Analysis
- max time kernel
82s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/10/2026, 06:03
Behavioral task
behavioral1
Sample
2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample261007-gr9vsstv2l
- SHA256 4c165db7b3a2250af5c35f1d837a145d2ef435c5bee576631718af5f96855510
- MD5 14964e46e90e4561e0997978f2dbaedf
- SHA1 15072469f940f559a529bf2a4dc56aded537c6af
- SHA512 7cdf3369dd15fbf88fe39291cb17ac5d2ee15ca7d438eea7f18275157fcc0267874e3c05d80d02ed09933e19088b561e0554a4f9e388eb4693dccc2250a41c72
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTw:RPjOa1NxyYtH1w
- TLSH T19315AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/484-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000e00000001c537-14.dat family_gh0strat behavioral2/files/0x000d00000001c53b-20.dat family_gh0strat behavioral2/memory/484-22-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c540-36.dat family_gh0strat behavioral2/memory/1872-609-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1804-591-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4112-573-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4308-555-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2364-537-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1472-519-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2412-501-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6124-483-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5200-465-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3364-447-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/860-429-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4724-411-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4316-393-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2976-375-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1056-357-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c589-353.dat family_gh0strat behavioral2/memory/3380-335-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c585-331.dat family_gh0strat behavioral2/memory/5468-313-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c581-309.dat family_gh0strat behavioral2/memory/1500-291-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c57d-287.dat family_gh0strat behavioral2/memory/1764-269-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c579-265.dat family_gh0strat behavioral2/memory/1812-247-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c575-243.dat family_gh0strat behavioral2/memory/2588-225-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c571-221.dat family_gh0strat behavioral2/memory/896-203-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c55e-199.dat family_gh0strat behavioral2/memory/2560-181-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c55a-177.dat family_gh0strat behavioral2/memory/4076-159-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c556-155.dat family_gh0strat behavioral2/memory/2268-137-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c552-133.dat family_gh0strat behavioral2/memory/1820-114-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c54e-110.dat family_gh0strat behavioral2/memory/3772-92-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c54a-88.dat family_gh0strat behavioral2/memory/2680-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c546-66.dat family_gh0strat behavioral2/memory/2680-48-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1316-45-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3F91305-DFAA-43e2-92C2-A4F5246F1418} inaqgiwze.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6272ECED-2EA5-4c09-B761-268BA7621EA8}\stubpath = "C:\\Windows\\system32\\inkvbdqbu.exe" inxujybfr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8563B185-3DDA-4869-B21A-7181A4960D35} iniqjgqjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0D95B6C-3019-4cb1-A096-DB6E3570AF57}\stubpath = "C:\\Windows\\system32\\inzrqlnxa.exe" inyxynpgc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{195B981B-A01A-4b4b-AECC-EC834F4FE94B}\stubpath = "C:\\Windows\\system32\\inrfpuysy.exe" inzvgovkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7AB4B329-018E-4335-834D-1468508C4283} inokbwlsa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB620C8D-5D5A-4e7a-A5F8-CDBA03541E6F} inpeyhpif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B83654BB-DD4F-49eb-A1EC-401B59E4C599}\stubpath = "C:\\Windows\\system32\\indwezqep.exe" inmkxopbr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64E32F6F-C1E5-4b06-80FE-390CC99B1563}\stubpath = "C:\\Windows\\system32\\infnwdvwr.exe" inikbvtjp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C053B630-3751-46a0-ADD0-5BDC6A62C3D2}\stubpath = "C:\\Windows\\system32\\inmvbdomc.exe" insezthji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6EE1153-F9D3-4ba3-B624-69A516E16A9D} inlaxcmgz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FD9A9B6-34C6-4a57-BD39-D1C2AA0926DF} intojzuff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E6D8EF7-A39E-4c37-81AA-62E7F2FB78A8}\stubpath = "C:\\Windows\\system32\\inrhnxdft.exe" iniszaxor.