqcxrfhg.exe 3460 inqcxrfhg.exe 4328 insezthji.exe 4328 insezthji.exe 2256 indtwnmuu.exe 2256 indtwnmuu.exe 3476 inhwoipfi.exe 3476 inhwoipfi.exe 1148 inkzrlbas.exe 1148 inkzrlbas.exe 2156 inmeufqjy.exe 2156 inmeufqjy.exe 4564 insohtodl.exe 4564 insohtodl.exe 4336 inuqbjvqf.exe 4336 inuqbjvqf.exe 4344 inxtemyti.exe 4344 inxtemyti.exe 5020 inzvgovkd.exe 5020 inzvgovkd.exe 3812 inbfyviuk.exe 3812 inbfyviuk.exe 920 inpleqlxa.exe 920 inpleqlxa.exe 5032 inrngsnzc.exe 5032 inrngsnzc.exe 2552 inrdysgih.exe 2552 inrdysgih.exe 2520 intfuikjc.exe 2520 intfuikjc.exe 3024 inwixlnmf.exe 3024 inwixlnmf.exe 1624 ingwzqpxx.exe 1624 ingwzqpxx.exe 3940 innqsrkjz.exe 3940 innqsrkjz.exe 2584 invuwaxma.exe 2584 invuwaxma.exe 2968 insvxwpco.exe 2968 insvxwpco.exe 812 inbrulkss.exe 812 inbrulkss.exe 1392 inopeewva.exe 1392 inopeewva.exe 3848 inixpjqgj.exe 3848 inixpjqgj.exe 3128 inlsmacbt.exe 3128 inlsmacbt.exe 4476 innuocedv.exe 4476 innuocedv.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 3824 inbqiycju.exe Token: SeDebugPrivilege 1824 indskelwb.exe Token: SeDebugPrivilege 680 invhwkmle.exe Token: SeDebugPrivilege 804 inykznpoh.exe Token: SeDebugPrivilege 3396 inqmfrmyb.exe Token: SeDebugPrivilege 4160 inpsutmlb.exe Token: SeDebugPrivilege 3460 inqcxrfhg.exe Token: SeDebugPrivilege 4328 insezthji.exe Token: SeDebugPrivilege 2256 indtwnmuu.exe Token: SeDebugPrivilege 3476 inhwoipfi.exe Token: SeDebugPrivilege 1148 inkzrlbas.exe Token: SeDebugPrivilege 2156 inmeufqjy.exe Token: SeDebugPrivilege 4564 insohtodl.exe Token: SeDebugPrivilege 4336 inuqbjvqf.exe Token: SeDebugPrivilege 4344 inxtemyti.exe Token: SeDebugPrivilege 5020 inzvgovkd.exe Token: SeDebugPrivilege 3812 inbfyviuk.exe Token: SeDebugPrivilege 920 inpleqlxa.exe Token: SeDebugPrivilege 5032 inrngsnzc.exe Token: SeDebugPrivilege 2552 inrdysgih.exe Token: SeDebugPrivilege 2520 intfuikjc.exe Token: SeDebugPrivilege 3024 inwixlnmf.exe Token: SeDebugPrivilege 1624 ingwzqpxx.exe Token: SeDebugPrivilege 3940 innqsrkjz.exe Token: SeDebugPrivilege 2584 invuwaxma.exe Token: SeDebugPrivilege 2968 insvxwpco.exe Token: SeDebugPrivilege 812 inbrulkss.exe Token: SeDebugPrivilege 1392 inopeewva.exe Token: SeDebugPrivilege 3848 inixpjqgj.exe Token: SeDebugPrivilege 3128 inlsmacbt.exe Token: SeDebugPrivilege 4476 innuocedv.exe Token: SeDebugPrivilege 980 inyorihpp.exe Token: SeDebugPrivilege 2832 inbaqtkjr.exe Token: SeDebugPrivilege 3512 inlvjosms.exe Token: SeDebugPrivilege 820 ingtgabri.exe Token: SeDebugPrivilege 4292 inilcbjwj.exe Token: SeDebugPrivilege 216 inmtnbdcu.exe Token: SeDebugPrivilege 3868 inpbwqegf.exe Token: SeDebugPrivilege 3656 inazpsjiq.exe Token: SeDebugPrivilege 5024 inugvjlkd.exe Token: SeDebugPrivilege 3716 ineuxonvv.exe Token: SeDebugPrivilege 2240 injyqkarh.exe Token: SeDebugPrivilege 732 inknedlyl.exe Token: SeDebugPrivilege 5164 inogwahsa.exe Token: SeDebugPrivilege 5252 inqklaasr.exe Token: SeDebugPrivilege 5344 inetlfmxc.exe Token: SeDebugPrivilege 5436 ingvnhoze.exe Token: SeDebugPrivilege 5532 inkbaivic.exe Token: SeDebugPrivilege 5620 injmdckxk.exe Token: SeDebugPrivilege 5704 innfvgrkz.exe Token: SeDebugPrivilege 5808 incanalcr.exe Token: SeDebugPrivilege 5896 inecpcnet.exe Token: SeDebugPrivilege 5988 inhfsfaqh.exe Token: SeDebugPrivilege 6080 inahuhbcs.exe Token: SeDebugPrivilege 3676 inefvmlzb.exe Token: SeDebugPrivilege 4220 inlofemzm.exe Token: SeDebugPrivilege 2124 injkrqgyq.exe Token: SeDebugPrivilege 1396 incrjzdkv.exe Token: SeDebugPrivilege 2276 infumgnyd.exe Token: SeDebugPrivilege 2828 inxhvtpha.exe Token: SeDebugPrivilege 4132 inyjbrycn.exe Token: SeDebugPrivilege 1508 inhwnltjf.exe Token: SeDebugPrivilege 4856 injwnoaqy.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 3824 inbqiycju.exe 1824 indskelwb.exe 680 invhwkmle.exe 804 inykznpoh.exe 3396 inqmfrmyb.exe 4160 inpsutmlb.exe 3460 inqcxrfhg.exe 4328 insezthji.exe 2256 indtwnmuu.exe 3476 inhwoipfi.exe 1148 inkzrlbas.exe 2156 inmeufqjy.exe 4564 insohtodl.exe 4336 inuqbjvqf.exe 4344 inxtemyti.exe 5020 inzvgovkd.exe 3812 inbfyviuk.exe 920 inpleqlxa.exe 5032 inrngsnzc.exe 2552 inrdysgih.exe 2520 intfuikjc.exe 3024 inwixlnmf.exe 1624 ingwzqpxx.exe 3940 innqsrkjz.exe 2584 invuwaxma.exe 2968 insvxwpco.exe 812 inbrulkss.