Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/10/2026, 06:50
Behavioral task
behavioral1
Sample
2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261025-hl87rage45
- SHA256 179b98b453069e6ef7e68dec87c562052b6e281d97ed9e8349683bb2bd51e9ab
- MD5 d2e9bb1684e356837864011de5ab3705
- SHA1 d9317c196c800c9a5848398afb22beebb5141006
- SHA512 969b968433254aabe3944b38bc0930d09983d3dc883bba152800b9e25ed597781020548374e380886f2306bf20ef9915391f21e191298b4ad37cd83b6cf63d4e
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTk:RPjOa1NxyYtH1k
- TLSH T19015AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 51 IoCs
resource yara_rule behavioral1/memory/4420-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000800000002446c-10.dat family_gh0strat behavioral1/files/0x0007000000024471-18.dat family_gh0strat behavioral1/memory/4420-26-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024476-44.dat family_gh0strat behavioral1/memory/2640-630-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3840-627-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4680-611-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3164-592-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3600-573-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2508-554-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1936-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1792-515-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3980-495-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/2012-471-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3980-467-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3464-458-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/924-439-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1264-420-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/3632-401-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000244ae-368.dat family_gh0strat behavioral1/memory/1112-361-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1176-358-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000244aa-344.dat family_gh0strat behavioral1/memory/5056-336-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000244a6-321.dat family_gh0strat behavioral1/memory/1208-313-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x00070000000244a2-298.dat family_gh0strat behavioral1/memory/4500-291-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002449e-275.dat family_gh0strat behavioral1/memory/3976-269-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002449a-252.dat family_gh0strat behavioral1/memory/4024-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024496-229.dat family_gh0strat behavioral1/memory/3996-221-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024492-206.dat family_gh0strat behavioral1/memory/340-198-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002448e-183.dat family_gh0strat behavioral1/memory/1608-175-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002448a-160.dat family_gh0strat behavioral1/memory/1028-152-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000024486-137.dat family_gh0strat behavioral1/files/0x0007000000024482-115.dat family_gh0strat behavioral1/memory/1464-108-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/4016-105-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002447e-91.dat family_gh0strat behavioral1/memory/2132-83-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x000700000002447a-68.dat family_gh0strat behavioral1/memory/1588-54-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/memory/1588-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral1/files/0x0007000000025dca-26550.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{563B95CE-6FDC-4e9c-AD20-9CAD5E538767}\stubpath = "C:\\Windows\\system32\\inleqpldr.exe" inktojpiu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0524AA7D-B888-478e-87EF-EFDF3F7B3FEF}\stubpath = "C:\\Windows\\system32\\inuvkxzmd.exe" inrvkfwvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB17323D-D817-4b3a-8319-264D2D4F2F23}\stubpath = "C:\\Windows\\system32\\infslrijv.exe" invhwkmle.