Analysis
- max time kernel
77s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 08:59
Behavioral task
behavioral1
Sample
2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260823-kx5d2shg86
- SHA256 fd25fb8b5a0218436f4b3fa6060ac915643d0e371a86448e779ad65d9d794f62
- MD5 48a2c88bb282818360a4ac6ee4ae3732
- SHA1 125b55f44d3a489385139c2845ea2c163561933c
- SHA512 ceece96fe397bd27b15859d12fa8f408dc53249256e6051453f87916943621d3894abae3e24af51883d2194bec62b26b26ae5d676e2a8ecd6f840cab65eba54a
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTt:RPjOa1NxyYtH1t
- TLSH T17415AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/5580-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c495-24.dat family_gh0strat behavioral2/memory/5580-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c499-32.dat family_gh0strat behavioral2/files/0x000d00000001c49a-43.dat family_gh0strat behavioral2/memory/2960-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c49f-64.dat family_gh0strat behavioral2/memory/5772-67-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4a2-87.dat family_gh0strat behavioral2/files/0x000d00000001c4a8-105.dat family_gh0strat behavioral2/memory/4784-177-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ca-239.dat family_gh0strat behavioral2/memory/4780-309-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1268-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1304-607-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3404-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2056-570-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1436-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3532-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5636-497-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1120-479-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1444-460-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5824-442-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1500-425-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4352-407-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6028-389-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5088-371-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3004-353-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4df-349.dat family_gh0strat behavioral2/memory/3864-331-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4db-327.dat family_gh0strat behavioral2/files/0x000d00000001c4d7-305.dat family_gh0strat behavioral2/memory/820-287-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d3-283.dat family_gh0strat behavioral2/memory/3704-265-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ce-261.dat family_gh0strat behavioral2/memory/1856-243-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2000-221-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c0-217.dat family_gh0strat behavioral2/memory/3732-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4bb-195.dat family_gh0strat behavioral2/files/0x000d00000001c4b6-173.dat family_gh0strat behavioral2/memory/720-155-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4b2-151.dat family_gh0strat behavioral2/memory/5916-146-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1464-132-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ac-128.dat family_gh0strat behavioral2/memory/4612-109-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDB8C6A7-A750-4adc-A1C1-598B93ACBF11} insaljfpw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2138C63-DACB-4d99-B5C9-A0DC570E87BE}\stubpath = "C:\\Windows\\system32\\inncprues.exe" invfrxfpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{566320A3-6391-466e-8109-91CD06759503} inwtdautu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{748E04A6-30CD-4e76-A4A9-9456E0E23913}\stubpath = "C:\\Windows\\system32\\inwtixaeq.exe" inlhnqivx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E8A6D02B-EB1B-4890-A8C4-3962F1C7889F}\stubpath = "C:\\Windows\\system32\\inbqostfv.exe" ingtvpopk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39EA122A-2653-4930-B0E0-FE6A69C5D417}\stubpath = "C:\\Windows\\system32\\inrxixhwa.exe" ingoxeawx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E985E934-47DD-462b-848E-84072779A7E3}\stubpath = "C:\\Windows\\system32\\indtfhlye.exe" indjvakex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD3AB332-6E52-49ab-A1D9-430CE4D7E277}\stubpath = "C:\\Windows\\system32\\innptoush.exe" inhrtbdgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23AEE7A3-3D96-42d4-8EE6-660F5B66438F}\stubpath = "C:\\Windows\\system32\\inbpjipes.exe" invdmeyvk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7F9E081-914B-46fd-B20F-73F8977AA225} injhepyti.