Analysis
- max time kernel
84s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 15:42
Behavioral task
behavioral1
Sample
2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260730-s5beya1dnh
- SHA256 27f81bf88693d2acfd95d31e1705f70b761e90a7f1493cf2975731e4f37d63f4
- MD5 3c400c655adee0869a087f44127fd6c4
- SHA1 508315b010d4c9ccea5673efe8e6f0a1977dc6ca
- SHA512 dd73c782230cc65b39157481b9c657f9fb499ed1839631a95632dc9d605d3446661479477d811b736f953ca80eb8fad18839560b6d36ed12bb86384c9802d130
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTb:RPjOa1NxyYtH1b
- TLSH T1C915AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/1344-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x001000000001c50d-20.dat family_gh0strat behavioral2/memory/1344-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c511-32.dat family_gh0strat behavioral2/files/0x000d00000001c513-40.dat family_gh0strat behavioral2/memory/3572-45-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x001800000001c471-64.dat family_gh0strat behavioral2/memory/1240-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c51d-86.dat family_gh0strat behavioral2/memory/4620-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c527-108.dat family_gh0strat behavioral2/memory/3736-111-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c52c-130.dat family_gh0strat behavioral2/memory/3004-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3504-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c530-155.dat family_gh0strat behavioral2/files/0x000d00000001c534-175.dat family_gh0strat behavioral2/files/0x000d00000001c53c-218.dat family_gh0strat behavioral2/files/0x000d00000001c541-241.dat family_gh0strat behavioral2/memory/2540-355-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2256-427-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4964-625-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6068-607-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/948-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2536-571-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1224-553-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1188-535-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1752-517-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4448-499-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4168-481-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4936-463-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/988-445-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1420-409-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2432-391-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4776-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c556-351.dat family_gh0strat behavioral2/memory/2684-331-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c552-329.dat family_gh0strat behavioral2/files/0x000d00000001c54d-310.dat family_gh0strat behavioral2/memory/3940-309-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3116-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c549-285.dat family_gh0strat behavioral2/memory/1296-267-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c545-263.dat family_gh0strat behavioral2/memory/3580-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2480-223-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3176-201-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c538-197.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{77DA0508-CB45-4737-84C1-F55451150108}\stubpath = "C:\\Windows\\system32\\inldtepix.exe" infdqdofu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA959A14-3E15-4449-8D1C-A435AFEEBA47} inugvjlkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0BB4FD-9278-46f6-AA6F-334C915EA5B2}\stubpath = "C:\\Windows\\system32\\insaljfpw.exe" inbobfwma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FC5BECE-516D-4640-9FD7-7B88D5C5E791}\stubpath = "C:\\Windows\\system32\\inbfyviuk.exe" inocokdvj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F994B5F1-BE54-4b94-B7AA-A45DE441FD9D} inuloqrtx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FE0F0230-E3CB-48c6-909A-2C8D242ED335}\stubpath = "C:\\Windows\\system32\\inatwyxqd.exe" inuwftrhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{347952B1-D7FD-429d-BC3D-7C8FE1B2D9BD}\stubpath = "C:\\Windows\\system32\\inmkxopbr.exe" inlaxcmgz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{150C14C0-AAB6-4702-9B8D-EFDE468AF638} inimthpzj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30128E9F-798C-4b42-A322-AD16D9828AB7} inochlfll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A9F54F0-0EA7-4389-AFC1-AC6B58BECEFF}\stubpath = "C:\\Windows\\system32\\insbquvhx.exe" ingtvpopk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A63A5353-C908-4b90-B462-1D186FD440F2} inxsdoolp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F8509E1-C5F1-440c-9468-C9D091F61D68}\stubpath = "C:\\Windows\\system32\\intetdxsy.exe" inpnehxjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0421C3A6-4510-4599-A8B1-46FF28218A32} injrhdzvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EB68018-3D10-4a50-8D1B-ABB63AC5F325}\stubpath = "C:\\Windows\\system32\\inmkoozmm.exe" inytozkkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02AFF538-E52B-43d4-9FE2-023D4CF22B26}\stubpath = "C:\\Windows\\system32\\inuytzxmg.exe" inrxixhwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9FCD4AB-CDDA-46b7-A7D0-4BDA4B1AB5F5} inwtyvsvp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33CEA66C-E0FD-46ee-97C5-D8AFD76F634B} inxjymong.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D4D044C-1FE4-4d2d-95E6-60AFC36DA05B} inmnccutj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4706FDD8-3E40-4ff3-9B09-3171D5A87980} infslrijv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB1F4D68-94B9-4396-A0C2-99026FBC311D} inhscspdt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0423DCE7-90F2-4574-AAAE-A1F28B21C159} inkxmjgli.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5385C475-FB74-4ee2-B9E4-197D183338AC} innjrlbrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FFC78797-F739-4170-8F73-415325BD2766}\stubpath = "C:\\Windows\\system32\\ingvetxyk.exe" inxtemyti.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D927DE12-8594-4d50-A668-DE1E951180D2} inejnhnnw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C9182D3-BE49-4069-9A6B-101C0BDF4FA9}\stubpath = "C:\\Windows\\system32\\inclwgwbt.exe" inwtdautu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C961E064-D309-4e97-AE4D-2AF663A8C909}\stubpath = "C:\\Windows\\system32\\inqrggyxc.exe" inlofemzm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D37436E8-BC73-4776-BB96-A8161089E9A4}\stubpath = "C:\\Windows\\system32\\inalzlawr.exe" inzewkdpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D989099-0A9B-4513-8465-18CE4A1CA149} inclpwksm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D58B00D-4F56-4248-9983-A57647E5A550}\stubpath = "C:\\Windows\\system32\\inquussur.exe" infgwnmcy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAEB6D2D-85E1-447d-968C-4FB359CF5E67} inztkqidm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5315F2C-ADFF-4da4-B59C-AF7E7BEDBC62}\stubpath = "C:\\Windows\\system32\\inqgdzfrf.exe" inqmfrmyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B040963-DF10-4d07-8508-83E33C8C4000}\stubpath = "C:\\Windows\\system32\\inzhuwqpq.exe" incbrdfjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B43D2719-0958-46d3-B40A-542CFA197E91} invzzdxxz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B632207-E795-48d0-990E-EE1D77D375A7}\stubpath = "C:\\Windows\\system32\\inipelkjl.exe" infzzbyva.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7DF6205-2883-439a-BE51-AA176DD86F48} inufueytz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98689795-ADB0-46ec-99FA-19119A51CD29}\stubpath = "C:\\Windows\\system32\\injhulmow.exe" inhfsfaqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8202C310-EEA0-4ed4-9D41-C32D390BBD00}\stubpath = "C:\\Windows\\system32\\injyiwuqi.exe" injkrqgyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A4395A3-5682-4c69-B879-35C3CF220CD9}\stubpath = "C:\\Windows\\system32\\inrcangym.exe" inucuflpc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{013A092D-27D3-432d-A699-E08EC061782F} injdwyyif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B4452D6-46AD-4e55-B1B3-056CA443560A}\stubpath = "C:\\Windows\\system32\\inytozkkh.exe" ineupaato.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91067752-2637-4be7-B472-30B936CC38D2}\stubpath = "C:\\Windows\\system32\\injwbpnkv.exe" inebdvara.