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6823BE59-C2EB-4933-B391-66AF4009CA98}\stubpath = "C:\\Windows\\system32\\inrbvqwap.exe" inomgbvam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E656D57-0C83-4a14-A7AE-BC2962994EF2}\stubpath = "C:\\Windows\\system32\\ingwrhiby.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C1E00ED-2022-4009-888F-C93EEEC51750}\stubpath = "C:\\Windows\\system32\\inkbuopru.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1184BF9-FC41-4873-9456-46F1726029E7}\stubpath = "C:\\Windows\\system32\\injtfgcrw.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2CF36366-449E-4076-AC5D-93E83B47136E}\stubpath = "C:\\Windows\\system32\\inkuaczqt.exe" inmawkptn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34AF89B0-28A4-4ea3-9902-79C6B7E7394A} insuxuebv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{21CCE7EF-7AC6-412d-8FF1-2D6C0334BC0B}\stubpath = "C:\\Windows\\system32\\innlcgcaj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50E3B95C-7CBE-46d7-A4C7-EA9DB66C8472}\stubpath = "C:\\Windows\\system32\\inyrceeqm.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{290BD9F6-5C04-4839-8BFB-16F194986D57}\stubpath = "C:\\Windows\\system32\\incrjzdkv.exe" inpbwqegf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A761118-500F-4063-82E8-550CAE1A3C9C}\stubpath = "C:\\Windows\\system32\\inmqlrpew.exe" infhrodsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82271224-C7D0-4040-AD38-6B9151F6653A} inahiaqgt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D19BFE6E-12D5-48f8-B227-16FF1694527E} insuknjca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{372F237A-189B-4dd3-9621-77D0E451F585}\stubpath = "C:\\Windows\\system32\\inbykggsa.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4759AEE-D13D-4c59-A67B-BC97691BB24C} intxcqoxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76B37C5F-B42D-4dfa-8ADA-04DFABB1EF69}\stubpath = "C:\\Windows\\system32\\inimbeutc.exe" ingkycsra.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36C82F1A-CFA6-411e-A372-F4690F2AB119} incgncjih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F8639D5-8F6D-421b-BA35-F3A0FDDCCA5E}\stubpath = "C:\\Windows\\system32\\injzhncuq.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4B29470-B4D3-452a-9E8F-3D3088FE20BC}\stubpath = "C:\\Windows\\system32\\iniilcgde.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BEEC2ACC-ED55-450f-B768-17137146127F}\stubpath = "C:\\Windows\\system32\\inwrtglwr.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9EC73BB-B2A6-40d0-8030-77762C7B6E3A} ineykmuaj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BE42E15-0D1E-43f3-B27F-C7142FA98338}\stubpath = "C:\\Windows\\system32\\inynvzzzr.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59C37B26-B099-4a04-B23A-7AD9D9E44630}\stubpath = "C:\\Windows\\system32\\inxitdtqe.exe" inzydrlkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C3C1F7A-5A8C-4f18-B766-AB5C73260D92} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68F28FF2-B046-4ea7-8AFE-4A830795D3C1}\stubpath = "C:\\Windows\\system32\\inwaugtok.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64FD9162-7F5A-479b-850A-06FB093B746C}\stubpath = "C:\\Windows\\system32\\indhkzmkj.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{417B28AF-F160-47b1-A69F-42B04AA6C7E2}\stubpath = "C:\\Windows\\system32\\inrpojtkr.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{90B87B1C-34D9-485e-956C-76DB1E4AC935} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73E96FE9-7C70-4236-B72B-74574427A0AA}\stubpath = "C:\\Windows\\system32\\inqxbfmkb.exe" ineeenyiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6761FEB9-9CC5-49d3-9B4E-E5254828E546} inkfpgznc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{298910CA-A083-4f38-8CBA-9D4E173B272B} injfiqaer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A82A4A6-40D3-49e2-88A9-51F93CF7846D}\stubpath = "C:\\Windows\\system32\\insjlhotv.