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52EC997D-C7B1-44e3-B844-C86C7644F069} inqmfrmyb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E130F28C-96F1-4589-B305-BD3943B6CC80} inwaymvpq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73CDB907-BA63-47f6-92B3-B6562B736882}\stubpath = "C:\\Windows\\system32\\inewrcnnk.exe" inhfsfaqh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7C74C1B-B439-45de-81E4-F198F4BF3487}\stubpath = "C:\\Windows\\system32\\innezahdx.exe" ingfvhjng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BEFDF40-6EB6-422a-B7BD-E50E82ABF29A} inbpxnjbw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A35EA74-693F-4cfe-B9C4-3EAD1B90D1D2} inokbwlsa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09A46FBE-618E-4b84-BCAA-03F9AAA01A09}\stubpath = "C:\\Windows\\system32\\inlolxmlm.exe" inbsfowhf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDC6B1C7-E540-45c7-B1BB-F4D5DEDCE453}\stubpath = "C:\\Windows\\system32\\inmbydanh.exe" inrvqwujd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{282DD736-D2D7-438f-A3C2-30E9DC01FCCB} inqrgtvyi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4FB7019E-9497-42b8-B0E3-7B823AAF8718} inufueytz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71D56F9F-59A4-42f8-BC4F-F7B5155A8599}\stubpath = "C:\\Windows\\system32\\inmvbdomc.exe" inhnmoqun.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{611647BF-66CD-4ea1-B953-858F526CD29D} inpbwqegf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC24868C-1C03-4368-A313-63E66DA1DE88} inhiypoew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DFD33D5C-3FDD-4f69-B855-4702CDC3F479}\stubpath = "C:\\Windows\\system32\\inmktaxgs.exe" inzprbebn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA47327A-F39A-4479-AAF1-E97103D2505C} innfvgrkz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AB97461-D93E-4062-896D-C8E8B3A84F47} injprzfoi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55D75D1A-08D9-4b42-B857-198A49D9C50F}\stubpath = "C:\\Windows\\system32\\inlhnqivx.exe" inthxpach.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C939030-77E3-4d81-BF4F-FDDC83B9F6F2}\stubpath = "C:\\Windows\\system32\\inzebvemw.exe" inamdunku.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9D5576A-454B-41ce-B681-1A1476A47B19}\stubpath = "C:\\Windows\\system32\\indscwrxb.exe" inbjwysrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1682195-E078-430b-9029-99E191321B9C}\stubpath = "C:\\Windows\\system32\\inwgusogd.exe" inejnhnnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2896183D-D56C-4348-8CAD-2ECBF07B9194} inaeepccp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{097847AB-3F22-4c75-9721-B8545E045AF1} inyufnzuj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{295DF189-498D-4ab4-A654-A2D1797F1850} indwezqep.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F452EA0-FAD4-48f3-8744-F7AA1A7A48D6} inniombtb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2C7A449-CCFB-4d6c-92EF-36AC24E14D04} indbxwxmz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AF5BA532-F96C-4f72-8D7E-CB791E12A2F3}\stubpath = "C:\\Windows\\system32\\inazojdaz.exe" inuaizlgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{528AD4F7-B863-422c-9D02-9916255FFA59} inpiqqmhr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9342E61-8D1D-4805-AF8C-59A978AE76FD} inpsutmlb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6E08139-659A-4085-9F7A-22F4A6AF238B} invhwkmle.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0234A49B-1566-4d6c-B1B2-20899113ED77} inrdysgih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58B7FCDF-CF96-45b3-AA11-986F6F9547B2}\stubpath = "C:\\Windows\\system32\\indskelwb.exe" injyixbhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73F60B90-ADA2-49c8-9D7F-F211786A8617} incsnrmiw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F7913D5-141D-4771-B2B3-74E5657674A1} inqgyjlgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9097A612-285F-48a2-895D-25D90ECC4F31} ineugyxhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BAE51A1-4393-4af6-9EA5-0AD8FC8620B1}\stubpath = "C:\\Windows\\system32\\indtyatrn.exe" ingyqejnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34A57F66-F60A-4cdf-BA4B-7ED5B5841879} injmdckxk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A5B45093-2152-4ca7-B788-16BEF1A10882} indskelwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F566456B-DD8E-47bd-9F14-516921AAB106} inbrulkss.