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0DBC4E1-FEC7-48ed-8C52-52AF0369A33A} infrfqjpo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F310B29D-2CA3-458c-9770-4178F0B8BB61} incvyzsfr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BCE0DFC-2DB8-44fc-AAB3-BBB3043A745A}\stubpath = "C:\\Windows\\system32\\inecpcnet.exe" inkuaczqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0088AC3D-FAAC-4506-91A1-F80927CE2F80}\stubpath = "C:\\Windows\\system32\\inrmslxzd.exe" inuydrpyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{330B9A6E-69A4-46ec-AA25-9F6C274E4ED4} inmkxopbr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{034D81CB-FE95-43cf-973D-0791082C73AC}\stubpath = "C:\\Windows\\system32\\inmflkmos.exe" inqxvmprs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6161EA97-D5BB-4de3-9322-1D230555F0F1} intetdxsy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6946C3B0-BCAE-4355-926E-EB694DC32CBA}\stubpath = "C:\\Windows\\system32\\inzewkdpr.exe" inrurbsrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{173D3898-9974-4253-A17B-11665042DCBF}\stubpath = "C:\\Windows\\system32\\invuwaxma.exe" inyufnzuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B950C99F-2E81-4a42-BA31-F9956B54B55B}\stubpath = "C:\\Windows\\system32\\inadbobmd.exe" injhulmow.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F09DC81-18B6-448b-96CC-6BDDB3D5E5CD} inalzlawr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8978780-D1A3-442e-88A5-EA01E751A92E} infrgispe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF00065A-D935-4bab-91AC-AC8A441988A5} inwixlnmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CF16EBD-D14D-4958-AD51-2D60CD85F06E} injyixbhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D872F96-B08E-452c-96E3-ABF878477DB2} indtwnmuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA8D1FE5-0BF9-4491-BD67-224F5100D26A}\stubpath = "C:\\Windows\\system32\\inxrycagn.exe" inopeewva.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A4395A3-5682-4c69-B879-35C3CF220CD9} inucuflpc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61498123-CA80-480f-89B5-FD22D12613D1}\stubpath = "C:\\Windows\\system32\\inqfeufhj.exe" inpqffxwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45EA02CD-3829-49b2-948E-DF59F4A18D40} indlyubtu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07F9DD17-3D16-45ac-B312-01E2DC5AFD54}\stubpath = "C:\\Windows\\system32\\inhpdyhbh.exe" inrlmbbts.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EAEB2538-F6A6-4f1c-ADDF-98AE2D002FDD} inzloqpih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EE49D3A-02E8-41d3-9249-FF63F2DEE57E}\stubpath = "C:\\Windows\\system32\\inegrpflv.exe" injwbpnkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E27836E6-3F5F-4556-9D2D-EE05514EDB1C}\stubpath = "C:\\Windows\\system32\\injvlaikw.exe" inadbobmd.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001200000001c450-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 3572 inlsmacbt.exe 1240 inpbwqegf.exe 4620 inetlfmxc.exe 3736 inbqiycju.exe 3004 inxjymong.exe 3504 indwztgsi.exe 3536 inaexuhtj.exe 3176 innfvgrkz.exe 2480 intfuikjc.exe 3580 inykznpoh.exe 1296 inaphxbit.exe 3116 infhthtec.exe 3940 inmtnbdcu.exe 2684 infdqdofu.exe 2540 inldtepix.exe 4776 incvyzsfr.exe 2432 innqsrkjz.exe 1420 indskelwb.exe 2256 incgzwjvl.exe 988 incrjzdkv.exe 4936 inaikwkwh.exe 4168 inruwvobn.exe 4448 injyqkarh.exe 1752 incanalcr.exe 1188 inwixlnmf.exe 1224 inoavpdfe.exe 2536 inbuxzyre.exe 948 inzkcszdo.exe 6068 indxawycz.exe 4964 infvypoww.exe 3024 inogwahsa.exe 2976 inzvgovkd.exe 2016 inrngsnzc.exe 2588 inbrulkss.exe 3756 ingvzmksi.exe 3280 insvxwpco.exe 2420 inixpjqgj.exe 5076 insohtodl.exe 3792 infumgnyd.exe 1336 inpleqlxa.exe 2576 inrdysgih.exe 5160 inyjbrycn.exe 1692 inwmpgfnn.exe 6016 ingvnhoze.exe 5864 inqmfrmyb.exe 2972 inqgdzfrf.exe 1716 inpsutmlb.exe 2348 inpiofygs.exe 1944 inkautvwl.exe 704 inugvjlkd.exe 5316 intsuvkkg.exe 3360 inwsdlxsh.exe 5252 indhxkwmb.exe 4192 ineybxzdp.exe 5228 inahuhbcs.exe 1964 inqcxrfhg.exe 3576 inwhpwale.exe 4892 injwnoaqy.exe 1860 inxtemyti.exe 2712 ingvetxyk.exe 5716 inbpxnjbw.exe 5632 ineuxonvv.exe 5480 inhiypoew.exe 4500 inyufnzuj.exe - Loads dropped DLL 64 IoCs