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{918A7CD5-C2DB-4dd4-84AE-D39400FC5CC8} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{11B58532-A375-4b2f-9DDA-A80C2F8ED5BB}\stubpath = "C:\\Windows\\system32\\inarvdxgu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A4E87EF-00C9-47cf-8C5A-7FD1D14DA281}\stubpath = "C:\\Windows\\system32\\inbnjexfy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{984F9CC1-90EF-4125-819F-06E2F5CA9A71}\stubpath = "C:\\Windows\\system32\\inhfsfaqh.exe" inecpcnet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8ABC5F68-4C85-4dce-82C0-6E63E3847812} ineqbmfxl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02949659-EA9E-4c20-A75B-ED1087A592CF}\stubpath = "C:\\Windows\\system32\\inlcfvhzy.exe" inzewkdpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51CE935E-9002-4d8b-A944-070CD5D43BF8} inmwmixdn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB96C976-5D3D-4067-95A1-1283A7A66172} injexeazw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F945E949-F1C6-4f07-8529-3E68E302E2C2} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{531B5204-D953-47bb-9B8A-F8CD33D05F1E} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0ED604B7-6E46-4e93-8F27-EC64DA6156A5} inykznpoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B46CDE58-3B91-4367-BF16-4E0816C438D0}\stubpath = "C:\\Windows\\system32\\infdztmdj.exe" inqjvuqid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF4D84B2-B6FE-4a77-835D-EA1462E88281}\stubpath = "C:\\Windows\\system32\\innmevplr.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB2964D5-2171-4628-9911-6CE72FA521A3} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03AACA48-3EE8-4d31-A7AD-18B9E2C83F52} inruwvobn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{230BD3FD-D811-4037-9976-EB05F04B017D} inxjymong.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6437FB9F-EE79-4dd6-9587-1B237F356039}\stubpath = "C:\\Windows\\system32\\invtppiyy.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C215A85B-7B5D-45ab-88F0-834CAF3D1DE0} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7D71CB6-33FF-4001-991A-338D222DF6D9}\stubpath = "C:\\Windows\\system32\\inuqbjvqf.exe" inljyapnv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7711ECB-562D-471b-8E79-149BE7589F39}\stubpath = "C:\\Windows\\system32\\inlynkhmj.exe" insjzlfro.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{92C51995-3834-4a17-A75C-8170448E6CF6}\stubpath = "C:\\Windows\\system32\\inboxtclv.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E726FBFB-15CE-4ebb-B86A-8D2AD461233D} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10BBC98A-012B-4b46-A3D8-3EA8F0BC0DD7} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10BBC98A-012B-4b46-A3D8-3EA8F0BC0DD7}\stubpath = "C:\\Windows\\system32\\inysuzmfx.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54666432-089C-4596-ACD4-3B46D703B70E}\stubpath = "C:\\Windows\\system32\\inanpaqtt.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F019396-CE3B-4e86-92D6-2523686B25D2} infzzbyva.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{224BC4F5-AD6F-4c25-8299-516CF68B1C2C} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47461988-794A-44b4-B6C3-0E241EC1759C}\stubpath = "C:\\Windows\\system32\\inpeyhpif.exe" invnbgkek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C504C346-AA69-4f76-ADCC-34055403C8B5}\stubpath = "C:\\Windows\\system32\\inewwuqnf.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{249B6D9C-EEA6-45e7-B375-CE42C45F9C40} inuwjozuo.