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 3824 2328 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 88 PID 3824 wrote to memory of 1824 3824 inbqiycju.exe 89 PID 1824 wrote to memory of 680 1824 indskelwb.exe 90 PID 680 wrote to memory of 804 680 invhwkmle.exe 91 PID 804 wrote to memory of 3396 804 inykznpoh.exe 92 PID 3396 wrote to memory of 4160 3396 inqmfrmyb.exe 93 PID 4160 wrote to memory of 3460 4160 inpsutmlb.exe 94 PID 3460 wrote to memory of 4328 3460 inqcxrfhg.exe 95 PID 4328 wrote to memory of 2256 4328 insezthji.exe 96 PID 2256 wrote to memory of 3476 2256 indtwnmuu.exe 97 PID 3476 wrote to memory of 1148 3476 inhwoipfi.exe 98 PID 1148 wrote to memory of 2156 1148 inkzrlbas.exe 99 PID 2156 wrote to memory of 4564 2156 inmeufqjy.exe 100 PID 4564 wrote to memory of 4336 4564 insohtodl.exe 101 PID 4336 wrote to memory of 4344 4336 inuqbjvqf.exe 102 PID 4344 wrote to memory of 5020 4344 inxtemyti.exe 103 PID 5020 wrote to memory of 3812 5020 inzvgovkd.exe 104 PID 3812 wrote to memory of 920 3812 inbfyviuk.exe 105 PID 920 wrote to memory of 5032 920 inpleqlxa.exe 106 PID 5032 wrote to memory of 2552 5032 inrngsnzc.exe 107 PID 2552 wrote to memory of 2520 2552 inrdysgih.exe 108 PID 2520 wrote to memory of 3024 2520 intfuikjc.exe 109 PID 3024 wrote to memory of 1624 3024 inwixlnmf.exe 110 PID 1624 wrote to memory of 3940 1624 ingwzqpxx.exe 111 PID 3940 wrote to memory of 2584 3940 innqsrkjz.exe 112 PID 2584 wrote to memory of 2968 2584 invuwaxma.exe 113 PID 2968 wrote to memory of 812 2968 insvxwpco.exe 114 PID 812 wrote to memory of 1392 812 inbrulkss.exe 115 PID 1392 wrote to memory of 3848 1392 inopeewva.exe 116 PID 3848 wrote to memory of 3128 3848 inixpjqgj.exe 117 PID 3128 wrote to memory of 4476 3128 inlsmacbt.exe 118 PID 4476 wrote to memory of 980 4476 innuocedv.exe 119 PID 980 wrote to memory of 2832 980 inyorihpp.exe 120 PID 2832 wrote to memory of 3512 2832 inbaqtkjr.exe 121 PID 3512 wrote to memory of 820 3512 inlvjosms.exe 122 PID 820 wrote to memory of 4292 820 ingtgabri.exe 123 PID 4292 wrote to memory of 216 4292 inilcbjwj.exe 124 PID 216 wrote to memory of 3868 216 inmtnbdcu.exe 125 PID 3868 wrote to memory of 3656 3868 inpbwqegf.exe 126 PID 3656 wrote to memory of 5024 3656 inazpsjiq.exe 127 PID 5024 wrote to memory of 3716 5024 inugvjlkd.exe 128 PID 3716 wrote to memory of 2240 3716 ineuxonvv.exe 129 PID 2240 wrote to memory of 732 2240 injyqkarh.exe 130 PID 732 wrote to memory of 5164 732 inknedlyl.exe 131 PID 5164 wrote to memory of 5252 5164 inogwahsa.exe 132 PID 5252 wrote to memory of 5344 5252 inqklaasr.exe 133 PID 5344 wrote to memory of 5436 5344 inetlfmxc.exe 134 PID 5436 wrote to memory of 5532 5436 ingvnhoze.exe 135 PID 5532 wrote to memory of 5620 5532 inkbaivic.exe 136 PID 5620 wrote to memory of 5704 5620 injmdckxk.exe 137 PID 5704 wrote to memory of 5808 5704 innfvgrkz.exe 138 PID 5808 wrote to memory of 5896 5808 incanalcr.exe 139 PID 5896 wrote to memory of 5988 5896 inecpcnet.exe 140 PID 5988 wrote to memory of 6080 5988 inhfsfaqh.exe 141 PID 6080 wrote to memory of 3676 6080 inahuhbcs.exe 142 PID 3676 wrote to memory of 4220 3676 inefvmlzb.exe 143 PID 4220 wrote to memory of 2124 4220 inlofemzm.exe 144 PID 2124 wrote to memory of 1396 2124 injkrqgyq.exe 145 PID 1396 wrote to memory of 2276 1396 incrjzdkv.exe 146 PID 2276 wrote to memory of 2828 2276 infumgnyd.exe 147 PID 2828 wrote to memory of 4132 2828 inxhvtpha.exe 148 PID 4132 wrote to memory of 1508 4132 inyjbrycn.exe 149 PID 1508 wrote to memory of 4856 1508 inhwnltjf.exe 150 PID 4856 wrote to memory of 3832 4856 injwnoaqy.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe34⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\inlvjosms.exeC:\Windows\system32\inlvjosms.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe43⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe65⤵
