Analysis
- max time kernel
78s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/10/2026, 06:50
Behavioral task
behavioral1
Sample
2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261025-hl87rage45
- SHA256 179b98b453069e6ef7e68dec87c562052b6e281d97ed9e8349683bb2bd51e9ab
- MD5 d2e9bb1684e356837864011de5ab3705
- SHA1 d9317c196c800c9a5848398afb22beebb5141006
- SHA512 969b968433254aabe3944b38bc0930d09983d3dc883bba152800b9e25ed597781020548374e380886f2306bf20ef9915391f21e191298b4ad37cd83b6cf63d4e
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTk:RPjOa1NxyYtH1k
- TLSH T19015AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 50 IoCs
resource yara_rule behavioral2/memory/5024-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5024-5-0x0000000002090000-0x0000000002103000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c4d2-13.dat family_gh0strat behavioral2/files/0x000d00000001c4d7-20.dat family_gh0strat behavioral2/memory/5024-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4dd-42.dat family_gh0strat behavioral2/memory/1208-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e7-64.dat family_gh0strat behavioral2/memory/1192-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4eb-86.dat family_gh0strat behavioral2/files/0x000d00000001c4f3-131.dat family_gh0strat behavioral2/files/0x000d00000001c4fd-174.dat family_gh0strat behavioral2/memory/4364-201-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4572-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c510-263.dat family_gh0strat behavioral2/memory/5252-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2100-463-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4424-553-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4496-624-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3948-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5780-589-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2664-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1936-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/928-517-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5416-499-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1336-481-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2540-445-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2892-427-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2792-409-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2876-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1688-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2204-355-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c528-351.dat family_gh0strat behavioral2/memory/3268-333-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c524-329.dat family_gh0strat behavioral2/memory/2336-311-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c51f-307.dat family_gh0strat behavioral2/files/0x000d00000001c515-285.dat family_gh0strat behavioral2/memory/468-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50c-244.dat family_gh0strat behavioral2/memory/3248-243-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c507-219.dat family_gh0strat behavioral2/files/0x000d00000001c503-197.dat family_gh0strat behavioral2/memory/256-179-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3152-157-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f8-153.dat family_gh0strat behavioral2/memory/2836-135-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/932-113-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ef-109.dat family_gh0strat behavioral2/memory/776-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29AC64BF-A8B4-4437-8FBD-74C7465AC66D} inpsutmlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73ECBA0C-35E6-4410-BDB9-16C75F54AB6B} indzyzoqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8951C47-5D04-4679-955A-7F3A1877751A}\stubpath = "C:\\Windows\\system32\\ingfvhjng.exe" infmbihgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3FCEA42-9E5B-456e-BF49-2F9725888C50}\stubpath = "C:\\Windows\\system32\\incajnuiq.exe" inpfzcyeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A93D58F3-9364-45dc-97C8-E2C868106D75}\stubpath = "C:\\Windows\\system32\\inugvjlkd.exe" inarenvge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05A31FA4-F27C-42a6-B91A-2C71B86C6E07}\stubpath = "C:\\Windows\\system32\\incjmswjo.exe" inbmkzbqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAC25E16-3809-4f20-A6F0-CC742C354395}\stubpath = "C:\\Windows\\system32\\inzajppij.exe" inbbmmbxa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B40D6BE9-74E2-4da7-B3AC-CE6B2C2692F6} inaulrodd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4DB27542-10B8-4d83-AFEE-E2C4218D9EE8} inihodrxd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BBD842E-2450-47ed-80F0-E2D8D27ECA06}\stubpath = "C:\\Windows\\system32\\ingatvyvf.exe" inkfaovfk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20D33886-E811-413d-BA5D-2912E93D05DF} ingcmtril.