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000024297-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1588 inogwahsa.exe 2132 inbqiycju.exe 1464 inetlfmxc.exe 4016 inzvgovkd.exe 1028 inaexuhtj.exe 1608 inlsmacbt.exe 340 innfvgrkz.exe 3996 incanalcr.exe 4024 invrckwrg.exe 3976 inyufnzuj.exe 4500 inwhpwale.exe 1208 inzkcszdo.exe 5056 inqmfrmyb.exe 1112 inpsutmlb.exe 1176 inruwvobn.exe 3632 inbuxzyre.exe 1264 indwztgsi.exe 924 incgzwjvl.exe 3464 inmprqjiy.exe 2012 inortslka.exe 3980 indxawycz.exe 1792 inatwyxqd.exe 1936 infhthtec.exe 2508 inwixlnmf.exe 3600 inzloqpih.exe 3164 innqsrkjz.exe 4680 inoavpdfe.exe 2640 inrdysgih.exe 3840 intfuikjc.exe 3400 ineuxonvv.exe 3596 inykznpoh.exe 528 injmdckxk.exe 536 inwmpgfnn.exe 1920 inbpxnjbw.exe 1736 indskelwb.exe 1376 ingvnhoze.exe 1636 intcrvwiy.exe 2360 inhwfuyzl.exe 2556 injhulmow.exe 1624 insohtodl.exe 1528 inocokdvj.exe 3580 inqgdzfrf.exe 948 inpiofygs.exe 4188 inxjymong.exe 4912 insrzztuj.exe 1764 inmtnbdcu.exe 4292 inpbwqegf.exe 2428 incrjzdkv.exe 3508 infdqdofu.exe 2940 insbquvhx.exe 3876 inyjbrycn.exe 1760 inpleqlxa.exe 3916 inrngsnzc.exe 4688 inqtvunam.exe 2540 insvxwpco.exe 3648 incvyzsfr.exe 4180 inpqffxwb.exe 3504 ingwzqpxx.exe 3932 inefvmlzb.exe 4172 inhiypoew.exe 2480 inhscspdt.exe 4860 inecpcnet.exe 4544 inhfsfaqh.exe 3280 ingoxeawx.exe - Loads dropped DLL 64 IoCs
pid Process 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 1588 inogwahsa.exe 1588 inogwahsa.exe 2132 inbqiycju.exe 2132 inbqiycju.exe 1464 inetlfmxc.exe 1464 inetlfmxc.exe 4016 inzvgovkd.exe 4016 inzvgovkd.exe 1028 inaexuhtj.exe 1028 inaexuhtj.exe 1608 inlsmacbt.exe 1608 inlsmacbt.exe 340 innfvgrkz.exe 340 innfvgrkz.exe 3996 incanalcr.exe 3996 incanalcr.exe 4024 invrckwrg.exe 4024 invrckwrg.exe 3976 inyufnzuj.exe 3976 inyufnzuj.exe 4500 inwhpwale.exe 4500 inwhpwale.exe 1208 inzkcszdo.exe 1208 inzkcszdo.exe 5056 inqmfrmyb.exe 5056 inqmfrmyb.exe 1112 inpsutmlb.exe 1112 inpsutmlb.exe 1176 inruwvobn.exe 1176 inruwvobn.exe 3632 inbuxzyre.exe 3632 inbuxzyre.exe 1264 indwztgsi.exe 1264 indwztgsi.exe 924 incgzwjvl.exe 924 incgzwjvl.exe 3464 inmprqjiy.exe 3464 inmprqjiy.exe 2012 inortslka.exe 2012 inortslka.exe 3980 indxawycz.exe 3980 indxawycz.exe 1792 inatwyxqd.exe 1792 inatwyxqd.exe 1936 infhthtec.exe 1936 infhthtec.exe 2508 inwixlnmf.exe 2508 inwixlnmf.exe 3600 inzloqpih.exe 3600 inzloqpih.exe 3164 innqsrkjz.exe 3164 innqsrkjz.exe 4680 inoavpdfe.exe 4680 inoavpdfe.exe 2640 inrdysgih.exe 2640 inrdysgih.exe 3840 intfuikjc.exe 3840 intfuikjc.exe 3400 ineuxonvv.exe 3400 ineuxonvv.exe 3596 inykznpoh.exe 3596 inykznpoh.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inmsevrki.exe_lang.ini inuisngbw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkquqcuf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inavgkgkt.exe File created C:\Windows\SysWOW64\inwlhjhih.exe Process not Found File opened for modification C:\Windows\SysWOW64\ineagvjbt.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inbqostfv.exe File opened for modification C:\Windows\SysWOW64\inuiybnpg.exe_lang.ini inqzaupvo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inivxkbyw.exe File opened for modification C:\Windows\SysWOW64\inuaizlgb.exe_lang.ini inekdjhgw.exe File created C:\Windows\SysWOW64\inmachloq.exe inihalmwh.exe File created C:\Windows\SysWOW64\inljhllwj.exe inltdlhks.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inodazcuq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inlsmacbt.exe File created C:\Windows\SysWOW64\inmnccutj.exe intpaiupe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inisywvgk.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\indfsjnkl.exe Process not Found File opened for modification C:\Windows\SysWOW64\inxfqxuqh.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inqnentdj.exe File opened for modification C:\Windows\SysWOW64\injltfsal.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inaspaeae.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inbqhxdxk.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inpobjkiq.exe Process not Found File created C:\Windows\SysWOW64\inczmkfzy.exe Process not Found File created C:\Windows\SysWOW64\ingtkolam.exe Process not Found File created C:\Windows\SysWOW64\intwamnoz.exe inergdafx.exe File created C:\Windows\SysWOW64\inczrcetn.exe Process not Found File opened for modification C:\Windows\SysWOW64\inaggaocx.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\infkavqje.