pid Process 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe 3572 inlsmacbt.exe 3572 inlsmacbt.exe 1240 inpbwqegf.exe 1240 inpbwqegf.exe 4620 inetlfmxc.exe 4620 inetlfmxc.exe 3736 inbqiycju.exe 3736 inbqiycju.exe 3004 inxjymong.exe 3004 inxjymong.exe 3504 indwztgsi.exe 3504 indwztgsi.exe 3536 inaexuhtj.exe 3536 inaexuhtj.exe 3176 innfvgrkz.exe 3176 innfvgrkz.exe 2480 intfuikjc.exe 2480 intfuikjc.exe 3580 inykznpoh.exe 3580 inykznpoh.exe 1296 inaphxbit.exe 1296 inaphxbit.exe 3116 infhthtec.exe 3116 infhthtec.exe 3940 inmtnbdcu.exe 3940 inmtnbdcu.exe 2684 infdqdofu.exe 2684 infdqdofu.exe 2540 inldtepix.exe 2540 inldtepix.exe 4776 incvyzsfr.exe 4776 incvyzsfr.exe 2432 innqsrkjz.exe 2432 innqsrkjz.exe 1420 indskelwb.exe 1420 indskelwb.exe 2256 incgzwjvl.exe 2256 incgzwjvl.exe 988 incrjzdkv.exe 988 incrjzdkv.exe 4936 inaikwkwh.exe 4936 inaikwkwh.exe 4168 inruwvobn.exe 4168 inruwvobn.exe 4448 injyqkarh.exe 4448 injyqkarh.exe 1752 incanalcr.exe 1752 incanalcr.exe 1188 inwixlnmf.exe 1188 inwixlnmf.exe 1224 inoavpdfe.exe 1224 inoavpdfe.exe 2536 inbuxzyre.exe 2536 inbuxzyre.exe 948 inzkcszdo.exe 948 inzkcszdo.exe 6068 indxawycz.exe 6068 indxawycz.exe 4964 infvypoww.exe 4964 infvypoww.exe 3024 inogwahsa.exe 3024 inogwahsa.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inngmlnpt.exe_lang.ini intmsjkwc.exe File opened for modification C:\Windows\SysWOW64\inaikwkwh.exe_lang.ini incrjzdkv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyqkarh.exe File created C:\Windows\SysWOW64\inochlfll.exe infudswxj.exe File created C:\Windows\SysWOW64\inmawkptn.exe inxsdoolp.exe File created C:\Windows\SysWOW64\iniwaqpwa.exe inomvcziu.exe File opened for modification C:\Windows\SysWOW64\injrhdzvq.exe_lang.ini inkxmjgli.exe File created C:\Windows\SysWOW64\ineqbmfxl.exe inkietvme.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkietvme.exe File opened for modification C:\Windows\SysWOW64\ineuxonvv.exe_lang.ini inbpxnjbw.exe File opened for modification C:\Windows\SysWOW64\innuocedv.exe_lang.ini indscwrxb.exe File created C:\Windows\SysWOW64\inihodrxd.exe inbmkzbqa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzjwmbpr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intojzuff.exe File created C:\Windows\SysWOW64\inaphxbit.exe inykznpoh.exe File opened for modification C:\Windows\SysWOW64\inlofemzm.exe_lang.ini inaqceivb.exe File opened for modification C:\Windows\SysWOW64\inzfhvydh.exe_lang.ini incvdypdo.exe File opened for modification C:\Windows\SysWOW64\ineugyxhj.exe_lang.ini ingtjmoji.exe File opened for modification C:\Windows\SysWOW64\inmnccutj.exe_lang.ini inochlfll.exe File created C:\Windows\SysWOW64\inmxiifwj.exe inclzteci.exe File created C:\Windows\SysWOW64\inuqbjvqf.exe inkbaivic.exe File opened for modification C:\Windows\SysWOW64\inclwgwbt.exe_lang.ini inwtdautu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indlyubtu.exe File created C:\Windows\SysWOW64\inaivxrqr.exe inmawkptn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvgovkd.exe File opened for modification C:\Windows\SysWOW64\intsuvkkg.exe_lang.ini inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\infsuonoj.exe_lang.ini indvjzcoq.exe File created C:\Windows\SysWOW64\indsbquvh.exe ineugyxhj.exe File opened for modification C:\Windows\SysWOW64\inhpdyhbh.exe_lang.ini inrlmbbts.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inebdvara.exe File created C:\Windows\SysWOW64\inupkqjvx.exe inupalliz.exe File created C:\Windows\SysWOW64\inhscspdt.exe iniszaxor.exe File created C:\Windows\SysWOW64\inegrpflv.exe injwbpnkv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incgzwjvl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyufnzuj.exe File created C:\Windows\SysWOW64\inscqyokc.exe inmprqjiy.exe File created C:\Windows\SysWOW64\inatybwnb.exe infslrijv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuiybnpg.exe File created C:\Windows\SysWOW64\iniszdhvx.exe inztkqidm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innlypqcs.exe File created C:\Windows\SysWOW64\inwgusogd.exe inwyzbftn.exe File created C:\Windows\SysWOW64\inzewkdpr.exe inrurbsrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfqeotx.exe File created C:\Windows\SysWOW64\inhfbqsjb.exe infrgispe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innqsrkjz.exe File opened for modification C:\Windows\SysWOW64\iniszaxor.exe_lang.ini inrhnxdft.exe File opened for modification C:\Windows\SysWOW64\inqrggyxc.exe_lang.ini inlofemzm.exe File created C:\Windows\SysWOW64\inzhpyfbx.exe incwvxbyn.exe File created C:\Windows\SysWOW64\inbmkzbqa.exe inuiybnpg.exe File created C:\Windows\SysWOW64\inbmyhvlc.exe inhnmoqun.exe File created C:\Windows\SysWOW64\inbfffozj.exe inecpcnet.exe File opened for modification C:\Windows\SysWOW64\inionprva.exe_lang.ini insrzztuj.exe File created C:\Windows\SysWOW64\inzfhvydh.exe incvdypdo.