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE110CFA-6A1D-4847-9211-8FFE24269FB7}\stubpath = "C:\\Windows\\system32\\inkptwycw.exe" inqbjpnmx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0504F62B-1DCF-4866-A53E-11B567C2E3D5}\stubpath = "C:\\Windows\\system32\\inomvcziu.exe" inwmpgfnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{69B75A91-226C-44c4-8BD1-305B7852D7E9} inrtwgusw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB1963AC-DB42-456e-90FF-2DAA60F41E5A}\stubpath = "C:\\Windows\\system32\\inytozkkh.exe" inpprolqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22808A3A-C18D-4aa7-A3A1-4AFC10D35A50}\stubpath = "C:\\Windows\\system32\\insbznvcp.exe" indxighng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{547455C1-AB0E-4c42-9EA1-BFC458624FC7} insbznvcp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC89DC5B-DCC6-4fcd-AEBB-13B8E6A54FBA}\stubpath = "C:\\Windows\\system32\\inuydrpyf.exe" inecpcnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{859959B1-4152-491b-8B3D-B7DA0E6A1501}\stubpath = "C:\\Windows\\system32\\invgvfzue.exe" inwgusogd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65573A1C-77EA-4e19-B279-CA4C921EF2C8}\stubpath = "C:\\Windows\\system32\\inmlwcerc.exe" inmktaxgs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7232F2E3-24CA-4468-8FF9-2A1846659A2E}\stubpath = "C:\\Windows\\system32\\insqkrbxb.exe" inilftocs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5DC5EDA-B35B-4cc1-8B38-17BF17F6268F} initcmsrt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79715887-3A5A-45e9-9F9E-BF4CFADB05E3}\stubpath = "C:\\Windows\\system32\\incpdebyb.exe" inqbcmcsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF7CE773-BC3C-4c23-B0ED-95F69C7CF97C} ingwzqpxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53776928-9B20-424d-912C-3832B24EE18C}\stubpath = "C:\\Windows\\system32\\inuvxhdct.exe" inddqfcew.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C55DBA0-FC3F-46aa-9447-37EC9B1935E3} indbxwxmz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C50DB808-F94A-42b4-BA50-83B03B54326F} incsvmltt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B17795C3-7B12-4e54-BA58-6D86F8AE57D6} inzfhvydh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7B4FA73-7BC6-4dba-A088-F831009C4797}\stubpath = "C:\\Windows\\system32\\inkbytnkt.exe" inzajppij.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B91BD99E-05C8-4efc-A82A-87FB91493A89} inniucjdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63A05D3C-393F-4830-BC45-0242ED45E902} inrdysgih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42B80CF1-2529-4376-929A-5D5D26C66012} inzydrlkr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF7414A7-8C88-4704-A946-24A6D627DD09}\stubpath = "C:\\Windows\\system32\\insaljfpw.exe" inaqgiwze.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A1F510D-3898-4a93-B86F-D1601BECA661}\stubpath = "C:\\Windows\\system32\\inmktaxgs.exe" inupkqjvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1098232-B021-4ef5-8CA5-F35EBC5A91CB}\stubpath = "C:\\Windows\\system32\\inoropope.exe" inaouaylq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C64E301-A404-4b3c-9437-5CFD15CACA60} inhpdyhbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3394755C-C7FD-4cf8-AF50-E158068D21BA}\stubpath = "C:\\Windows\\system32\\ingcmtril.exe" inygczwba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20D33886-E811-413d-BA5D-2912E93D05DF}\stubpath = "C:\\Windows\\system32\\inifasoed.exe" ingcmtril.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DBC94886-3439-48c1-BF35-B16E8D2F19E7} iniqzgcyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7B9ECA49-77F5-44d3-9C27-6214096D53B4} inyodrton.