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\ingtvpopk.exe_lang.ini inertnmni.exe File opened for modification C:\Windows\SysWOW64\inzrzcjpi.exe_lang.ini inhtjgiui.exe File opened for modification C:\Windows\SysWOW64\indtyatrn.exe_lang.ini intkqnccl.exe File opened for modification C:\Windows\SysWOW64\inyyqniwm.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File created C:\Windows\SysWOW64\inqmqnuiq.exe Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inpljrdzf.exe File created C:\Windows\SysWOW64\inrkscryp.exe inmbvemfc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inpiqqmhr.exe_lang.ini insacfcod.exe File created C:\Windows\SysWOW64\inzjlpkqo.exe inphclvql.exe File opened for modification C:\Windows\SysWOW64\invlbrhjx.exe_lang.ini inqofiykl.exe File created C:\Windows\SysWOW64\inlgisalg.exe inaqlyskp.exe File opened for modification C:\Windows\SysWOW64\inxikfepk.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inwhlhluc.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ingjrbfsg.exe Process not Found File created C:\Windows\SysWOW64\innhnzoqa.exe indrqojnz.exe File opened for modification C:\Windows\SysWOW64\inwwqnpfc.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\injtrsrce.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inxgaoyjn.exe inoyifzki.exe File opened for modification C:\Windows\SysWOW64\inuvzztqs.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inqzaupvo.exe inmkxopbr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\syslog.dat inrdysgih.exe File opened for modification C:\Windows\SysWOW64\inykmqjhq.exe_lang.ini intndtuwg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat Process not Found File opened for modification C:\Windows\SysWOW64\inklhwgpl.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inyuwqchz.exe Process not Found File created C:\Windows\SysWOW64\inpleqlxa.exe inyjbrycn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insvxwpco.exe File opened for modification C:\Windows\SysWOW64\inlolxmlm.exe_lang.ini invlbrhjx.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpurorlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inacgtgkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inadlmaxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniaooxbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infdqdofu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intnjpska.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrhnxdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inktojpiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzebhpmt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inemiltdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbpftoif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhhujgdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtjmoji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfiqaer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuisngbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innikicxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invqmdynu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvcvbrm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwmpgfnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indibtvfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxncqsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intuwvzao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insrzztuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirmhzng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhjrgabu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniwaqpwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhqlgymf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inagshjtq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 1588 inogwahsa.exe 1588 inogwahsa.exe 2132 inbqiycju.exe 2132 inbqiycju.exe 1464 inetlfmxc.exe 1464 inetlfmxc.exe 4016 inzvgovkd.exe 4016 inzvgovkd.exe 1028 inaexuhtj.exe 1028 inaexuhtj.exe 1608 inlsmacbt.exe 1608 inlsmacbt.exe 340 innfvgrkz.exe 340 innfvgrkz.exe 3996 incanalcr.exe 3996 incanalcr.exe 4024 invrckwrg.exe 4024 invrckwrg.exe 3976 inyufnzuj.exe 3976 inyufnzuj.exe 