Analysis
- max time kernel
73s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 00:35
Behavioral task
behavioral1
Sample
2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260821-axtmfagg54
- SHA256 2d2ec54e99a355926b47a9d1b505346787ae4dd886e0e4bc6b81580e66ae4281
- MD5 36e069edbbf537737a8640c0cbf669b6
- SHA1 eda8f17f52ac0ec068fa4d3bab8f431a226206f8
- SHA512 0e776eb4a6b6c98078e1b0b7e78b8b53eb60b9755c1a195cdd550ae6e8b20b31e1b5e26fddc6533859a38c1c4830d0551d16508879c72521002df3f703f0d66d
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTE:RPjOa1NxyYtH1E
- TLSH T1A615AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 54 IoCs
resource yara_rule behavioral2/memory/5668-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5668-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c54d-21.dat family_gh0strat behavioral2/files/0x000c00000001c551-32.dat family_gh0strat behavioral2/files/0x000c00000001c553-40.dat family_gh0strat behavioral2/memory/5940-48-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1560-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c557-65.dat family_gh0strat behavioral2/memory/5940-67-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c55a-87.dat family_gh0strat behavioral2/memory/5188-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c55f-110.dat family_gh0strat behavioral2/memory/4164-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c563-132.dat family_gh0strat behavioral2/memory/2128-135-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c567-155.dat family_gh0strat behavioral2/memory/2952-160-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c56c-178.dat family_gh0strat behavioral2/files/0x000c00000001c570-200.dat family_gh0strat behavioral2/memory/264-205-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4800-226-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c579-242.dat family_gh0strat behavioral2/memory/4324-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5268-289-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4444-403-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1160-454-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2148-471-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2096-504-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4984-522-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1304-538-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1764-488-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5648-437-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4400-419-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6060-386-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4720-369-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/824-352-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c58e-348.dat family_gh0strat behavioral2/memory/5932-331-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c58a-327.dat family_gh0strat behavioral2/memory/2624-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c586-306.dat family_gh0strat behavioral2/files/0x000c00000001c582-285.dat family_gh0strat behavioral2/files/0x000c00000001c57e-264.dat family_gh0strat behavioral2/memory/1000-247-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c575-222.dat family_gh0strat behavioral2/memory/5792-183-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1256-555-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4868-575-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4244-593-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4684-613-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4196-630-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5640-650-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2820-667-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3752-668-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA677BDD-4B7A-4af3-B286-02B1EA0CE84A}\stubpath = "C:\\Windows\\system32\\indskelwb.exe" inqmfrmyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7D194984-D894-4d50-B342-96B4F7CEFF6A}\stubpath = "C:\\Windows\\system32\\incgzwjvl.exe" innuocedv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E44AFE7-94F6-40fd-959F-1FD4883A69D5}\stubpath = "C:\\Windows\\system32\\ineybxzdp.exe" inixomukg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7747D2B-0416-4d49-9EEC-79F57DE39F5F} initcmsrt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{616C82F4-6605-400e-B4E3-32DDCE71FF3C} inlynkhmj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E75B1077-7554-4a6f-9DBD-8C2B6BBD139D}\stubpath = "C:\\Windows\\system32\\inionprva.exe" inupkqjvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{181F57FF-A1BD-495f-A587-02E380E9A9DE}\stubpath = "C:\\Windows\\system32\\iniwaqpwa.exe" insacfcod.