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD4913E3-54C8-4e33-82E5-ADFA1805B243}\stubpath = "C:\\Windows\\system32\\inopeewva.exe" inmflkmos.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9374629A-F260-4821-8D76-352F58FB51D1} inyccnaan.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6FDFD3D-416D-4cc2-ACA6-72AB12E5D126} inidwdyvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0AE3CEDE-98A3-430d-8146-653435F13C90} invspsmvj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8813FBA-F5DD-4a1f-99AE-D3789FD62DF9} infjxbrqx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1776A220-AE65-4e07-B2E8-D019CA6BB24B} inulkzdji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39504EC9-2276-418f-962A-0B1116895755} inewrcnnk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18E2A19A-C28D-4769-B674-E0895C65C78C} inhbuwzwg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39B6CFED-4F95-45fc-B36F-B719FB14B912}\stubpath = "C:\\Windows\\system32\\inrvqwujd.exe" inuwegjgs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88400F11-A083-4265-B10D-B6832B66EA84} incjmswjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{28F344E5-B1D3-4543-87C1-000BCD4CB380}\stubpath = "C:\\Windows\\system32\\innvcvbrm.exe" inbsfowhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DBF45B1-FBB5-488a-9449-60132AE92D81} infmbpvbz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEF276FE-7AB3-4074-B047-BBD0FA85EB40} innptoush.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA2F6E18-1B13-4a50-908C-3FEA6C314DCF}\stubpath = "C:\\Windows\\system32\\inmtnbdcu.exe" inhwoipfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4ABECB10-9C58-48f3-B7C6-A22975F65BD6} injyixbhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC8433F1-F38E-45fa-90A2-A09EAC6BB72B} indtfhlye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DC1CC37-B48C-47ec-9E19-0D655BAFE0FC} innrmsqfx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{703383D1-1787-4c57-A7B5-F5075F06068B} inzbahzkq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6A29F64-267F-4494-AA08-D39CFA725E62} insylvfcw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6A29F64-267F-4494-AA08-D39CFA725E62}\stubpath = "C:\\Windows\\system32\\inkfaovfk.exe" insylvfcw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9B24F95-3D9D-450c-9682-17613A11D5AE} inoyifzki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C62BCB45-1003-4024-8CBE-F98761B4E1E1}\stubpath = "C:\\Windows\\system32\\inljswfrz.exe" inbxslgig.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F544DC4D-9B5E-4c11-BB95-592326B74B99} inycykdza.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD5F1457-A7C2-4a6c-8B6A-D26A0F4F3DED} inhhujgdi.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000019cb3-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1208 incrjzdkv.exe 1192 inpleqlxa.exe 776 inuqbjvqf.exe 932 inhwoipfi.exe 2836 inmtnbdcu.exe 3152 inrdysgih.exe 256 inaexuhtj.exe 4364 inpsutmlb.exe 4572 inbuxzyre.exe 3248 incgzwjvl.exe 468 invuwaxma.exe 5252 inqgdzfrf.exe 2336 inxjymong.exe 3268 inknedlyl.exe 2204 inazpsjiq.exe 1688 inwixlnmf.exe 2876 infgwnmcy.exe 2792 insvxwpco.exe 2892 inykznpoh.exe 2540 intpaiupe.exe 2100 inrcangym.exe 1336 ingwzqpxx.exe 5416 innuocedv.exe 928 insezthji.exe 1936 ingtgabri.exe 4424 inumafjdj.exe 2664 inadbobmd.exe 5780 ineuxonvv.exe 3948 innqsrkjz.exe 4496 inwsdlxsh.exe 3492 injyqkarh.exe 5488 innfvgrkz.exe 5708 invrckwrg.exe 2032 ingiuiufd.exe 5632 inqmfrmyb.exe 4288 inruwvobn.exe 3928 indwztgsi.exe 2188 inmprqjiy.exe 5248 inpbwqegf.exe 4260 inxhvtpha.exe 3776 inldtepix.exe 1496 innlypqcs.exe 988 incvyzsfr.exe 2392 inlsmacbt.exe 5088 inqcxrfhg.exe 6100 ingvnhoze.exe 4964 injmdckxk.exe 4700 insohtodl.exe 752 indwezqep.exe 3344 infvypoww.exe 3868 inmeufqjy.exe 3200 inqklaasr.exe 3744 inzvgovkd.exe 5804 inigtklnv.exe 3968 inoavpdfe.exe 4488 inetlfmxc.exe 5600 inqjpgzht.exe 4104 inefvmlzb.exe 4468 inbqiycju.exe 5744 inyufnzuj.exe 5124 inaikwkwh.exe 3004 injwnoaqy.exe 4888 inbaqtkjr.exe 3800 infhthtec.exe - Loads dropped DLL 64 IoCs