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9E7024E-A06C-4c3d-8668-FF4FC280CA72} inhwfuyzl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A953458-E539-4880-A1D8-E43231457518} inkesnbrx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{82F6C16E-3DCF-42d5-8A7A-C151560EC454} innnpmjol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2C824B99-CC98-4853-956D-33B845FE5BAA}\stubpath = "C:\\Windows\\system32\\innikicxv.exe" inyxgeiit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3D7BAEC-A3DB-49ea-9D85-C7676742BEC2}\stubpath = "C:\\Windows\\system32\\insanriau.exe" invqlrkwy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB4DF611-CAD3-4c94-849B-A108E7C9024A}\stubpath = "C:\\Windows\\system32\\incsdfhkz.exe" inwyoarng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F72C210F-71B9-46cb-89AE-3EB2871FA756}\stubpath = "C:\\Windows\\system32\\inrcangym.exe" inulkzdji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{746C2F14-CA14-4344-A7E0-158023304306}\stubpath = "C:\\Windows\\system32\\inxrqyyst.exe" inzvgovkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96EAB521-B633-42d6-AE78-463FCD4F8BC7}\stubpath = "C:\\Windows\\system32\\infcpjolj.exe" inyccnaan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03865750-1087-4158-939D-AB5175682F2E}\stubpath = "C:\\Windows\\system32\\iniwaqpwa.exe" inptcowdq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{40177E9D-D746-4792-8674-EA8E0D582E1D}\stubpath = "C:\\Windows\\system32\\inirveqyf.exe" insfkvqkr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA6375B1-2309-488e-A280-FA12CE6AB6BE}\stubpath = "C:\\Windows\\system32\\inivxkbyw.exe" inkfbyhcg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91ED0370-C9A1-4758-B00F-D4108452D396}\stubpath = "C:\\Windows\\system32\\inixomukg.exe" inzrcejxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8592CA2-BB2E-4027-AEF9-3BC01DD1371B}\stubpath = "C:\\Windows\\system32\\intsuvkkg.exe" inwixlnmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B103D3F-E28C-4401-8554-1EF25EEA545E}\stubpath = "C:\\Windows\\system32\\inulkzdji.exe" invgvfzue.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A043011-6EA5-40cd-8483-6D770C3B97D0} ineeenyiy.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001200000001b664-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 2960 ingvnhoze.exe 5772 insvxwpco.exe 5916 inlsmacbt.exe 4612 insohtodl.exe 1464 inatwyxqd.exe 720 inbfyviuk.exe 4784 inrngsnzc.exe 3732 inetlfmxc.exe 2000 injyqkarh.exe 1856 inoavpdfe.exe 3704 intfuikjc.exe 820 inykznpoh.exe 4780 inpsutmlb.exe 3864 insezthji.exe 3004 incgzwjvl.exe 5088 inortslka.exe 6028 inpfzcyeq.exe 4352 inhjvjvge.exe 1500 innqsrkjz.exe 5824 ineybxzdp.exe 1444 inwixlnmf.exe 1120 intsuvkkg.exe 5636 indpalewk.exe 1268 invhwkmle.exe 3532 injmdckxk.exe 1436 inqcxrfhg.exe 2056 infumgnyd.exe 3404 inyjbrycn.exe 1304 injwnoaqy.exe 5168 inxtemyti.exe 2264 inrkqhiua.exe 1616 inkivmnpx.exe 3228 inwsdlxsh.exe 1608 inaexuhtj.exe 4800 inrfpuysy.exe 2616 inyorihpp.exe 5940 indtwnmuu.exe 5932 inefvmlzb.exe 5708 inaphxbit.exe 2248 ingerepgv.exe 3392 ingvetxyk.exe 4088 inogwahsa.exe 3308 inugvjlkd.exe 3424 inrdysgih.exe 5076 ingiuiufd.exe 4880 injyixbhg.exe 4724 indskelwb.exe 4736 inqjpgzht.exe 4844 inmeufqjy.exe 3040 inruwvobn.exe 1300 indwztgsi.exe 2912 inkzrlbas.exe 5716 inljyapnv.exe 4492 ineqbmfxl.exe 2368 inhwoipfi.exe 4616 inmtnbdcu.exe 1248 inuqbjvqf.exe 1188 incvyzsfr.exe 796 indhxkwmb.exe 2436 invuwaxma.exe 3320 inyufnzuj.exe 3180 inzkcszdo.exe 4432 ingtvpopk.exe 5192 inbqostfv.exe - Loads dropped DLL 64 IoCs