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbsfowhf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaaajueu.exe File opened for modification C:\Windows\SysWOW64\inruwvobn.exe_lang.ini inaikwkwh.exe File created C:\Windows\SysWOW64\ingvzmksi.exe inbrulkss.exe File created C:\Windows\SysWOW64\inlhzufqa.exe inbfyviuk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inooxsntm.exe File created C:\Windows\SysWOW64\inrshhzyd.exe inmkimmxk.exe File created C:\Windows\SysWOW64\inujlcwuk.exe inigtklnv.exe File opened for modification C:\Windows\SysWOW64\inxhvtpha.exe_lang.ini inatybwnb.exe File opened for modification C:\Windows\SysWOW64\inalzlawr.exe_lang.ini inzewkdpr.exe File opened for modification C:\Windows\SysWOW64\inijzqpfx.exe_lang.ini intbosajb.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfqeotx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infsuonoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwbpnkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwztgsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhsblrqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniszaxor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingcowdkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbaqtkjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclpwksm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indeulkya.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insohtodl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpleqlxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineuxonvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmnccutj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkbaivic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inftrnfcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intpaiupe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsdlxsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtvpopk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtgabri.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrurbsrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzhuwqpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inocymrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incajnuiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqxbfmkb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intetdxsy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhbuwzwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaphxbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthmqkqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inionprva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrdysgih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intcrvwiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuloqrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmqlrpew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxavmale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inihodrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inotjfrzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxjymong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaexuhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indpalewk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqjpgzht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzhpyfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegrpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrshhzyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpfzcyeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqiycju.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indskelwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaikwkwh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infudswxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incraptug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfyviuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbqostfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmflkmos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indqsmlmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inimthpzj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbihgy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inligcrtk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innjrlbrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvetxyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbpxnjbw.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe 3572 inlsmacbt.exe 3572 inlsmacbt.exe 1240 inpbwqegf.exe 1240 inpbwqegf.exe 4620 inetlfmxc.exe 4620 inetlfmxc.exe 3736 inbqiycju.exe 3736 inbqiycju.exe 3004 inxjymong.exe 3004 inxjymong.exe 3504 indwztgsi.exe 3504 indwztgsi.exe 3536 inaexuhtj.exe 3536 inaexuhtj.exe 3176 innfvgrkz.exe 3176 innfvgrkz.exe 2480 intfuikjc.exe 2480 intfuikjc.exe 3580 inykznpoh.exe 3580 inykznpoh.exe 1296 inaphxbit.exe 1296 inaphxbit.exe 3116 infhthtec.exe 3116 infhthtec.exe 3940 inmtnbdcu.exe 3940 inmtnbdcu.exe 2684 infdqdofu.exe 2684 infdqdofu.exe 2540 inldtepix.exe 2540 inldtepix.exe 4776 incvyzsfr.exe 4776 incvyzsfr.exe 2432 innqsrkjz.exe 2432 innqsrkjz.exe 1420 indskelwb.exe 1420 indskelwb.exe 2256 incgzwjvl.exe 2256 incgzwjvl.exe 988 incrjzdkv.exe 988 incrjzdkv.exe 4936 inaikwkwh.exe 4936 inaikwkwh.exe 4168 inruwvobn.exe 4168 inruwvobn.exe 4448 injyqkarh.exe 4448 injyqkarh.exe 1752 incanalcr.exe 1752 incanalcr.exe 1188 inwixlnmf.exe 1188 inwixlnmf.exe 1224 inoavpdfe.exe 1224 inoavpdfe.exe 2536 inbuxzyre.exe 2536 inbuxzyre.exe 948 inzkcszdo.exe 948 inzkcszdo.exe 6068 indxawycz.exe 6068 indxawycz.exe 4964 infvypoww.exe 4964 infvypoww.exe 3024 inogwahsa.exe 3024 inogwahsa.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 3572 inlsmacbt.exe Token: SeDebugPrivilege 1240 inpbwqegf.exe Token: SeDebugPrivilege 4620 inetlfmxc.exe Token: SeDebugPrivilege 3736 inbqiycju.exe Token: SeDebugPrivilege 3004 inxjymong.exe Token: SeDebugPrivilege 3504 indwztgsi.exe Token: SeDebugPrivilege 3536 inaexuhtj.exe Token: SeDebugPrivilege 3176 innfvgrkz.exe Token: SeDebugPrivilege 2480 intfuikjc.exe Token: SeDebugPrivilege 3580 inykznpoh.exe Token: SeDebugPrivilege 1296 inaphxbit.exe Token: SeDebugPrivilege 3116 infhthtec.exe Token: SeDebugPrivilege 3940 inmtnbdcu.exe Token: SeDebugPrivilege 2684 infdqdofu.exe Token: SeDebugPrivilege 2540 inldtepix.exe Token: SeDebugPrivilege 4776 incvyzsfr.exe Token: SeDebugPrivilege 2432 innqsrkjz.exe Token: SeDebugPrivilege 1420 indskelwb.exe Token: SeDebugPrivilege 2256 incgzwjvl.exe Token: SeDebugPrivilege 988 incrjzdkv.exe Token: SeDebugPrivilege 4936 inaikwkwh.exe Token: SeDebugPrivilege 4168 inruwvobn.exe Token: SeDebugPrivilege 4448 injyqkarh.exe Token: SeDebugPrivilege 1752 incanalcr.exe Token: SeDebugPrivilege 1188 inwixlnmf.exe Token: SeDebugPrivilege 1224 inoavpdfe.exe Token: SeDebugPrivilege 2536 inbuxzyre.exe Token: SeDebugPrivilege 948 inzkcszdo.exe Token: SeDebugPrivilege 6068 indxawycz.exe Token: SeDebugPrivilege 4964 infvypoww.exe Token: SeDebugPrivilege 3024 inogwahsa.exe Token: SeDebugPrivilege 2976 inzvgovkd.exe Token: SeDebugPrivilege 2016 inrngsnzc.exe Token: SeDebugPrivilege 2588 inbrulkss.exe Token: SeDebugPrivilege 3756 ingvzmksi.exe Token: SeDebugPrivilege 3280 insvxwpco.exe Token: SeDebugPrivilege 2420 inixpjqgj.exe Token: SeDebugPrivilege 5076 insohtodl.exe Token: SeDebugPrivilege 3792 infumgnyd.exe Token: SeDebugPrivilege 1336 inpleqlxa.exe Token: SeDebugPrivilege 2576 inrdysgih.exe Token: SeDebugPrivilege 5160 inyjbrycn.exe Token: SeDebugPrivilege 1692 inwmpgfnn.exe Token: SeDebugPrivilege 6016 ingvnhoze.exe Token: SeDebugPrivilege 5864 inqmfrmyb.exe Token: SeDebugPrivilege 2972 inqgdzfrf.exe Token: SeDebugPrivilege 1716 inpsutmlb.exe Token: SeDebugPrivilege 2348 inpiofygs.exe Token: SeDebugPrivilege 1944 inkautvwl.exe Token: SeDebugPrivilege 704 inugvjlkd.exe Token: SeDebugPrivilege 5316 intsuvkkg.exe Token: SeDebugPrivilege 3360 inwsdlxsh.exe Token: SeDebugPrivilege 5252 indhxkwmb.exe Token: SeDebugPrivilege 4192 ineybxzdp.exe Token: SeDebugPrivilege 5228 inahuhbcs.exe Token: SeDebugPrivilege 1964 inqcxrfhg.exe Token: SeDebugPrivilege 3576 inwhpwale.exe Token: SeDebugPrivilege 4892 injwnoaqy.exe Token: SeDebugPrivilege 1860 inxtemyti.exe Token: SeDebugPrivilege 2712 ingvetxyk.exe Token: SeDebugPrivilege 5716 inbpxnjbw.exe Token: SeDebugPrivilege 5632 ineuxonvv.exe Token: SeDebugPrivilege 5480 inhiypoew.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe 3572 inlsmacbt.exe 1240 inpbwqegf.exe 4620 inetlfmxc.exe 3736 inbqiycju.exe 3004 inxjymong.exe 3504 indwztgsi.exe 3536 inaexuhtj.exe 3176 innfvgrkz.exe 2480 intfuikjc.exe 3580 inykznpoh.exe 1296 inaphxbit.exe 3116 infhthtec.exe 3940 inmtnbdcu.exe 2684 infdqdofu.exe 2540 inldtepix.exe 4776 incvyzsfr.exe 2432 innqsrkjz.exe 1420 indskelwb.exe 2256 incgzwjvl.exe 988 incrjzdkv.exe 4936 inaikwkwh.exe 4168 inruwvobn.exe 4448 injyqkarh.exe 1752 incanalcr.exe 1188 inwixlnmf.exe 1224 inoavpdfe.exe 2536 inbuxzyre.