pid Process 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 1208 incrjzdkv.exe 1208 incrjzdkv.exe 1192 inpleqlxa.exe 1192 inpleqlxa.exe 776 inuqbjvqf.exe 776 inuqbjvqf.exe 932 inhwoipfi.exe 932 inhwoipfi.exe 2836 inmtnbdcu.exe 2836 inmtnbdcu.exe 3152 inrdysgih.exe 3152 inrdysgih.exe 256 inaexuhtj.exe 256 inaexuhtj.exe 4364 inpsutmlb.exe 4364 inpsutmlb.exe 4572 inbuxzyre.exe 4572 inbuxzyre.exe 3248 incgzwjvl.exe 3248 incgzwjvl.exe 468 invuwaxma.exe 468 invuwaxma.exe 5252 inqgdzfrf.exe 5252 inqgdzfrf.exe 2336 inxjymong.exe 2336 inxjymong.exe 3268 inknedlyl.exe 3268 inknedlyl.exe 2204 inazpsjiq.exe 2204 inazpsjiq.exe 1688 inwixlnmf.exe 1688 inwixlnmf.exe 2876 infgwnmcy.exe 2876 infgwnmcy.exe 2792 insvxwpco.exe 2792 insvxwpco.exe 2892 inykznpoh.exe 2892 inykznpoh.exe 2540 intpaiupe.exe 2540 intpaiupe.exe 2100 inrcangym.exe 2100 inrcangym.exe 1336 ingwzqpxx.exe 1336 ingwzqpxx.exe 5416 innuocedv.exe 5416 innuocedv.exe 928 insezthji.exe 928 insezthji.exe 1936 ingtgabri.exe 1936 ingtgabri.exe 4424 inumafjdj.exe 4424 inumafjdj.exe 2664 inadbobmd.exe 2664 inadbobmd.exe 5780 ineuxonvv.exe 5780 ineuxonvv.exe 3948 innqsrkjz.exe 3948 innqsrkjz.exe 4496 inwsdlxsh.exe 4496 inwsdlxsh.exe 3492 injyqkarh.exe 3492 injyqkarh.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inlofemzm.exe File opened for modification C:\Windows\SysWOW64\inpkvggzd.exe_lang.ini injkrqgyq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyteppma.exe File opened for modification C:\Windows\SysWOW64\insqkfzec.exe_lang.ini indrmgdxz.exe File created C:\Windows\SysWOW64\inzbahzkq.exe inwanaevl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmzfdmqx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhwnltjf.exe File opened for modification C:\Windows\SysWOW64\inuiybnpg.exe_lang.ini inhbuwzwg.exe File created C:\Windows\SysWOW64\invfrxfpk.exe incpcgxnb.exe File opened for modification C:\Windows\SysWOW64\inirveqyf.exe_lang.ini inuibdjgg.exe File created C:\Windows\SysWOW64\innjrlbrs.exe inlolxmlm.exe File opened for modification C:\Windows\SysWOW64\ingwzqpxx.exe_lang.ini inrcangym.exe File opened for modification C:\Windows\SysWOW64\inaiqezai.exe_lang.ini incgthaci.exe File created C:\Windows\SysWOW64\inkbytnkt.exe inzajppij.exe File opened for modification C:\Windows\SysWOW64\iniowtbls.exe_lang.ini invqrynpv.exe File opened for modification C:\Windows\SysWOW64\iniszdhvx.exe_lang.ini inprouzhr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxgusiod.exe File opened for modification C:\Windows\SysWOW64\innqmfdal.exe_lang.ini invqmdynu.exe File opened for modification C:\Windows\SysWOW64\inazojdaz.exe_lang.ini inqzfhsqg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuwftrhn.exe File opened for modification C:\Windows\SysWOW64\inczeboin.exe_lang.ini ingtjmoji.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inthmqkqb.exe File opened for modification C:\Windows\SysWOW64\inlmosntr.exe_lang.ini inutvwllh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbmmjnwc.exe File opened for modification C:\Windows\SysWOW64\inzavthnp.exe_lang.ini invspsmvj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ininzqfqh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invqrynpv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingtgabri.exe File opened for modification C:\Windows\SysWOW64\inxnqhgoo.exe_lang.ini inkzrlbas.exe File opened for modification C:\Windows\SysWOW64\injdwyyif.exe_lang.ini inykmqjhq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inktbmkag.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyccnaan.exe File created C:\Windows\SysWOW64\inxdmghfn.exe inznwqrda.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inckscbjk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyegrpfl.exe File created C:\Windows\SysWOW64\inaaajueu.exe inisucehe.exe File created C:\Windows\SysWOW64\inrjcgagg.exe inamdunku.exe File created C:\Windows\SysWOW64\inwanaevl.exe inidwdyvc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insuxuebv.exe File created C:\Windows\SysWOW64\inltdlhks.exe inlhpjpqs.exe File opened for modification C:\Windows\SysWOW64\inzvnieka.exe_lang.ini inrwawibx.exe File created C:\Windows\SysWOW64\injgmuryj.exe inzebhpmt.exe File created C:\Windows\SysWOW64\inpkvggzd.exe injkrqgyq.exe File opened for modification C:\Windows\SysWOW64\inyluacnl.exe_lang.ini inkdbjsnc.exe File opened for modification C:\Windows\SysWOW64\inpiextzn.exe_lang.ini inoyifzki.