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8014F41C-C6BA-413e-8983-40FF12483727} inmrhdpxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A9F7B50D-1E86-4175-887E-000466A16C2B}\stubpath = "C:\\Windows\\system32\\inptcowdq.exe" inbaqbdfi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{611E0B5C-9006-4d75-B213-CD2E2E368C4D} invlbrhjx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{07747581-B295-4069-9FD8-1828D38D6680}\stubpath = "C:\\Windows\\system32\\ingiuiufd.exe" inbjwysrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CB283AA-DE93-45b3-B9F7-7B862BB6440A} inbfffozj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4B6CB545-44D3-451e-9F6D-634E509C4F60}\stubpath = "C:\\Windows\\system32\\inaeepccp.exe" inuwegjgs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{325419F7-817E-435e-924E-223B51239E0A} iniqgcwmo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC5DFEAF-A920-482b-9D14-8BEF245F483C} inniyteex.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70553AEF-5655-419f-84D0-4CAADF321951} inbqostfv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{204BC45D-7710-4063-9214-AA9DE129D58F} innfajbav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A29A2A0-A730-4c5b-A12C-649B87B2014D}\stubpath = "C:\\Windows\\system32\\infxiosfk.exe" inhhujgdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89FB7EE5-118C-4a49-BAE2-D5E70B396927}\stubpath = "C:\\Windows\\system32\\inbjdjvkm.exe" inzkzjyci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FBF3408-C461-487b-BCE6-FB87FDF2DCAE}\stubpath = "C:\\Windows\\system32\\inpbwqegf.exe" 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6C6B339-C032-45de-9DA2-BA8772F1DBFF} inkivmnpx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{118A0C40-1C1B-4a3a-9A05-27F880CB4815} insgwlney.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7C055E1-23B5-44b8-ACC5-6D81757430E0}\stubpath = "C:\\Windows\\system32\\inlhzufqa.exe" inkbaivic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DD90298-CA1A-4a94-BFE8-61140F0F68F4}\stubpath = "C:\\Windows\\system32\\inxgaoyjn.exe" inkietvme.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EA43DF4-5816-4f39-9851-BF83B17A993F}\stubpath = "C:\\Windows\\system32\\inbuzcxoc.exe" inhomdgwi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABB44A6C-5EFF-4d75-873D-6131676BF6D1}\stubpath = "C:\\Windows\\system32\\inhpdyhbh.exe" inzyhfjju.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7810D9FA-698A-46f5-964F-9C7288B139B6}\stubpath = "C:\\Windows\\system32\\invzesqzg.exe" inlrcrbvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BEF0BEC-7317-46bb-BA63-F53D2B5C298A}\stubpath = "C:\\Windows\\system32\\inzvgovkd.exe" inadbobmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C80589C3-820F-47bc-9C2F-5F0F3F1C485F}\stubpath = "C:\\Windows\\system32\\inxujybfr.exe" inlgphgbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64D70C71-784A-405e-A176-48D54FBAE3F4} inxuxrboe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F18376C-9314-422d-BCE3-159B955F0149} inwhjedoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E995F0C-BCAA-430f-A508-224545A59250}\stubpath = "C:\\Windows\\system32\\inyfydwsq.exe" inkwblfyk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{179DAE91-6672-4d36-99EE-FFDC84DD4DDD} ingiuiufd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF17C3F8-3442-44a5-9092-C966110B619C} indwztgsi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00E556A0-36E3-4151-B527-E6651022CF5D}\stubpath = "C:\\Windows\\system32\\inlgwrccv.exe" inkuaczqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD014BAB-B2AD-43ae-8178-B9BFDFA3BA15}\stubpath = "C:\\Windows\\system32\\inqfeufhj.exe" intmsjkwc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D36AFADC-FC71-43f7-A434-70E20C050B24}\stubpath = "C:\\Windows\\system32\\inpdlvxfh.exe" inwikohfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5722FE39-572E-4c98-8E0C-7BFDECCF8E0D}\stubpath = "C:\\Windows\\system32\\inztjzmib.exe" inxgaoyjn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09E998AF-0EB0-4add-AFE1-76981B71A17A} inqswbpnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E64A3ABE-CF81-4a57-8796-86E1233964FB} ingcowdkg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC9D4098-155F-4bda-874A-C57FF4869C68}\stubpath = "C:\\Windows\\system32\\inasgqvzt.exe" inyoqadam.