4500 inwhpwale.exe 4500 inwhpwale.exe 1208 inzkcszdo.exe 1208 inzkcszdo.exe 5056 inqmfrmyb.exe 5056 inqmfrmyb.exe 1112 inpsutmlb.exe 1112 inpsutmlb.exe 1176 inruwvobn.exe 1176 inruwvobn.exe 3632 inbuxzyre.exe 3632 inbuxzyre.exe 1264 indwztgsi.exe 1264 indwztgsi.exe 924 incgzwjvl.exe 924 incgzwjvl.exe 3464 inmprqjiy.exe 3464 inmprqjiy.exe 2012 inortslka.exe 2012 inortslka.exe 3980 indxawycz.exe 3980 indxawycz.exe 1792 inatwyxqd.exe 1792 inatwyxqd.exe 1936 infhthtec.exe 1936 infhthtec.exe 2508 inwixlnmf.exe 2508 inwixlnmf.exe 3600 inzloqpih.exe 3600 inzloqpih.exe 3164 innqsrkjz.exe 3164 innqsrkjz.exe 4680 inoavpdfe.exe 4680 inoavpdfe.exe 2640 inrdysgih.exe 2640 inrdysgih.exe 3840 intfuikjc.exe 3840 intfuikjc.exe 3400 ineuxonvv.exe 3400 ineuxonvv.exe 3596 inykznpoh.exe 3596 inykznpoh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 1588 inogwahsa.exe Token: SeDebugPrivilege 2132 inbqiycju.exe Token: SeDebugPrivilege 1464 inetlfmxc.exe Token: SeDebugPrivilege 4016 inzvgovkd.exe Token: SeDebugPrivilege 1028 inaexuhtj.exe Token: SeDebugPrivilege 1608 inlsmacbt.exe Token: SeDebugPrivilege 340 innfvgrkz.exe Token: SeDebugPrivilege 3996 incanalcr.exe Token: SeDebugPrivilege 4024 invrckwrg.exe Token: SeDebugPrivilege 3976 inyufnzuj.exe Token: SeDebugPrivilege 4500 inwhpwale.exe Token: SeDebugPrivilege 1208 inzkcszdo.exe Token: SeDebugPrivilege 5056 inqmfrmyb.exe Token: SeDebugPrivilege 1112 inpsutmlb.exe Token: SeDebugPrivilege 1176 inruwvobn.exe Token: SeDebugPrivilege 3632 inbuxzyre.exe Token: SeDebugPrivilege 1264 indwztgsi.exe Token: SeDebugPrivilege 924 incgzwjvl.exe Token: SeDebugPrivilege 3464 inmprqjiy.exe Token: SeDebugPrivilege 2012 inortslka.exe Token: SeDebugPrivilege 3980 indxawycz.exe Token: SeDebugPrivilege 1792 inatwyxqd.exe Token: SeDebugPrivilege 1936 infhthtec.exe Token: SeDebugPrivilege 2508 inwixlnmf.exe Token: SeDebugPrivilege 3600 inzloqpih.exe Token: SeDebugPrivilege 3164 innqsrkjz.exe Token: SeDebugPrivilege 4680 inoavpdfe.exe Token: SeDebugPrivilege 2640 inrdysgih.exe Token: SeDebugPrivilege 3840 intfuikjc.exe Token: SeDebugPrivilege 3400 ineuxonvv.exe Token: SeDebugPrivilege 3596 inykznpoh.exe Token: SeDebugPrivilege 528 injmdckxk.exe Token: SeDebugPrivilege 536 inwmpgfnn.exe Token: SeDebugPrivilege 1920 inbpxnjbw.exe Token: SeDebugPrivilege 1736 indskelwb.exe Token: SeDebugPrivilege 1376 ingvnhoze.exe Token: SeDebugPrivilege 1636 intcrvwiy.exe Token: SeDebugPrivilege 2360 inhwfuyzl.exe Token: SeDebugPrivilege 2556 injhulmow.exe Token: SeDebugPrivilege 1624 insohtodl.exe Token: SeDebugPrivilege 1528 inocokdvj.exe Token: SeDebugPrivilege 3580 inqgdzfrf.exe Token: SeDebugPrivilege 948 inpiofygs.exe Token: SeDebugPrivilege 4188 inxjymong.exe Token: SeDebugPrivilege 4912 insrzztuj.exe Token: SeDebugPrivilege 1764 inmtnbdcu.exe Token: SeDebugPrivilege 4292 inpbwqegf.exe Token: SeDebugPrivilege 2428 incrjzdkv.exe Token: SeDebugPrivilege 3508 infdqdofu.exe Token: SeDebugPrivilege 2940 insbquvhx.exe Token: SeDebugPrivilege 3876 inyjbrycn.exe Token: SeDebugPrivilege 1760 inpleqlxa.exe Token: SeDebugPrivilege 3916 inrngsnzc.exe Token: SeDebugPrivilege 4688 inqtvunam.exe Token: SeDebugPrivilege 2540 insvxwpco.exe Token: SeDebugPrivilege 3648 incvyzsfr.exe Token: SeDebugPrivilege 4180 inpqffxwb.exe Token: SeDebugPrivilege 3504 ingwzqpxx.exe Token: SeDebugPrivilege 3932 inefvmlzb.exe Token: SeDebugPrivilege 4172 inhiypoew.exe Token: SeDebugPrivilege 2480 inhscspdt.exe Token: SeDebugPrivilege 4860 inecpcnet.exe Token: SeDebugPrivilege 4544 inhfsfaqh.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 1588 inogwahsa.exe 2132 inbqiycju.exe 1464 inetlfmxc.exe 4016 inzvgovkd.exe 1028 inaexuhtj.exe 1608 inlsmacbt.exe 340 innfvgrkz.exe 3996 incanalcr.exe 4024 invrckwrg.exe 3976 inyufnzuj.exe 4500 inwhpwale.exe 1208 inzkcszdo.exe 5056 inqmfrmyb.exe 1112 inpsutmlb.exe 1176 inruwvobn.exe 3632 inbuxzyre.exe 1264 indwztgsi.exe 924 incgzwjvl.exe 3464 inmprqjiy.exe 2012 inortslka.exe 3980 indxawycz.exe 1792 inatwyxqd.exe 1936 infhthtec.exe 2508 inwixlnmf.exe 3600 inzloqpih.exe 3164 innqsrkjz.exe 4680 inoavpdfe.