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indskelwb.exe File opened for modification C:\Windows\SysWOW64\inujlcwuk.exe_lang.ini invbdruwx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfqeotx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwmcsiky.exe File opened for modification C:\Windows\SysWOW64\inrgfvgik.exe_lang.ini infjmomlg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhfbqsjb.exe File created C:\Windows\SysWOW64\injrhdzvq.exe inaeepccp.exe File opened for modification C:\Windows\SysWOW64\inxgusiod.exe_lang.ini iniszdhvx.exe File created C:\Windows\SysWOW64\insbquvhx.exe inhzrfkoi.exe File created C:\Windows\SysWOW64\inochlfll.exe ingvetxyk.exe File created C:\Windows\SysWOW64\inlgwrccv.exe invwyxcqk.exe File opened for modification C:\Windows\SysWOW64\inbsbjtei.exe_lang.ini inkhtihxi.exe File created C:\Windows\SysWOW64\inuhmcksg.exe inzavthnp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inunzyumh.exe File created C:\Windows\SysWOW64\inmsthrks.exe inhpxhdgo.exe File opened for modification C:\Windows\SysWOW64\inuypzsaf.exe_lang.ini inhoksmcs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inowmiavg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infcpjolj.exe File created C:\Windows\SysWOW64\inkuaczqt.exe incajnuiq.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmhxsddw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqxbfmkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqiycju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsdfhkz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbobfwma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intwamnoz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyepukgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inruwvobn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqfmalkm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inypsuvxw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwnltjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innajnacf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatybwnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxuxrboe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebmvqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkbytnkt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmbpckft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykznpoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invgvfzue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inikojpnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrgtvyi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inytozkkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infqlxfmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzhfgmfs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoqupvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingiuiufd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingoxeawx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmqlrpew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingxqnxqy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgphgbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewhnrej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intuwvzao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injflluak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvnhoze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfnbzwf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhrodsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intchxupt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuxuebv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inckekwln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incmhaqvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbdhuahl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingrakqpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsvmltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inofbieyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inacgtgkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpkuzhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqjpgzht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbrulkss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inamdunku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmnyysj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injgpuugv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inotjfrzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrdysgih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowqgwxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invlbrhjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmsthrks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwrmkgem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indfkortr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intxmhybx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpwglkgm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 