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62563FAC-0A57-45cb-94AD-382077885A61} intvfbarj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA9E6EFF-F4A2-4a51-B130-10AAAB1C3EE2}\stubpath = "C:\\Windows\\system32\\inhzpfbvl.exe" inisglpjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{048D6B7C-BB55-44bf-9BAF-5B6AEC70BD3A} injausioy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9C7F221-FF78-4224-A0BB-F34996EC4A04}\stubpath = "C:\\Windows\\system32\\insbznvcp.exe" inbhrywnq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84FEA6D1-12EE-4a52-BCF3-D939CC718870} inztjzmib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C2DC2D5-0083-4d30-8BBD-AD513B610AD1}\stubpath = "C:\\Windows\\system32\\inrwawibx.exe" inoioprby.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF262B86-5248-4cf4-A3E4-6A477F7CAD4E} ingatvyvf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B723484B-AAC2-4e9d-BFA9-A2B0AB84708D}\stubpath = "C:\\Windows\\system32\\inwixlnmf.exe" inqtvunam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C7A48F5-A741-47d5-A1D9-1A0BADD62F3A}\stubpath = "C:\\Windows\\system32\\inirmhzng.exe" incbrdfjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FC7EDAA-BC08-464e-99A8-AA9096BD85ED} inyegtexf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CEEFBE2-14AA-4892-BD20-9A8AD0EB9CFC}\stubpath = "C:\\Windows\\system32\\innsieqyf.exe" indeoeuxa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A38F77F-AF4F-469b-B3FC-4504397AFF77}\stubpath = "C:\\Windows\\system32\\ineuxonvv.exe" inrdysgih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D990A6B0-C69D-40fe-9A5D-A838E994FFE3}\stubpath = "C:\\Windows\\system32\\inwsdlxsh.exe" inknedlyl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B5C0503-A53F-4093-8034-DCB81C698B7D} inupalliz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4EE1498-D2B0-4f97-AFD8-49523108B7CB} infslrijv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E25B5FA-BB64-4262-B88E-11186BB91015} inowmiavg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3116692B-370C-4ea5-8F44-292C105CA35E} inyodrton.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22364F26-892F-407f-85B0-F837225454F9}\stubpath = "C:\\Windows\\system32\\inrshhzyd.exe" inwmpgfnn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9CD39DC7-3ECA-44c7-8ED3-274C1CAE5D7F} inyorihpp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CBA2399E-3BA6-47b6-A4EA-7AC2D53BD776} inaivxrqr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC7500CB-229E-4909-80DD-1D1E63ED181F}\stubpath = "C:\\Windows\\system32\\inpdimgmm.exe" iniqzgcyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CE7C37C-18D7-465e-8FFF-AAD25C9688ED}\stubpath = "C:\\Windows\\system32\\inqxbfmkb.exe" insaljfpw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97F3362D-E22F-48be-A2DA-FCF75EC38102} inwskdhbh.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000019ce0-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1560 inpbwqegf.exe 5940 inuqbjvqf.exe 5188 inxiaqxbm.exe 4164 inbuxzyre.exe 2128 inmeufqjy.exe 2952 inmtnbdcu.exe 5792 infudswxj.exe 264 inqmfrmyb.exe 4800 indskelwb.exe 1000 inykznpoh.exe 4324 inpsutmlb.exe 5268 inqgdzfrf.exe 2624 inxjymong.exe 5932 inortslka.exe 824 inatwyxqd.exe 4720 inbfyviuk.exe 6060 inrngsnzc.exe 4444 inetlfmxc.exe 4400 inzhpyfbx.exe 5648 inoavpdfe.exe 1160 intfuikjc.exe 2148 ingwzqpxx.exe 1764 invuwaxma.exe 2096 inxtemyti.exe 4984 inyjbrycn.exe 1304 insohtodl.exe 1256 inugvjlkd.exe 4868 inwmpgfnn.exe 4244 inrshhzyd.exe 4684 inhiypoew.exe 4196 inaexuhtj.exe 5640 innuocedv.exe 2820 incgzwjvl.exe 3752 incrjzdkv.exe 2044 ingvetxyk.exe 5464 inqtvunam.exe 4716 inwixlnmf.exe 1300 intpaiupe.exe 4688 inrcangym.exe 6016 inzkcszdo.exe 2708 inaphxbit.exe 3132 invhwkmle.exe 5232 inpleqlxa.exe 1116 inadbobmd.exe 756 inzvgovkd.exe 5888 innqsrkjz.exe 5592 infdqdofu.exe 1092 indhxkwmb.exe 3556 inbqiycju.exe 1656 indtwnmuu.exe 2072 injhulmow.exe 2848 inscqyokc.exe 1992 inaikwkwh.exe 4728 inxnqhgoo.exe 4760 inhjvjvge.exe 2696 inkivmnpx.exe 5392 inesqmezb.exe 5740 inlsmacbt.exe 2988 inqcxrfhg.exe 5848 inwhpwale.exe 5756 inmibthrw.exe 4280 infumgnyd.exe 1580 inigtklnv.exe 3000 inrdysgih.exe - Loads dropped DLL 64 IoCs