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 3572 1344 2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 3572 wrote to memory of 1240 3572 inlsmacbt.exe 90 PID 1240 wrote to memory of 4620 1240 inpbwqegf.exe 91 PID 4620 wrote to memory of 3736 4620 inetlfmxc.exe 92 PID 3736 wrote to memory of 3004 3736 inbqiycju.exe 93 PID 3004 wrote to memory of 3504 3004 inxjymong.exe 94 PID 3504 wrote to memory of 3536 3504 indwztgsi.exe 95 PID 3536 wrote to memory of 3176 3536 inaexuhtj.exe 96 PID 3176 wrote to memory of 2480 3176 innfvgrkz.exe 97 PID 2480 wrote to memory of 3580 2480 intfuikjc.exe 98 PID 3580 wrote to memory of 1296 3580 inykznpoh.exe 99 PID 1296 wrote to memory of 3116 1296 inaphxbit.exe 100 PID 3116 wrote to memory of 3940 3116 infhthtec.exe 101 PID 3940 wrote to memory of 2684 3940 inmtnbdcu.exe 102 PID 2684 wrote to memory of 2540 2684 infdqdofu.exe 103 PID 2540 wrote to memory of 4776 2540 inldtepix.exe 104 PID 4776 wrote to memory of 2432 4776 incvyzsfr.exe 105 PID 2432 wrote to memory of 1420 2432 innqsrkjz.exe 106 PID 1420 wrote to memory of 2256 1420 indskelwb.exe 107 PID 2256 wrote to memory of 988 2256 incgzwjvl.exe 108 PID 988 wrote to memory of 4936 988 incrjzdkv.exe 109 PID 4936 wrote to memory of 4168 4936 inaikwkwh.exe 110 PID 4168 wrote to memory of 4448 4168 inruwvobn.exe 111 PID 4448 wrote to memory of 1752 4448 injyqkarh.exe 112 PID 1752 wrote to memory of 1188 1752 incanalcr.exe 113 PID 1188 wrote to memory of 1224 1188 inwixlnmf.exe 114 PID 1224 wrote to memory of 2536 1224 inoavpdfe.exe 115 PID 2536 wrote to memory of 948 2536 inbuxzyre.exe 116 PID 948 wrote to memory of 6068 948 inzkcszdo.exe 117 PID 6068 wrote to memory of 4964 6068 indxawycz.exe 118 PID 4964 wrote to memory of 3024 4964 infvypoww.exe 119 PID 3024 wrote to memory of 2976 3024 inogwahsa.exe 120 PID 2976 wrote to memory of 2016 2976 inzvgovkd.exe 121 PID 2016 wrote to memory of 2588 2016 inrngsnzc.exe 122 PID 2588 wrote to memory of 3756 2588 inbrulkss.exe 123 PID 3756 wrote to memory of 3280 3756 ingvzmksi.exe 124 PID 3280 wrote to memory of 2420 3280 insvxwpco.exe 125 PID 2420 wrote to memory of 5076 2420 inixpjqgj.exe 126 PID 5076 wrote to memory of 3792 5076 insohtodl.exe 127 PID 3792 wrote to memory of 1336 3792 infumgnyd.exe 128 PID 1336 wrote to memory of 2576 1336 inpleqlxa.exe 129 PID 2576 wrote to memory of 5160 2576 inrdysgih.exe 130 PID 5160 wrote to memory of 1692 5160 inyjbrycn.exe 131 PID 1692 wrote to memory of 6016 1692 inwmpgfnn.exe 132 PID 6016 wrote to memory of 5864 6016 ingvnhoze.exe 133 PID 5864 wrote to memory of 2972 5864 inqmfrmyb.exe 134 PID 2972 wrote to memory of 1716 2972 inqgdzfrf.exe 135 PID 1716 wrote to memory of 2348 1716 inpsutmlb.exe 136 PID 2348 wrote to memory of 1944 2348 inpiofygs.exe 137 PID 1944 wrote to memory of 704 1944 inkautvwl.exe 138 PID 704 wrote to memory of 5316 704 inugvjlkd.exe 139 PID 5316 wrote to memory of 3360 5316 intsuvkkg.exe 140 PID 3360 wrote to memory of 5252 3360 inwsdlxsh.exe 141 PID 5252 wrote to memory of 4192 5252 indhxkwmb.exe 142 PID 4192 wrote to memory of 5228 4192 ineybxzdp.exe 143 PID 5228 wrote to memory of 1964 5228 inahuhbcs.exe 144 PID 1964 wrote to memory of 3576 1964 inqcxrfhg.exe 145 PID 3576 wrote to memory of 4892 3576 inwhpwale.exe 146 PID 4892 wrote to memory of 1860 4892 injwnoaqy.exe 147 PID 1860 wrote to memory of 2712 1860 inxtemyti.exe 148 PID 2712 wrote to memory of 5716 2712 ingvetxyk.exe 149 PID 5716 wrote to memory of 5632 5716 inbpxnjbw.exe 150 PID 5632 wrote to memory of 5480 5632 ineuxonvv.exe 151 PID 5480 wrote to memory of 4500 5480 inhiypoew.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3c400c655adee0869a087f44127fd6c4_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe15⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe17⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe26⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe46⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\inkautvwl.exeC:\Windows\system32\inkautvwl.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe51⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe60⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe65⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
PID:4500 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe66⤵PID:2524
-
C:\Windows\SysWOW64\inwnmuuop.exeC:\Windows\system32\inwnmuuop.exe67⤵PID:5460