1208 incrjzdkv.exe 1208 incrjzdkv.exe 1192 inpleqlxa.exe 1192 inpleqlxa.exe 776 inuqbjvqf.exe 776 inuqbjvqf.exe 932 inhwoipfi.exe 932 inhwoipfi.exe 2836 inmtnbdcu.exe 2836 inmtnbdcu.exe 3152 inrdysgih.exe 3152 inrdysgih.exe 256 inaexuhtj.exe 256 inaexuhtj.exe 4364 inpsutmlb.exe 4364 inpsutmlb.exe 4572 inbuxzyre.exe 4572 inbuxzyre.exe 3248 incgzwjvl.exe 3248 incgzwjvl.exe 468 invuwaxma.exe 468 invuwaxma.exe 5252 inqgdzfrf.exe 5252 inqgdzfrf.exe 2336 inxjymong.exe 2336 inxjymong.exe 3268 inknedlyl.exe 3268 inknedlyl.exe 2204 inazpsjiq.exe 2204 inazpsjiq.exe 1688 inwixlnmf.exe 1688 inwixlnmf.exe 2876 infgwnmcy.exe 2876 infgwnmcy.exe 2792 insvxwpco.exe 2792 insvxwpco.exe 2892 inykznpoh.exe 2892 inykznpoh.exe 2540 intpaiupe.exe 2540 intpaiupe.exe 2100 inrcangym.exe 2100 inrcangym.exe 1336 ingwzqpxx.exe 1336 ingwzqpxx.exe 5416 innuocedv.exe 5416 innuocedv.exe 928 insezthji.exe 928 insezthji.exe 1936 ingtgabri.exe 1936 ingtgabri.exe 4424 inumafjdj.exe 4424 inumafjdj.exe 2664 inadbobmd.exe 2664 inadbobmd.exe 5780 ineuxonvv.exe 5780 ineuxonvv.exe 3948 innqsrkjz.exe 3948 innqsrkjz.exe 4496 inwsdlxsh.exe 4496 inwsdlxsh.exe 3492 injyqkarh.exe 3492 injyqkarh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 1208 incrjzdkv.exe Token: SeDebugPrivilege 1192 inpleqlxa.exe Token: SeDebugPrivilege 776 inuqbjvqf.exe Token: SeDebugPrivilege 932 inhwoipfi.exe Token: SeDebugPrivilege 2836 inmtnbdcu.exe Token: SeDebugPrivilege 3152 inrdysgih.exe Token: SeDebugPrivilege 256 inaexuhtj.exe Token: SeDebugPrivilege 4364 inpsutmlb.exe Token: SeDebugPrivilege 4572 inbuxzyre.exe Token: SeDebugPrivilege 3248 incgzwjvl.exe Token: SeDebugPrivilege 468 invuwaxma.exe Token: SeDebugPrivilege 5252 inqgdzfrf.exe Token: SeDebugPrivilege 2336 inxjymong.exe Token: SeDebugPrivilege 3268 inknedlyl.exe Token: SeDebugPrivilege 2204 inazpsjiq.exe Token: SeDebugPrivilege 1688 inwixlnmf.exe Token: SeDebugPrivilege 2876 infgwnmcy.exe Token: SeDebugPrivilege 2792 insvxwpco.exe Token: SeDebugPrivilege 2892 inykznpoh.exe Token: SeDebugPrivilege 2540 intpaiupe.exe Token: SeDebugPrivilege 2100 inrcangym.exe Token: SeDebugPrivilege 1336 ingwzqpxx.exe Token: SeDebugPrivilege 5416 innuocedv.exe Token: SeDebugPrivilege 928 insezthji.exe Token: SeDebugPrivilege 1936 ingtgabri.exe Token: SeDebugPrivilege 4424 inumafjdj.exe Token: SeDebugPrivilege 2664 inadbobmd.exe Token: SeDebugPrivilege 5780 ineuxonvv.exe Token: SeDebugPrivilege 3948 innqsrkjz.exe Token: SeDebugPrivilege 4496 inwsdlxsh.exe Token: SeDebugPrivilege 3492 injyqkarh.exe Token: SeDebugPrivilege 5488 innfvgrkz.exe Token: SeDebugPrivilege 5708 invrckwrg.exe Token: SeDebugPrivilege 2032 ingiuiufd.exe Token: SeDebugPrivilege 5632 inqmfrmyb.exe Token: SeDebugPrivilege 4288 inruwvobn.exe Token: SeDebugPrivilege 3928 indwztgsi.exe Token: SeDebugPrivilege 2188 inmprqjiy.exe Token: SeDebugPrivilege 5248 inpbwqegf.exe Token: SeDebugPrivilege 4260 inxhvtpha.exe Token: SeDebugPrivilege 3776 inldtepix.exe Token: SeDebugPrivilege 1496 innlypqcs.exe Token: SeDebugPrivilege 988 incvyzsfr.exe Token: SeDebugPrivilege 2392 inlsmacbt.exe Token: SeDebugPrivilege 5088 inqcxrfhg.exe Token: SeDebugPrivilege 6100 ingvnhoze.exe Token: SeDebugPrivilege 4964 injmdckxk.exe Token: SeDebugPrivilege 4700 insohtodl.exe Token: SeDebugPrivilege 752 indwezqep.exe Token: SeDebugPrivilege 3344 infvypoww.exe Token: SeDebugPrivilege 3868 inmeufqjy.exe Token: SeDebugPrivilege 3200 inqklaasr.exe Token: SeDebugPrivilege 3744 inzvgovkd.exe Token: SeDebugPrivilege 5804 inigtklnv.exe Token: SeDebugPrivilege 3968 inoavpdfe.exe Token: SeDebugPrivilege 4488 inetlfmxc.exe Token: SeDebugPrivilege 5600 inqjpgzht.exe Token: SeDebugPrivilege 4104 inefvmlzb.exe Token: SeDebugPrivilege 4468 inbqiycju.exe Token: SeDebugPrivilege 5744 inyufnzuj.exe Token: SeDebugPrivilege 5124 inaikwkwh.exe Token: SeDebugPrivilege 3004 injwnoaqy.exe Token: SeDebugPrivilege 4888 inbaqtkjr.