pid Process 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe 1560 inpbwqegf.exe 1560 inpbwqegf.exe 5940 inuqbjvqf.exe 5940 inuqbjvqf.exe 5188 inxiaqxbm.exe 5188 inxiaqxbm.exe 4164 inbuxzyre.exe 4164 inbuxzyre.exe 2128 inmeufqjy.exe 2128 inmeufqjy.exe 2952 inmtnbdcu.exe 2952 inmtnbdcu.exe 5792 infudswxj.exe 5792 infudswxj.exe 264 inqmfrmyb.exe 264 inqmfrmyb.exe 4800 indskelwb.exe 4800 indskelwb.exe 1000 inykznpoh.exe 1000 inykznpoh.exe 4324 inpsutmlb.exe 4324 inpsutmlb.exe 5268 inqgdzfrf.exe 5268 inqgdzfrf.exe 2624 inxjymong.exe 2624 inxjymong.exe 5932 inortslka.exe 5932 inortslka.exe 824 inatwyxqd.exe 824 inatwyxqd.exe 4720 inbfyviuk.exe 4720 inbfyviuk.exe 6060 inrngsnzc.exe 6060 inrngsnzc.exe 4444 inetlfmxc.exe 4444 inetlfmxc.exe 4400 inzhpyfbx.exe 4400 inzhpyfbx.exe 5648 inoavpdfe.exe 5648 inoavpdfe.exe 1160 intfuikjc.exe 1160 intfuikjc.exe 2148 ingwzqpxx.exe 2148 ingwzqpxx.exe 1764 invuwaxma.exe 1764 invuwaxma.exe 2096 inxtemyti.exe 2096 inxtemyti.exe 4984 inyjbrycn.exe 4984 inyjbrycn.exe 1304 insohtodl.exe 1304 insohtodl.exe 1256 inugvjlkd.exe 1256 inugvjlkd.exe 4868 inwmpgfnn.exe 4868 inwmpgfnn.exe 4244 inrshhzyd.exe 4244 inrshhzyd.exe 4684 inhiypoew.exe 4684 inhiypoew.exe 4196 inaexuhtj.exe 4196 inaexuhtj.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\injvlaikw.exe_lang.ini insezthji.exe File created C:\Windows\SysWOW64\inmvbdomc.exe ingkycsra.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkfaovfk.exe File created C:\Windows\SysWOW64\inmprqjiy.exe inftrnfcc.exe File opened for modification C:\Windows\SysWOW64\inwemzvcu.exe_lang.ini inngmlnpt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intojzuff.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwhxahtz.exe File opened for modification C:\Windows\SysWOW64\inbkobdgw.exe_lang.ini indqezurm.exe File opened for modification C:\Windows\SysWOW64\inirveqyf.exe_lang.ini indvpwggs.exe File created C:\Windows\SysWOW64\inlisltat.exe inuonujxj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inixpjqgj.exe File opened for modification C:\Windows\SysWOW64\insulctjf.exe_lang.ini injvkjzkm.exe File created C:\Windows\SysWOW64\inqdmufdj.exe incbrcegj.exe File created C:\Windows\SysWOW64\inmkimmxk.exe invspsmvj.exe File opened for modification C:\Windows\SysWOW64\inpkfxleq.exe_lang.ini inpiofygs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indtwnmuu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmkimmxk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhnmoqun.exe File created C:\Windows\SysWOW64\inqswbpnw.exe intlkfhrk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infvypoww.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwikohfo.exe File created C:\Windows\SysWOW64\invkhejgd.exe inaouaylq.exe File created C:\Windows\SysWOW64\inkwblfyk.exe indnibrwr.exe File created C:\Windows\SysWOW64\incwvxbyn.exe inmawkptn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxhvtpha.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inumafjdj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inueaqidm.exe File opened for modification C:\Windows\SysWOW64\inmsevrki.exe_lang.ini inttrrtqn.exe File opened for modification C:\Windows\SysWOW64\intxmhybx.exe_lang.ini infauwnfj.exe File opened for modification C:\Windows\SysWOW64\invuwaxma.exe_lang.ini ingwzqpxx.exe File opened for modification C:\Windows\SysWOW64\incsnrmiw.exe_lang.ini insgwlney.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incpcgxnb.exe File opened for modification C:\Windows\SysWOW64\indtfhlye.exe_lang.ini inyccnaan.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intbpxrhx.exe File opened for modification C:\Windows\SysWOW64\inxrqyyst.exe_lang.ini inujlcwuk.exe File opened for modification C:\Windows\SysWOW64\inblsqhkm.exe_lang.ini inisucehe.exe File created C:\Windows\SysWOW64\intuwvzao.exe incybtpgq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmqlrpew.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innezovdr.exe File opened for modification C:\Windows\SysWOW64\inwsdlxsh.exe_lang.ini inknedlyl.exe File created C:\Windows\SysWOW64\injdwyyif.exe inqdmufdj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqzaupvo.exe File created C:\Windows\SysWOW64\incraptug.exe inlgwrccv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intvfbarj.exe File created C:\Windows\SysWOW64\inlgwrccv.exe inkuaczqt.exe File created C:\Windows\SysWOW64\indlyubtu.exe infvqbbup.