-
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe68⤵PID:5980
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe69⤵PID:4572
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe70⤵PID:4628
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe71⤵PID:3976
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe72⤵PID:5944
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe73⤵PID:5828
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe74⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5880 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe75⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3936 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3220 -
C:\Windows\SysWOW64\injvlaikw.exeC:\Windows\system32\injvlaikw.exe77⤵PID:3668
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe78⤵PID:1108
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe79⤵PID:4580
-
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe80⤵PID:6092
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe81⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe82⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe83⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:4604 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe84⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe85⤵
- Drops file in System32 directory
PID:4316 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe86⤵PID:4856
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe87⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe88⤵PID:2108
-
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe89⤵PID:1292
-
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe90⤵
- Drops file in System32 directory
PID:5372 -
C:\Windows\SysWOW64\inupkqjvx.exeC:\Windows\system32\inupkqjvx.exe91⤵PID:2284
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe92⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe93⤵PID:1496
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe94⤵PID:4124
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe95⤵PID:4248
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe96⤵PID:2900
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe97⤵PID:6044
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe98⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2200 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe99⤵PID:4144
-
C:\Windows\SysWOW64\inoxdfqoe.exeC:\Windows\system32\inoxdfqoe.exe100⤵PID:5896
-
C:\Windows\SysWOW64\inbuzcxoc.exeC:\Windows\system32\inbuzcxoc.exe101⤵PID:5152
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe102⤵PID:1704
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe103⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1896 -
C:\Windows\SysWOW64\injyiwuqi.exeC:\Windows\system32\injyiwuqi.exe104⤵PID:1352
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe105⤵PID:2464
-
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe106⤵PID:4972
-
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe107⤵PID:1068
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe108⤵PID:2816
-
C:\Windows\SysWOW64\injyixbhg.exeC:\Windows\system32\injyixbhg.exe109⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5608 -
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe110⤵
- System Location Discovery: System Language Discovery
PID:4156 -
C:\Windows\SysWOW64\inkuaczqt.exeC:\Windows\system32\inkuaczqt.exe111⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1176 -
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe112⤵
- Drops file in System32 directory
PID:2708 -
C:\Windows\SysWOW64\inbfffozj.exeC:\Windows\system32\inbfffozj.exe113⤵PID:5940
-
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe114⤵PID:4176
-
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe115⤵PID:3260
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe116⤵
- Drops file in System32 directory
PID:4332 -
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe117⤵PID:2468
-
C:\Windows\SysWOW64\inbobfwma.exeC:\Windows\system32\inbobfwma.exe118⤵
- Boot or Logon Autostart Execution: Active Setup
PID:264 -
C:\Windows\SysWOW64\insaljfpw.exeC:\Windows\system32\insaljfpw.exe119⤵PID:3864
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe120⤵PID:4304
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe121⤵
- System Location Discovery: System Language Discovery
PID:6032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-