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 1208 incrjzdkv.exe 1192 inpleqlxa.exe 776 inuqbjvqf.exe 932 inhwoipfi.exe 2836 inmtnbdcu.exe 3152 inrdysgih.exe 256 inaexuhtj.exe 4364 inpsutmlb.exe 4572 inbuxzyre.exe 3248 incgzwjvl.exe 468 invuwaxma.exe 5252 inqgdzfrf.exe 2336 inxjymong.exe 3268 inknedlyl.exe 2204 inazpsjiq.exe 1688 inwixlnmf.exe 2876 infgwnmcy.exe 2792 insvxwpco.exe 2892 inykznpoh.exe 2540 intpaiupe.exe 2100 inrcangym.exe 1336 ingwzqpxx.exe 5416 innuocedv.exe 928 insezthji.exe 1936 ingtgabri.exe 4424 inumafjdj.exe 2664 inadbobmd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5024 wrote to memory of 1208 5024 2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 1208 wrote to memory of 1192 1208 incrjzdkv.exe 90 PID 1192 wrote to memory of 776 1192 inpleqlxa.exe 91 PID 776 wrote to memory of 932 776 inuqbjvqf.exe 92 PID 932 wrote to memory of 2836 932 inhwoipfi.exe 93 PID 2836 wrote to memory of 3152 2836 inmtnbdcu.exe 94 PID 3152 wrote to memory of 256 3152 inrdysgih.exe 95 PID 256 wrote to memory of 4364 256 inaexuhtj.exe 96 PID 4364 wrote to memory of 4572 4364 inpsutmlb.exe 97 PID 4572 wrote to memory of 3248 4572 inbuxzyre.exe 98 PID 3248 wrote to memory of 468 3248 incgzwjvl.exe 99 PID 468 wrote to memory of 5252 468 invuwaxma.exe 100 PID 5252 wrote to memory of 2336 5252 inqgdzfrf.exe 101 PID 2336 wrote to memory of 3268 2336 inxjymong.exe 102 PID 3268 wrote to memory of 2204 3268 inknedlyl.exe 103 PID 2204 wrote to memory of 1688 2204 inazpsjiq.exe 104 PID 1688 wrote to memory of 2876 1688 inwixlnmf.exe 105 PID 2876 wrote to memory of 2792 2876 infgwnmcy.exe 106 PID 2792 wrote to memory of 2892 2792 insvxwpco.exe 107 PID 2892 wrote to memory of 2540 2892 inykznpoh.exe 108 PID 2540 wrote to memory of 2100 2540 intpaiupe.exe 109 PID 2100 wrote to memory of 1336 2100 inrcangym.exe 110 PID 1336 wrote to memory of 5416 1336 ingwzqpxx.exe 111 PID 5416 wrote to memory of 928 5416 innuocedv.exe 112 PID 928 wrote to memory of 1936 928 insezthji.exe 113 PID 1936 wrote to memory of 4424 1936 ingtgabri.exe 114 PID 4424 wrote to memory of 2664 4424 inumafjdj.exe 115 PID 2664 wrote to memory of 5780 2664 inadbobmd.exe 116 PID 5780 wrote to memory of 3948 5780 ineuxonvv.exe 117 PID 3948 wrote to memory of 4496 3948 innqsrkjz.exe 118 PID 4496 wrote to memory of 3492 4496 inwsdlxsh.exe 119 PID 3492 wrote to memory of 5488 3492 injyqkarh.exe 120 PID 5488 wrote to memory of 5708 5488 innfvgrkz.exe 121 PID 5708 wrote to memory of 2032 5708 invrckwrg.exe 122 PID 2032 wrote to memory of 5632 2032 ingiuiufd.exe 123 PID 5632 wrote to memory of 4288 5632 inqmfrmyb.exe 124 PID 4288 wrote to memory of 3928 4288 inruwvobn.exe 125 PID 3928 wrote to memory of 2188 3928 indwztgsi.exe 126 PID 2188 wrote to memory of 5248 2188 inmprqjiy.exe 127 PID 5248 wrote to memory of 4260 5248 inpbwqegf.exe 128 PID 4260 wrote to memory of 3776 4260 inxhvtpha.exe 129 PID 3776 wrote to memory of 1496 3776 inldtepix.exe 130 PID 1496 wrote to memory of 988 1496 innlypqcs.exe 131 PID 988 wrote to memory of 2392 988 incvyzsfr.exe 132 PID 2392 wrote to memory of 5088 2392 inlsmacbt.exe 133 PID 5088 wrote to memory of 6100 5088 inqcxrfhg.exe 134 PID 6100 wrote to memory of 4964 6100 ingvnhoze.exe 135 PID 4964 wrote to memory of 4700 4964 injmdckxk.exe 136 PID 4700 wrote to memory of 752 4700 insohtodl.exe 137 PID 752 wrote to memory of 3344 752 indwezqep.exe 138 PID 3344 wrote to memory of 3868 3344 infvypoww.exe 139 PID 3868 wrote to memory of 3200 3868 inmeufqjy.exe 140 PID 3200 wrote to memory of 3744 3200 inqklaasr.exe 141 PID 3744 wrote to memory of 5804 3744 inzvgovkd.exe 142 PID 5804 wrote to memory of 3968 5804 inigtklnv.exe 143 PID 3968 wrote to memory of 4488 3968 inoavpdfe.exe 144 PID 4488 wrote to memory of 5600 4488 inetlfmxc.exe 145 PID 5600 wrote to memory of 4104 5600 inqjpgzht.exe 146 PID 4104 wrote to memory of 4468 4104 inefvmlzb.exe 147 PID 4468 wrote to memory of 5744 4468 inbqiycju.exe 148 PID 5744 wrote to memory of 5124 5744 inyufnzuj.exe 149 PID 5124 wrote to memory of 3004 5124 inaikwkwh.exe 150 PID 3004 wrote to memory of 4888 3004 injwnoaqy.exe 151 PID 4888 wrote to memory of 3800 4888 inbaqtkjr.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-24_d2e9bb1684e356837864011de5ab3705_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe23⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe65⤵