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incwvxbyn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingtvpopk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infnxzhjm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlhnqivx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incjmswjo.exe File created C:\Windows\SysWOW64\insjarhdx.exe inwhxahtz.exe File created C:\Windows\SysWOW64\inzjlpkqo.exe invzesqzg.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini infvypoww.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intekobge.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrurbsrs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intxmhybx.exe File created C:\Windows\SysWOW64\inxrqyyst.exe inujlcwuk.exe File opened for modification C:\Windows\SysWOW64\inueaqidm.exe_lang.ini inhnmoqun.exe File created C:\Windows\SysWOW64\inuloqrtx.exe inarenvge.exe File created C:\Windows\SysWOW64\inzkcszdo.exe inrcangym.exe File created C:\Windows\SysWOW64\inmflkmos.exe ingfvhjng.exe File created C:\Windows\SysWOW64\inbuxzyre.exe inxiaqxbm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmeufqjy.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indxawycz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inddmxhxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invspsmvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxhvtpha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhzufqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegtexf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intqwjtdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlynkhmj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbrulkss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inulkzdji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invbdruwx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrkqhiua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inofbieyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaivxrqr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuhmxsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infsuonoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaaajueu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmrxryds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhscspdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvypoww.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infslrijv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkveoutv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indrzpldy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innusjmop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infauwnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injtvdfif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbpvbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inovtknpq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisucehe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inimbeutc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwnoaqy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmvbdomc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpprolqn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuxuebv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inciujlvs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtfhlye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvdypdo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvqwujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innqaomqq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingoxeawx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iniszaxor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intekobge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzewkdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkzjyci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaeepccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inemwygil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyixbhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuinrlrc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpnlpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmosntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwegjgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inugvjlkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaikwkwh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyorihpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkuaczqt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogxmhdp.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe 1560 inpbwqegf.exe 1560 inpbwqegf.exe 5940 inuqbjvqf.exe 5940 inuqbjvqf.exe 5188 inxiaqxbm.exe 5188 inxiaqxbm.exe 4164 inbuxzyre.exe 4164 inbuxzyre.exe 2128 inmeufqjy.exe 2128 inmeufqjy.exe 2952 inmtnbdcu.exe 2952 inmtnbdcu.exe 5792 infudswxj.exe 5792 infudswxj.exe 264 inqmfrmyb.exe 264 inqmfrmyb.exe 4800 indskelwb.exe 4800 indskelwb.exe 1000 inykznpoh.exe 1000 inykznpoh.exe 4324 inpsutmlb.exe 4324 inpsutmlb.exe 5268 inqgdzfrf.exe 5268 inqgdzfrf.exe 2624 inxjymong.exe 2624 inxjymong.exe 5932 inortslka.exe 5932 inortslka.exe 824 inatwyxqd.exe 824 inatwyxqd.exe 4720 inbfyviuk.exe 4720 inbfyviuk.exe 6060 inrngsnzc.exe 6060 inrngsnzc.exe 4444 inetlfmxc.exe 4444 inetlfmxc.exe 4400 inzhpyfbx.exe 4400 inzhpyfbx.exe 5648 inoavpdfe.exe 5648 inoavpdfe.exe 1160 intfuikjc.exe 1160 intfuikjc.exe 2148 ingwzqpxx.exe 2148 ingwzqpxx.exe 1764 invuwaxma.exe 1764 invuwaxma.exe 2096 inxtemyti.exe 2096 inxtemyti.exe 4984 inyjbrycn.exe 4984 inyjbrycn.exe 1304 insohtodl.exe 1304 insohtodl.exe 1256 inugvjlkd.exe 1256 inugvjlkd.exe 4868 inwmpgfnn.exe 4868 inwmpgfnn.exe 4244 inrshhzyd.exe 4244 inrshhzyd.exe 4684 inhiypoew.exe 4684 inhiypoew.exe 4196 inaexuhtj.exe 4196 inaexuhtj.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 1560 inpbwqegf.exe Token: SeDebugPrivilege 5940 inuqbjvqf.exe Token: SeDebugPrivilege 5188 inxiaqxbm.exe Token: SeDebugPrivilege 4164 inbuxzyre.exe Token: SeDebugPrivilege 2128 inmeufqjy.exe Token: SeDebugPrivilege 2952 inmtnbdcu.exe Token: SeDebugPrivilege 5792 infudswxj.exe Token: SeDebugPrivilege 264 inqmfrmyb.exe Token: SeDebugPrivilege 4800 indskelwb.exe Token: SeDebugPrivilege 1000 inykznpoh.exe Token: SeDebugPrivilege 4324 inpsutmlb.exe Token: SeDebugPrivilege 5268 inqgdzfrf.exe Token: SeDebugPrivilege 2624 inxjymong.exe Token: SeDebugPrivilege 5932 inortslka.exe Token: SeDebugPrivilege 824 inatwyxqd.exe Token: SeDebugPrivilege 4720 inbfyviuk.exe Token: SeDebugPrivilege 6060 inrngsnzc.exe Token: SeDebugPrivilege 4444 inetlfmxc.exe Token: SeDebugPrivilege 4400 inzhpyfbx.exe Token: SeDebugPrivilege 5648 inoavpdfe.exe Token: SeDebugPrivilege 1160 intfuikjc.exe Token: SeDebugPrivilege 2148 ingwzqpxx.exe Token: SeDebugPrivilege 1764 invuwaxma.exe Token: SeDebugPrivilege 2096 inxtemyti.exe Token: SeDebugPrivilege 4984 inyjbrycn.exe Token: SeDebugPrivilege 1304 insohtodl.exe Token: SeDebugPrivilege 1256 inugvjlkd.exe Token: SeDebugPrivilege 4868 inwmpgfnn.exe Token: SeDebugPrivilege 4244 inrshhzyd.exe Token: SeDebugPrivilege 4684 inhiypoew.exe Token: SeDebugPrivilege 4196 inaexuhtj.exe Token: SeDebugPrivilege 5640 innuocedv.exe Token: SeDebugPrivilege 2820 incgzwjvl.exe Token: SeDebugPrivilege 3752 incrjzdkv.exe Token: SeDebugPrivilege 2044 ingvetxyk.exe Token: SeDebugPrivilege 5464 inqtvunam.exe Token: SeDebugPrivilege 4716 inwixlnmf.exe Token: SeDebugPrivilege 1300 intpaiupe.exe Token: SeDebugPrivilege 4688 inrcangym.exe Token: SeDebugPrivilege 6016 inzkcszdo.exe Token: SeDebugPrivilege 2708 inaphxbit.exe Token: SeDebugPrivilege 3132 invhwkmle.exe Token: SeDebugPrivilege 5232 inpleqlxa.exe Token: SeDebugPrivilege 1116 inadbobmd.exe Token: SeDebugPrivilege 756 inzvgovkd.exe Token: SeDebugPrivilege 5888 innqsrkjz.exe Token: SeDebugPrivilege 5592 infdqdofu.exe Token: SeDebugPrivilege 1092 indhxkwmb.exe Token: SeDebugPrivilege 3556 inbqiycju.exe Token: SeDebugPrivilege 1656 indtwnmuu.exe Token: SeDebugPrivilege 2072 injhulmow.exe Token: SeDebugPrivilege 2848 inscqyokc.exe Token: SeDebugPrivilege 1992 inaikwkwh.exe Token: SeDebugPrivilege 4728 inxnqhgoo.exe Token: SeDebugPrivilege 4760 inhjvjvge.exe Token: SeDebugPrivilege 2696 inkivmnpx.exe Token: SeDebugPrivilege 5392 inesqmezb.exe Token: SeDebugPrivilege 5740 inlsmacbt.exe Token: SeDebugPrivilege 2988 inqcxrfhg.exe Token: SeDebugPrivilege 5848 inwhpwale.exe Token: SeDebugPrivilege 5756 inmibthrw.exe Token: SeDebugPrivilege 4280 infumgnyd.exe Token: SeDebugPrivilege 1580 inigtklnv.