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 1588 4420 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 85 PID 1588 wrote to memory of 2132 1588 inogwahsa.exe 86 PID 2132 wrote to memory of 1464 2132 inbqiycju.exe 87 PID 1464 wrote to memory of 4016 1464 inetlfmxc.exe 88 PID 4016 wrote to memory of 1028 4016 inzvgovkd.exe 89 PID 1028 wrote to memory of 1608 1028 inaexuhtj.exe 90 PID 1608 wrote to memory of 340 1608 inlsmacbt.exe 91 PID 340 wrote to memory of 3996 340 innfvgrkz.exe 92 PID 3996 wrote to memory of 4024 3996 incanalcr.exe 93 PID 4024 wrote to memory of 3976 4024 invrckwrg.exe 94 PID 3976 wrote to memory of 4500 3976 inyufnzuj.exe 95 PID 4500 wrote to memory of 1208 4500 inwhpwale.exe 96 PID 1208 wrote to memory of 5056 1208 inzkcszdo.exe 97 PID 5056 wrote to memory of 1112 5056 inqmfrmyb.exe 98 PID 1112 wrote to memory of 1176 1112 inpsutmlb.exe 99 PID 1176 wrote to memory of 3632 1176 inruwvobn.exe 100 PID 3632 wrote to memory of 1264 3632 inbuxzyre.exe 101 PID 1264 wrote to memory of 924 1264 indwztgsi.exe 102 PID 924 wrote to memory of 3464 924 incgzwjvl.exe 103 PID 3464 wrote to memory of 2012 3464 inmprqjiy.exe 104 PID 2012 wrote to memory of 3980 2012 inortslka.exe 105 PID 3980 wrote to memory of 1792 3980 indxawycz.exe 106 PID 1792 wrote to memory of 1936 1792 inatwyxqd.exe 107 PID 1936 wrote to memory of 2508 1936 infhthtec.exe 108 PID 2508 wrote to memory of 3600 2508 inwixlnmf.exe 109 PID 3600 wrote to memory of 3164 3600 inzloqpih.exe 110 PID 3164 wrote to memory of 4680 3164 innqsrkjz.exe 111 PID 4680 wrote to memory of 2640 4680 inoavpdfe.exe 112 PID 2640 wrote to memory of 3840 2640 inrdysgih.exe 113 PID 3840 wrote to memory of 3400 3840 intfuikjc.exe 114 PID 3400 wrote to memory of 3596 3400 ineuxonvv.exe 115 PID 3596 wrote to memory of 528 3596 inykznpoh.exe 116 PID 528 wrote to memory of 536 528 injmdckxk.exe 117 PID 536 wrote to memory of 1920 536 inwmpgfnn.exe 118 PID 1920 wrote to memory of 1736 1920 inbpxnjbw.exe 119 PID 1736 wrote to memory of 1376 1736 indskelwb.exe 120 PID 1376 wrote to memory of 1636 1376 ingvnhoze.exe 121 PID 1636 wrote to memory of 2360 1636 intcrvwiy.exe 122 PID 2360 wrote to memory of 2556 2360 inhwfuyzl.exe 123 PID 2556 wrote to memory of 1624 2556 injhulmow.exe 124 PID 1624 wrote to memory of 1528 1624 insohtodl.exe 125 PID 1528 wrote to memory of 3580 1528 inocokdvj.exe 126 PID 3580 wrote to memory of 948 3580 inqgdzfrf.exe 127 PID 948 wrote to memory of 4188 948 inpiofygs.exe 128 PID 4188 wrote to memory of 4912 4188 inxjymong.exe 129 PID 4912 wrote to memory of 1764 4912 insrzztuj.exe 130 PID 1764 wrote to memory of 4292 1764 inmtnbdcu.exe 131 PID 4292 wrote to memory of 2428 4292 inpbwqegf.exe 132 PID 2428 wrote to memory of 3508 2428 incrjzdkv.exe 133 PID 3508 wrote to memory of 2940 3508 infdqdofu.exe 134 PID 2940 wrote to memory of 3876 2940 insbquvhx.exe 135 PID 3876 wrote to memory of 1760 3876 inyjbrycn.exe 136 PID 1760 wrote to memory of 3916 1760 inpleqlxa.exe 137 PID 3916 wrote to memory of 4688 3916 inrngsnzc.exe 138 PID 4688 wrote to memory of 2540 4688 inqtvunam.exe 139 PID 2540 wrote to memory of 3648 2540 insvxwpco.exe 140 PID 3648 wrote to memory of 4180 3648 incvyzsfr.exe 141 PID 4180 wrote to memory of 3504 4180 inpqffxwb.exe 142 PID 3504 wrote to memory of 3932 3504 ingwzqpxx.exe 143 PID 3932 wrote to memory of 4172 3932 inefvmlzb.exe 144 PID 4172 wrote to memory of 2480 4172 inhiypoew.exe 145 PID 2480 wrote to memory of 4860 2480 inhscspdt.exe 146 PID 4860 wrote to memory of 4544 4860 inecpcnet.exe 147 PID 4544 wrote to memory of 3280 4544 inhfsfaqh.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe16⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe32⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe48⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe63⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe65⤵
- Executes dropped EXE
PID:3280 -
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe66⤵PID:5064