- Executes dropped EXE
PID:3800 -
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe66⤵PID:4704
-
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe67⤵PID:4644
-
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe68⤵PID:2052
-
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe69⤵PID:5588
-
C:\Windows\SysWOW64\injsnioht.exeC:\Windows\system32\injsnioht.exe70⤵PID:5584
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe71⤵
- Drops file in System32 directory
PID:2960 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe72⤵PID:4800
-
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe73⤵PID:3608
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe74⤵PID:3296
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe75⤵
- Drops file in System32 directory
PID:5636 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe76⤵PID:6024
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe78⤵PID:2632
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe79⤵PID:4440
-
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe80⤵
- Drops file in System32 directory
PID:2112 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe81⤵PID:4292
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe82⤵PID:976
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe83⤵PID:2080
-
C:\Windows\SysWOW64\invmdukgq.exeC:\Windows\system32\invmdukgq.exe84⤵PID:5832
-
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe85⤵PID:1092
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe86⤵PID:5572
-
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe87⤵PID:3116
-
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe88⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2928 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe89⤵PID:2804
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe90⤵PID:4712
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe91⤵PID:2828
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe92⤵PID:960
-
C:\Windows\SysWOW64\inionprva.exeC:\Windows\system32\inionprva.exe93⤵PID:6048
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe94⤵PID:2620
-
C:\Windows\SysWOW64\insacfcod.exeC:\Windows\system32\insacfcod.exe95⤵PID:3412
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe96⤵PID:5752
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe97⤵PID:4400
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe98⤵PID:1072
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe99⤵PID:1740
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe100⤵PID:2724
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe101⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5684 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe102⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3136 -
C:\Windows\SysWOW64\inuydrpyf.exeC:\Windows\system32\inuydrpyf.exe103⤵PID:4860
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe104⤵PID:5420
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe105⤵PID:5032
-
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe106⤵PID:1296
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe107⤵PID:1412
-
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe108⤵PID:5644
-
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe109⤵
- System Location Discovery: System Language Discovery
PID:5680 -
C:\Windows\SysWOW64\incsdfhkz.exeC:\Windows\system32\incsdfhkz.exe110⤵
- System Location Discovery: System Language Discovery
PID:5792 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe111⤵PID:4960
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe112⤵PID:2496
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe113⤵PID:1276
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe114⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1928 -
C:\Windows\SysWOW64\inomvcziu.exeC:\Windows\system32\inomvcziu.exe115⤵PID:2376
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe116⤵PID:5348
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe117⤵PID:5060
-
C:\Windows\SysWOW64\intxcqoxe.exeC:\Windows\system32\intxcqoxe.exe118⤵PID:4136
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe119⤵PID:6044
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe120⤵PID:1364
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe121⤵PID:4788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-