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe 1560 inpbwqegf.exe 5940 inuqbjvqf.exe 5188 inxiaqxbm.exe 4164 inbuxzyre.exe 2128 inmeufqjy.exe 2952 inmtnbdcu.exe 5792 infudswxj.exe 264 inqmfrmyb.exe 4800 indskelwb.exe 1000 inykznpoh.exe 4324 inpsutmlb.exe 5268 inqgdzfrf.exe 2624 inxjymong.exe 5932 inortslka.exe 824 inatwyxqd.exe 4720 inbfyviuk.exe 6060 inrngsnzc.exe 4444 inetlfmxc.exe 4400 inzhpyfbx.exe 5648 inoavpdfe.exe 1160 intfuikjc.exe 2148 ingwzqpxx.exe 1764 invuwaxma.exe 2096 inxtemyti.exe 4984 inyjbrycn.exe 1304 insohtodl.exe 1256 inugvjlkd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5668 wrote to memory of 1560 5668 2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 1560 wrote to memory of 5940 1560 inpbwqegf.exe 90 PID 5940 wrote to memory of 5188 5940 inuqbjvqf.exe 91 PID 5188 wrote to memory of 4164 5188 inxiaqxbm.exe 92 PID 4164 wrote to memory of 2128 4164 inbuxzyre.exe 93 PID 2128 wrote to memory of 2952 2128 inmeufqjy.exe 94 PID 2952 wrote to memory of 5792 2952 inmtnbdcu.exe 95 PID 5792 wrote to memory of 264 5792 infudswxj.exe 96 PID 264 wrote to memory of 4800 264 inqmfrmyb.exe 97 PID 4800 wrote to memory of 1000 4800 indskelwb.exe 98 PID 1000 wrote to memory of 4324 1000 inykznpoh.exe 99 PID 4324 wrote to memory of 5268 4324 inpsutmlb.exe 100 PID 5268 wrote to memory of 2624 5268 inqgdzfrf.exe 101 PID 2624 wrote to memory of 5932 2624 inxjymong.exe 102 PID 5932 wrote to memory of 824 5932 inortslka.exe 103 PID 824 wrote to memory of 4720 824 inatwyxqd.exe 104 PID 4720 wrote to memory of 6060 4720 inbfyviuk.exe 105 PID 6060 wrote to memory of 4444 6060 inrngsnzc.exe 106 PID 4444 wrote to memory of 4400 4444 inetlfmxc.exe 107 PID 4400 wrote to memory of 5648 4400 inzhpyfbx.exe 108 PID 5648 wrote to memory of 1160 5648 inoavpdfe.exe 109 PID 1160 wrote to memory of 2148 1160 intfuikjc.exe 110 PID 2148 wrote to memory of 1764 2148 ingwzqpxx.exe 111 PID 1764 wrote to memory of 2096 1764 invuwaxma.exe 112 PID 2096 wrote to memory of 4984 2096 inxtemyti.exe 113 PID 4984 wrote to memory of 1304 4984 inyjbrycn.exe 114 PID 1304 wrote to memory of 1256 1304 insohtodl.exe 115 PID 1256 wrote to memory of 4868 1256 inugvjlkd.exe 116 PID 4868 wrote to memory of 4244 4868 inwmpgfnn.exe 117 PID 4244 wrote to memory of 4684 4244 inrshhzyd.exe 118 PID 4684 wrote to memory of 4196 4684 inhiypoew.exe 119 PID 4196 wrote to memory of 5640 4196 inaexuhtj.exe 120 PID 5640 wrote to memory of 2820 5640 innuocedv.exe 121 PID 2820 wrote to memory of 3752 2820 incgzwjvl.exe 122 PID 3752 wrote to memory of 2044 3752 incrjzdkv.exe 123 PID 2044 wrote to memory of 5464 2044 ingvetxyk.exe 124 PID 5464 wrote to memory of 4716 5464 inqtvunam.exe 125 PID 4716 wrote to memory of 1300 4716 inwixlnmf.exe 126 PID 1300 wrote to memory of 4688 1300 intpaiupe.exe 127 PID 4688 wrote to memory of 6016 4688 inrcangym.exe 128 PID 6016 wrote to memory of 2708 6016 inzkcszdo.exe 129 PID 2708 wrote to memory of 3132 2708 inaphxbit.exe 130 PID 3132 wrote to memory of 5232 3132 invhwkmle.exe 131 PID 5232 wrote to memory of 1116 5232 inpleqlxa.exe 132 PID 1116 wrote to memory of 756 1116 inadbobmd.exe 133 PID 756 wrote to memory of 5888 756 inzvgovkd.exe 134 PID 5888 wrote to memory of 5592 5888 innqsrkjz.exe 135 PID 5592 wrote to memory of 1092 5592 infdqdofu.exe 136 PID 1092 wrote to memory of 3556 1092 indhxkwmb.exe 137 PID 3556 wrote to memory of 1656 3556 inbqiycju.exe 138 PID 1656 wrote to memory of 2072 1656 indtwnmuu.exe 139 PID 2072 wrote to memory of 2848 2072 injhulmow.exe 140 PID 2848 wrote to memory of 1992 2848 inscqyokc.exe 141 PID 1992 wrote to memory of 4728 1992 inaikwkwh.exe 142 PID 4728 wrote to memory of 4760 4728 inxnqhgoo.exe 143 PID 4760 wrote to memory of 2696 4760 inhjvjvge.exe 144 PID 2696 wrote to memory of 5392 2696 inkivmnpx.exe 145 PID 5392 wrote to memory of 5740 5392 inesqmezb.exe 146 PID 5740 wrote to memory of 2988 5740 inlsmacbt.exe 147 PID 2988 wrote to memory of 5848 2988 inqcxrfhg.exe 148 PID 5848 wrote to memory of 5756 5848 inwhpwale.exe 149 PID 5756 wrote to memory of 4280 5756 inmibthrw.exe 150 PID 4280 wrote to memory of 1580 4280 infumgnyd.exe 151 PID 1580 wrote to memory of 3000 1580 inigtklnv.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_36e069edbbf537737a8640c0cbf669b6_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\inzhpyfbx.exeC:\Windows\system32\inzhpyfbx.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe29⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe37⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe57⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe65⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe66⤵PID:848