pid Process 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe 2960 ingvnhoze.exe 2960 ingvnhoze.exe 5772 insvxwpco.exe 5772 insvxwpco.exe 5916 inlsmacbt.exe 5916 inlsmacbt.exe 4612 insohtodl.exe 4612 insohtodl.exe 1464 inatwyxqd.exe 1464 inatwyxqd.exe 720 inbfyviuk.exe 720 inbfyviuk.exe 4784 inrngsnzc.exe 4784 inrngsnzc.exe 3732 inetlfmxc.exe 3732 inetlfmxc.exe 2000 injyqkarh.exe 2000 injyqkarh.exe 1856 inoavpdfe.exe 1856 inoavpdfe.exe 3704 intfuikjc.exe 3704 intfuikjc.exe 820 inykznpoh.exe 820 inykznpoh.exe 4780 inpsutmlb.exe 4780 inpsutmlb.exe 3864 insezthji.exe 3864 insezthji.exe 3004 incgzwjvl.exe 3004 incgzwjvl.exe 5088 inortslka.exe 5088 inortslka.exe 6028 inpfzcyeq.exe 6028 inpfzcyeq.exe 4352 inhjvjvge.exe 4352 inhjvjvge.exe 1500 innqsrkjz.exe 1500 innqsrkjz.exe 5824 ineybxzdp.exe 5824 ineybxzdp.exe 1444 inwixlnmf.exe 1444 inwixlnmf.exe 1120 intsuvkkg.exe 1120 intsuvkkg.exe 5636 indpalewk.exe 5636 indpalewk.exe 1268 invhwkmle.exe 1268 invhwkmle.exe 3532 injmdckxk.exe 3532 injmdckxk.exe 1436 inqcxrfhg.exe 1436 inqcxrfhg.exe 2056 infumgnyd.exe 2056 infumgnyd.exe 3404 inyjbrycn.exe 3404 inyjbrycn.exe 1304 injwnoaqy.exe 1304 injwnoaqy.exe 5168 inxtemyti.exe 5168 inxtemyti.exe 2264 inrkqhiua.exe 2264 inrkqhiua.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inxzfxryi.exe_lang.ini incbskfog.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxajcwrn.exe File opened for modification C:\Windows\SysWOW64\inxtemyti.exe_lang.ini injwnoaqy.exe File created C:\Windows\SysWOW64\invrckwrg.exe inqmfrmyb.exe File opened for modification C:\Windows\SysWOW64\innuocedv.exe_lang.ini inahuhbcs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlvjosms.exe File opened for modification C:\Windows\SysWOW64\inhwfuyzl.exe_lang.ini inwgusogd.exe File opened for modification C:\Windows\SysWOW64\insgoyikn.exe_lang.ini intglbjrf.exe File created C:\Windows\SysWOW64\injfzedyv.exe inpeapdzu.exe File created C:\Windows\SysWOW64\inlhzufqa.exe inupalliz.exe File created C:\Windows\SysWOW64\inyoeaukm.exe incwvxbyn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innqsrkjz.exe File created C:\Windows\SysWOW64\inocokdvj.exe inmprqjiy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inulkzdji.exe File created C:\Windows\SysWOW64\inknedlyl.exe inpqffxwb.exe File created C:\Windows\SysWOW64\indvdvgmq.exe indlvgkyq.exe File created C:\Windows\SysWOW64\inswrxvke.exe intkkwbze.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqjpgzht.exe File created C:\Windows\SysWOW64\inwmpgfnn.exe indtkzjxv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infhthtec.exe File created C:\Windows\SysWOW64\inxgusiod.exe inaeepccp.exe File created C:\Windows\SysWOW64\invudbffq.exe ingtjmoji.exe File created C:\Windows\SysWOW64\ingrakqpr.exe inscqyokc.exe File created C:\Windows\SysWOW64\indryibnm.exe inbaqbdfi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuydrpyf.exe File created C:\Windows\SysWOW64\indtyatrn.exe ingyqejnh.exe File opened for modification C:\Windows\SysWOW64\inbpjipes.exe_lang.ini invdmeyvk.exe File created C:\Windows\SysWOW64\innfajbav.exe inztjzmib.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwixlnmf.exe File created C:\Windows\SysWOW64\inomzqrdt.exe indtosnaj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineuxonvv.exe File opened for modification C:\Windows\SysWOW64\inxgusiod.exe_lang.ini inaeepccp.exe File opened for modification C:\Windows\SysWOW64\incldxuje.exe_lang.ini inykxcqol.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqnbrgit.exe File created C:\Windows\SysWOW64\inrtkbsie.exe inpiofygs.exe File created C:\Windows\SysWOW64\inbkyszdb.exe iniszaxor.exe File opened for modification C:\Windows\SysWOW64\intikurgv.exe_lang.ini indcsegkx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwsdlxsh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhqlgymf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insulctjf.exe File opened for modification C:\Windows\SysWOW64\inquussur.exe_lang.ini inpdlvxfh.exe File created C:\Windows\SysWOW64\inqnbrgit.exe inzloqpih.exe File created C:\Windows\SysWOW64\inpqffxwb.exe inpkvggzd.exe File opened for modification C:\Windows\SysWOW64\inuytzxmg.exe_lang.ini inrlmbbts.exe File opened for modification C:\Windows\SysWOW64\inotjfrzg.exe_lang.ini inkwblfyk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkwkupid.exe File created C:\Windows\SysWOW64\innqsrkjz.exe inhjvjvge.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqmfrmyb.exe File created C:\Windows\SysWOW64\inclzteci.exe inaikwkwh.exe File opened for modification C:\Windows\SysWOW64\insbznvcp.exe_lang.ini inzhpyfbx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inakrpgjz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indcsegkx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inugvjlkd.exe File created C:\Windows\SysWOW64\indwztgsi.exe inruwvobn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indhxkwmb.exe File opened for modification C:\Windows\SysWOW64\indwezqep.exe_lang.ini inzhuwqpq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat incbzwztd.exe File created C:\Windows\SysWOW64\inujlcwuk.exe inzkzjyci.exe File opened for modification C:\Windows\SysWOW64\inuloqrtx.exe_lang.ini inooxsntm.exe File opened for modification C:\Windows\SysWOW64\inwbpkebv.exe_lang.ini inbmyhvlc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inooxsntm.exe File created C:\Windows\SysWOW64\inctckufj.exe inswrxvke.