- Executes dropped EXE
PID:3832 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe66⤵PID:5028
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe67⤵PID:2608
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe68⤵PID:1064
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe69⤵PID:808
-
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe70⤵PID:5188
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe71⤵PID:5276
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe72⤵PID:5360
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe73⤵PID:5464
-
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe74⤵PID:5548
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe75⤵PID:5640
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe76⤵PID:3508
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe77⤵PID:5816
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe78⤵PID:1620
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe79⤵PID:5980
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe80⤵PID:6068
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe81⤵PID:1016
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe82⤵PID:1820
-
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe83⤵PID:1100
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe84⤵PID:4776
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe85⤵PID:2616
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe86⤵PID:5536
-
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe87⤵PID:1988
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe88⤵PID:4236
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe89⤵PID:1756
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe90⤵PID:1516
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe91⤵PID:6000
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe92⤵PID:1572
-
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe93⤵PID:5056
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe94⤵PID:4052
-
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe95⤵PID:5172
-
C:\Windows\SysWOW64\infsuonoj.exeC:\Windows\system32\infsuonoj.exe96⤵PID:5248
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5324 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe98⤵PID:5400
-
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe99⤵PID:1916
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe100⤵PID:5568
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe101⤵PID:5656
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe102⤵PID:3732
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe103⤵PID:5804
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe104⤵PID:2432
-
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe105⤵PID:5964
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe106⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2632 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe107⤵PID:6140
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe108⤵PID:4352
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe109⤵PID:4956
-
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe110⤵PID:5520
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe111⤵PID:1252
-
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe112⤵PID:1772
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe113⤵PID:5688
-
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe114⤵PID:4900
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe115⤵PID:4536
-
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe116⤵PID:3896
-
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe117⤵
- Boot or Logon Autostart Execution: Active Setup
PID:204 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe118⤵PID:1368
-
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\system32\indeulkya.exe119⤵PID:1032
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe120⤵
- System Location Discovery: System Language Discovery
PID:6084 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe121⤵PID:3736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-