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe67⤵PID:1408
-
C:\Windows\SysWOW64\inytozkkh.exeC:\Windows\system32\inytozkkh.exe68⤵PID:3576
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe69⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe70⤵PID:4772
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe71⤵PID:4380
-
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe72⤵
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\injvlaikw.exeC:\Windows\system32\injvlaikw.exe73⤵PID:4108
-
C:\Windows\SysWOW64\inijzqpfx.exeC:\Windows\system32\inijzqpfx.exe74⤵PID:1088
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe75⤵PID:4320
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:1432 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe77⤵PID:6068
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe78⤵PID:4016
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe79⤵PID:5884
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe80⤵
- Drops file in System32 directory
PID:5100 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe81⤵PID:4708
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe82⤵PID:5528
-
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe83⤵PID:716
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe84⤵PID:4516
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe85⤵PID:1060
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe86⤵PID:852
-
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe87⤵
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe88⤵
- System Location Discovery: System Language Discovery
PID:1896 -
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe89⤵PID:4636
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe90⤵
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe91⤵PID:4112
-
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe92⤵PID:3560
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe93⤵PID:3364
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe94⤵PID:1692
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe95⤵PID:5672
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe96⤵
- Drops file in System32 directory
PID:5348 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe97⤵
- Drops file in System32 directory
PID:2100 -
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe98⤵PID:2448
-
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe99⤵PID:4872
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe100⤵PID:3228
-
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe101⤵PID:6080
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe102⤵
- System Location Discovery: System Language Discovery
PID:4172 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe103⤵PID:3884
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe104⤵PID:5852
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe105⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe106⤵PID:3692
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe107⤵PID:2640
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe108⤵PID:1120
-
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe109⤵PID:4328
-
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe110⤵PID:5856
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe111⤵
- System Location Discovery: System Language Discovery
PID:4404 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe112⤵
- Drops file in System32 directory
PID:2352 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe113⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2232 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe114⤵PID:4660
-
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe115⤵
- Drops file in System32 directory
PID:4228 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe116⤵PID:2060
-
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe117⤵PID:4388
-
C:\Windows\SysWOW64\inthmqkqb.exeC:\Windows\system32\inthmqkqb.exe118⤵PID:5576
-
C:\Windows\SysWOW64\injrhdzvq.exeC:\Windows\system32\injrhdzvq.exe119⤵PID:3620
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe120⤵PID:3788
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe121⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-