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infjxbrqx.exe File opened for modification C:\Windows\SysWOW64\intsuvkkg.exe_lang.ini inwixlnmf.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdsbquv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyxgeiit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infqzujev.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmqlrpew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intwamnoz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxshctsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injprzfoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvfndjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtleici.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intmsjkwc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innpclapa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzleble.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaexuhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inocokdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inapnrseu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innptoush.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infxiosfk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzjlpkqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtixaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhqyjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvqwujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwldhtuf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzzdxxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtvpopk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisucehe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inucuflpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebmvqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incmrujul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpedtegi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdbjsnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuaizlgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebgydau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indpalewk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingiuiufd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrxixhwa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrfqjpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoeaukm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insbznvcp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzewkdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insaljfpw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzrfkoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineamubie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innswqwhw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkjzlnrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwztgsi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innfvgrkz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intqwjtdz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpeyhpif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infacmfam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpscqoss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvcvbrm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvsctst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrngsnzc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewrcnnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisglpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inergdafx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpiofygs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inumafjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpmynm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaeepccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inocymrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczeboin.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe 2960 ingvnhoze.exe 2960 ingvnhoze.exe 5772 insvxwpco.exe 5772 insvxwpco.exe 5916 inlsmacbt.exe 5916 inlsmacbt.exe 4612 insohtodl.exe 4612 insohtodl.exe 1464 inatwyxqd.exe 1464 inatwyxqd.exe 720 inbfyviuk.exe 720 inbfyviuk.exe 4784 inrngsnzc.exe 4784 inrngsnzc.exe 3732 inetlfmxc.exe 3732 inetlfmxc.exe 2000 injyqkarh.exe 2000 injyqkarh.exe 1856 inoavpdfe.exe 1856 inoavpdfe.exe 3704 intfuikjc.exe 3704 intfuikjc.exe 820 inykznpoh.exe 820 inykznpoh.exe 4780 inpsutmlb.exe 4780 inpsutmlb.exe 3864 insezthji.exe 3864 insezthji.exe 3004 incgzwjvl.exe 3004 incgzwjvl.exe 5088 inortslka.exe 5088 inortslka.exe 6028 inpfzcyeq.exe 6028 inpfzcyeq.exe 4352 inhjvjvge.exe 4352 inhjvjvge.exe 1500 innqsrkjz.exe 1500 innqsrkjz.exe 5824 ineybxzdp.exe 5824 ineybxzdp.exe 1444 inwixlnmf.exe 1444 inwixlnmf.exe 1120 intsuvkkg.exe 1120 intsuvkkg.exe 5636 indpalewk.exe 5636 indpalewk.exe 1268 invhwkmle.exe 1268 invhwkmle.exe 3532 injmdckxk.exe 3532 injmdckxk.exe 1436 inqcxrfhg.exe 1436 inqcxrfhg.exe 2056 infumgnyd.exe 2056 infumgnyd.exe 3404 inyjbrycn.exe 3404 inyjbrycn.exe 1304 injwnoaqy.exe 1304 injwnoaqy.exe 5168 inxtemyti.exe 5168 inxtemyti.exe 2264 inrkqhiua.exe 2264 inrkqhiua.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 2960 ingvnhoze.exe Token: SeDebugPrivilege 5772 insvxwpco.exe Token: SeDebugPrivilege 5916 inlsmacbt.exe Token: SeDebugPrivilege 4612 insohtodl.exe Token: SeDebugPrivilege 1464 inatwyxqd.exe Token: SeDebugPrivilege 720 inbfyviuk.exe Token: SeDebugPrivilege 4784 inrngsnzc.exe Token: SeDebugPrivilege 3732 inetlfmxc.exe Token: SeDebugPrivilege 2000 injyqkarh.exe Token: SeDebugPrivilege 1856 inoavpdfe.exe Token: SeDebugPrivilege 3704 intfuikjc.exe Token: SeDebugPrivilege 820 inykznpoh.exe Token: SeDebugPrivilege 4780 inpsutmlb.exe Token: SeDebugPrivilege 3864 insezthji.exe Token: SeDebugPrivilege 3004 incgzwjvl.exe Token: SeDebugPrivilege 5088 inortslka.exe Token: SeDebugPrivilege 6028 inpfzcyeq.exe Token: SeDebugPrivilege 4352 inhjvjvge.exe Token: SeDebugPrivilege 1500 innqsrkjz.exe Token: SeDebugPrivilege 5824 ineybxzdp.exe Token: SeDebugPrivilege 1444 inwixlnmf.exe Token: SeDebugPrivilege 1120 intsuvkkg.exe Token: SeDebugPrivilege 5636 indpalewk.exe Token: SeDebugPrivilege 1268 invhwkmle.exe Token: SeDebugPrivilege 3532 injmdckxk.exe Token: SeDebugPrivilege 1436 inqcxrfhg.exe Token: SeDebugPrivilege 2056 infumgnyd.exe Token: SeDebugPrivilege 3404 inyjbrycn.exe Token: SeDebugPrivilege 1304 injwnoaqy.exe Token: SeDebugPrivilege 5168 inxtemyti.exe Token: SeDebugPrivilege 2264 inrkqhiua.exe Token: SeDebugPrivilege 1616 inkivmnpx.exe Token: SeDebugPrivilege 3228 inwsdlxsh.exe Token: SeDebugPrivilege 1608 inaexuhtj.exe Token: SeDebugPrivilege 4800 inrfpuysy.exe Token: SeDebugPrivilege 2616 inyorihpp.exe Token: SeDebugPrivilege 5940 indtwnmuu.exe Token: SeDebugPrivilege 5932 inefvmlzb.exe Token: SeDebugPrivilege 5708 inaphxbit.exe Token: SeDebugPrivilege 2248 ingerepgv.exe Token: SeDebugPrivilege 3392 ingvetxyk.exe Token: SeDebugPrivilege 4088 inogwahsa.exe Token: SeDebugPrivilege 3308 inugvjlkd.exe Token: SeDebugPrivilege 3424 inrdysgih.exe Token: SeDebugPrivilege 5076 ingiuiufd.exe Token: SeDebugPrivilege 4880 injyixbhg.exe Token: SeDebugPrivilege 4724 indskelwb.exe Token: SeDebugPrivilege 4736 inqjpgzht.exe Token: SeDebugPrivilege 4844 inmeufqjy.exe Token: SeDebugPrivilege 3040 inruwvobn.exe Token: SeDebugPrivilege 1300 indwztgsi.exe Token: SeDebugPrivilege 2912 inkzrlbas.exe Token: SeDebugPrivilege 5716 inljyapnv.exe Token: SeDebugPrivilege 4492 ineqbmfxl.exe Token: SeDebugPrivilege 2368 inhwoipfi.exe Token: SeDebugPrivilege 4616 inmtnbdcu.exe Token: SeDebugPrivilege 1248 inuqbjvqf.exe Token: SeDebugPrivilege 1188 incvyzsfr.exe Token: SeDebugPrivilege 796 indhxkwmb.exe Token: SeDebugPrivilege 2436 invuwaxma.exe Token: SeDebugPrivilege 3320 inyufnzuj.exe Token: SeDebugPrivilege 3180 inzkcszdo.exe Token: SeDebugPrivilege 4432 ingtvpopk.