-
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe67⤵PID:316
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe68⤵PID:4460
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe69⤵PID:4840
-
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe70⤵PID:888
-
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe71⤵PID:4652
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe72⤵PID:1120
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe73⤵PID:4728
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe74⤵PID:868
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe75⤵PID:4700
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe76⤵PID:2852
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe77⤵PID:4764
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe78⤵PID:4064
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe79⤵PID:4720
-
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe80⤵PID:2000
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe81⤵
- Boot or Logon Autostart Execution: Active Setup
PID:408 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe82⤵PID:1032
-
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe83⤵PID:4496
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe84⤵PID:1232
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe85⤵PID:1700
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe86⤵PID:4592
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe87⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4308 -
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe88⤵PID:4916
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe89⤵
- Drops file in System32 directory
PID:3760 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe90⤵PID:2216
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe91⤵PID:4440
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe92⤵PID:1324
-
C:\Windows\SysWOW64\intxcqoxe.exeC:\Windows\system32\intxcqoxe.exe93⤵
- Boot or Logon Autostart Execution: Active Setup
PID:832 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe94⤵PID:3436
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe95⤵PID:624
-
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe96⤵PID:4204
-
C:\Windows\SysWOW64\inmflkmos.exeC:\Windows\system32\inmflkmos.exe97⤵PID:3344
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe98⤵
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\inkwblfyk.exeC:\Windows\system32\inkwblfyk.exe99⤵PID:1380
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe100⤵PID:2244
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe101⤵PID:1068
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe102⤵PID:2968
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe103⤵PID:3376
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe104⤵PID:2336
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe105⤵PID:4300
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe106⤵PID:1312
-
C:\Windows\SysWOW64\inbmmjnwc.exeC:\Windows\system32\inbmmjnwc.exe107⤵PID:1880
-
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe108⤵PID:3056
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe109⤵PID:3036
-
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe110⤵PID:2248
-
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe111⤵PID:1580
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe112⤵PID:3444
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe113⤵PID:2628
-
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe114⤵PID:1036
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe115⤵PID:2264
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe116⤵PID:2008
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe117⤵PID:4092
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe118⤵PID:1836
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe119⤵PID:1904
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe120⤵PID:5020
-
C:\Windows\SysWOW64\indrzpldy.exeC:\Windows\system32\indrzpldy.exe121⤵PID:1652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-