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe 2960 ingvnhoze.exe 5772 insvxwpco.exe 5916 inlsmacbt.exe 4612 insohtodl.exe 1464 inatwyxqd.exe 720 inbfyviuk.exe 4784 inrngsnzc.exe 3732 inetlfmxc.exe 2000 injyqkarh.exe 1856 inoavpdfe.exe 3704 intfuikjc.exe 820 inykznpoh.exe 4780 inpsutmlb.exe 3864 insezthji.exe 3004 incgzwjvl.exe 5088 inortslka.exe 6028 inpfzcyeq.exe 4352 inhjvjvge.exe 1500 innqsrkjz.exe 5824 ineybxzdp.exe 1444 inwixlnmf.exe 1120 intsuvkkg.exe 5636 indpalewk.exe 1268 invhwkmle.exe 3532 injmdckxk.exe 1436 inqcxrfhg.exe 2056 infumgnyd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5580 wrote to memory of 2960 5580 2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 2960 wrote to memory of 5772 2960 ingvnhoze.exe 90 PID 5772 wrote to memory of 5916 5772 insvxwpco.exe 91 PID 5916 wrote to memory of 4612 5916 inlsmacbt.exe 92 PID 4612 wrote to memory of 1464 4612 insohtodl.exe 93 PID 1464 wrote to memory of 720 1464 inatwyxqd.exe 94 PID 720 wrote to memory of 4784 720 inbfyviuk.exe 95 PID 4784 wrote to memory of 3732 4784 inrngsnzc.exe 96 PID 3732 wrote to memory of 2000 3732 inetlfmxc.exe 97 PID 2000 wrote to memory of 1856 2000 injyqkarh.exe 98 PID 1856 wrote to memory of 3704 1856 inoavpdfe.exe 99 PID 3704 wrote to memory of 820 3704 intfuikjc.exe 100 PID 820 wrote to memory of 4780 820 inykznpoh.exe 101 PID 4780 wrote to memory of 3864 4780 inpsutmlb.exe 102 PID 3864 wrote to memory of 3004 3864 insezthji.exe 103 PID 3004 wrote to memory of 5088 3004 incgzwjvl.exe 104 PID 5088 wrote to memory of 6028 5088 inortslka.exe 105 PID 6028 wrote to memory of 4352 6028 inpfzcyeq.exe 106 PID 4352 wrote to memory of 1500 4352 inhjvjvge.exe 107 PID 1500 wrote to memory of 5824 1500 innqsrkjz.exe 108 PID 5824 wrote to memory of 1444 5824 ineybxzdp.exe 109 PID 1444 wrote to memory of 1120 1444 inwixlnmf.exe 110 PID 1120 wrote to memory of 5636 1120 intsuvkkg.exe 111 PID 5636 wrote to memory of 1268 5636 indpalewk.exe 112 PID 1268 wrote to memory of 3532 1268 invhwkmle.exe 113 PID 3532 wrote to memory of 1436 3532 injmdckxk.exe 114 PID 1436 wrote to memory of 2056 1436 inqcxrfhg.exe 115 PID 2056 wrote to memory of 3404 2056 infumgnyd.exe 116 PID 3404 wrote to memory of 1304 3404 inyjbrycn.exe 117 PID 1304 wrote to memory of 5168 1304 injwnoaqy.exe 118 PID 5168 wrote to memory of 2264 5168 inxtemyti.exe 119 PID 2264 wrote to memory of 1616 2264 inrkqhiua.exe 120 PID 1616 wrote to memory of 3228 1616 inkivmnpx.exe 121 PID 3228 wrote to memory of 1608 3228 inwsdlxsh.exe 122 PID 1608 wrote to memory of 4800 1608 inaexuhtj.exe 123 PID 4800 wrote to memory of 2616 4800 inrfpuysy.exe 124 PID 2616 wrote to memory of 5940 2616 inyorihpp.exe 125 PID 5940 wrote to memory of 5932 5940 indtwnmuu.exe 126 PID 5932 wrote to memory of 5708 5932 inefvmlzb.exe 127 PID 5708 wrote to memory of 2248 5708 inaphxbit.exe 128 PID 2248 wrote to memory of 3392 2248 ingerepgv.exe 129 PID 3392 wrote to memory of 4088 3392 ingvetxyk.exe 130 PID 4088 wrote to memory of 3308 4088 inogwahsa.exe 131 PID 3308 wrote to memory of 3424 3308 inugvjlkd.exe 132 PID 3424 wrote to memory of 5076 3424 inrdysgih.exe 133 PID 5076 wrote to memory of 4880 5076 ingiuiufd.exe 134 PID 4880 wrote to memory of 4724 4880 injyixbhg.exe 135 PID 4724 wrote to memory of 4736 4724 indskelwb.exe 136 PID 4736 wrote to memory of 4844 4736 inqjpgzht.exe 137 PID 4844 wrote to memory of 3040 4844 inmeufqjy.exe 138 PID 3040 wrote to memory of 1300 3040 inruwvobn.exe 139 PID 1300 wrote to memory of 2912 1300 indwztgsi.exe 140 PID 2912 wrote to memory of 5716 2912 inkzrlbas.exe 141 PID 5716 wrote to memory of 4492 5716 inljyapnv.exe 142 PID 4492 wrote to memory of 2368 4492 ineqbmfxl.exe 143 PID 2368 wrote to memory of 4616 2368 inhwoipfi.exe 144 PID 4616 wrote to memory of 1248 4616 inmtnbdcu.exe 145 PID 1248 wrote to memory of 1188 1248 inuqbjvqf.exe 146 PID 1188 wrote to memory of 796 1188 incvyzsfr.exe 147 PID 796 wrote to memory of 2436 796 indhxkwmb.exe 148 PID 2436 wrote to memory of 3320 2436 invuwaxma.exe 149 PID 3320 wrote to memory of 3180 3320 inyufnzuj.exe 150 PID 3180 wrote to memory of 4432 3180 inzkcszdo.exe 151 PID 4432 wrote to memory of 5192 4432 ingtvpopk.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_48a2c88bb282818360a4ac6ee4ae3732_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe22⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe25⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe26⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\inrkqhiua.exeC:\Windows\system32\inrkqhiua.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\inkivmnpx.exeC:\Windows\system32\inkivmnpx.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\injyixbhg.exeC:\Windows\system32\injyixbhg.exe47⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe48⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\system32\ineqbmfxl.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe62⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe64⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe65⤵
- Executes dropped EXE
PID:5192 -
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe66⤵PID:3868
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe67⤵PID:2624
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe68⤵PID:1080
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe69⤵PID:3612
-
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe70⤵PID:3824
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe71⤵PID:4480
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe72⤵PID:1860
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe73⤵PID:1640
-
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe74⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:3124 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe75⤵PID:3172
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe76⤵PID:1096
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe77⤵PID:3232
-
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe78⤵PID:5604
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe79⤵PID:5912
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe80⤵
- Drops file in System32 directory
PID:2304 -
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe81⤵
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe82⤵PID:2664
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe83⤵
- Drops file in System32 directory
PID:1348 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe84⤵PID:4240
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe85⤵PID:1400
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe86⤵PID:4956
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe87⤵PID:5744
-
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe88⤵PID:2300
-
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe89⤵PID:3156
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe90⤵PID:3724
-
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe91⤵PID:3456
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe92⤵
- Drops file in System32 directory
PID:3504 -
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe93⤵PID:3676
-
C:\Windows\SysWOW64\incvdypdo.exeC:\Windows\system32\incvdypdo.exe94⤵PID:4064
-
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe95⤵PID:4884
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe96⤵PID:4108
-
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe97⤵PID:3700
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe98⤵PID:3972
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe99⤵PID:2108
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe100⤵PID:4584
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe101⤵PID:4212
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe102⤵PID:2276
-
C:\Windows\SysWOW64\inftrnfcc.exeC:\Windows\system32\inftrnfcc.exe103⤵PID:1028
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe104⤵PID:2504
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe105⤵PID:2752
-
C:\Windows\SysWOW64\initcmsrt.exeC:\Windows\system32\initcmsrt.exe106⤵PID:2900
-
C:\Windows\SysWOW64\infsuonoj.exeC:\Windows\system32\infsuonoj.exe107⤵PID:5488
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\system32\inbohznex.exe108⤵PID:4748
-
C:\Windows\SysWOW64\inocymrvp.exeC:\Windows\system32\inocymrvp.exe109⤵
- System Location Discovery: System Language Discovery
PID:4668 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe110⤵PID:3608
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe111⤵PID:476
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe112⤵PID:3112
-
C:\Windows\SysWOW64\inmflkmos.exeC:\Windows\system32\inmflkmos.exe113⤵PID:708
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe114⤵PID:4512
-
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe115⤵PID:2084
-
C:\Windows\SysWOW64\inljswfrz.exeC:\Windows\system32\inljswfrz.exe116⤵PID:2076
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe117⤵PID:5000
-
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe118⤵
- Drops file in System32 directory
PID:1744 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe119⤵PID:1908
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe120⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\invgvfzue.exeC:\Windows\system32\invgvfzue.exe121⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-