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9358029E-CEEB-46e3-9E46-A2392DF71A61} incsnrmiw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51344011-A0C6-44d9-93CB-2DFD5723A04D} inpriaela.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D63F237D-BC95-49b0-8EA7-5AF6BD0B242F} innxkgbub.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68499AC9-DF04-4ede-8C5D-DD0E725A07FB} indbkovjr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9ED0E47-5D08-4228-B039-78986A229FFD} inojljdyw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{131B75EE-6819-4b19-ACAE-43AA1065FAE9} inrkqhiua.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7665F5AD-6363-4ef8-A808-5D8E88E93EED} iniuxcykh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E58F1AC8-1141-4054-8C3C-7742BCAD88B0}\stubpath = "C:\\Windows\\system32\\inpkfxleq.exe" incfdqdof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{391228D1-5E65-4433-A1EE-3D2FD6389F56}\stubpath = "C:\\Windows\\system32\\ingerepgv.exe" inaphxbit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0BC9969-56CB-45e1-98A4-341BA08C4B56} ingerepgv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD940B33-9AFE-4d61-B788-C53CF34D6C61} inqtvunam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB2B9874-43D2-444e-8AB7-2CC7BAFFF72E}\stubpath = "C:\\Windows\\system32\\invmdukgq.exe" inhjvjvge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3744F560-8DA8-42cb-89B0-7D58049A973A}\stubpath = "C:\\Windows\\system32\\inycopaqa.exe" inmsevrki.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14AC83FA-0181-4a1b-9830-5A7C19C00921} inycopaqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{888BC7B7-CDFE-4f1b-9454-4DD6E163670D} ingatvyvf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8473A01F-D216-4bc5-AA3F-244389130114} incgzwjvl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E36087E5-FDCA-4690-8FCB-C211A9CFCB7A} inngmlnpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19EF07D1-F54F-409f-A6BE-B78F4BD17B49} inzkzjyci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E2193F0-D3BF-44c0-B260-A7FA54D9921D}\stubpath = "C:\\Windows\\system32\\inkbytnkt.exe" indxighng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6EE1153-F9D3-4ba3-B624-69A516E16A9D}\stubpath = "C:\\Windows\\system32\\inzyhfjju.exe" inlaxcmgz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{86C9C964-ADCC-4d07-9EC7-3679E7AA4D51}\stubpath = "C:\\Windows\\system32\\inihodrxd.exe" innoddvuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59FD450C-46C1-4ac0-A8F5-00A52053BC2D}\stubpath = "C:\\Windows\\system32\\inptcowdq.exe" innjrlbrs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35EA69AF-2BD0-4710-A75E-272E8B0CF0BE} infmbpvbz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75F44584-EC47-4ed2-89E5-776277392948} inuonujxj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5020EA7B-98F0-4c0b-AF9D-25795EA2A44A}\stubpath = "C:\\Windows\\system32\\inrmslxzd.exe" inlcfvhzy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3315D676-C7EE-4130-A8E8-4A2326F31938}\stubpath = "C:\\Windows\\system32\\injavkrnv.exe" invspsmvj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF4D27DD-AB51-445e-A52F-A3762B447EB9} inuizasnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{023675A6-B7C5-47b3-BD78-AF74DC5D7F78}\stubpath = "C:\\Windows\\system32\\inodxpojl.exe" inkesnbrx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5022E2D3-7296-41fb-8C0A-DAADBEF8CF18}\stubpath = "C:\\Windows\\system32\\inqgdzfrf.exe" inbmkzbqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9A9392C-56DC-431e-BB5B-3BAD600129CB} inqcxrfhg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1BD45A0-B5BA-4080-A76E-77AEEF226852} iniqzgcyz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B83654BB-DD4F-49eb-A1EC-401B59E4C599} inmkxopbr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63B4619B-32F6-4f88-B001-D435CDBAF602} inljswfrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8BC044D-C9CB-43d3-B6D0-DFB7B7D99DA1} inkhtihxi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62F9B389-6C28-434b-B658-6F04C6FBE6E6} inlhnqivx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51588E45-0395-4fed-B7FB-9D8506283D4A}\stubpath = "C:\\Windows\\system32\\inljyapnv.exe" ingvetxyk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFEDEBE0-FE03-4f27-8B20-7C541AA752BD}\stubpath = "C:\\Windows\\system32\\infdqdofu.exe" inqnbrgit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39909837-DF1C-41bc-A58B-4019C0178CAE} innnpmjol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94B1871E-C3E2-41ce-97E0-11DB6666C1E6}\stubpath = "C:\\Windows\\system32\\inortslka.exe" inhwoipfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EEFB8E85-43B7-4a35-8280-C158992FF24C}\stubpath = "C:\\Windows\\system32\\insjarhdx.exe" inesqmezb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97A22F37-9FAE-4151-929D-16502E87AD03} inuwftrhn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CEE39337-081E-4be8-A665-70215E32DC60} indcsegkx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B44BB865-2A1D-4d68-86C5-0EBDE2DD4BE0} inqmfrmyb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B75AA91-7077-43ad-8F32-6011B64BD0AB}\stubpath = "C:\\Windows\\system32\\incraptug.exe" inzfhvydh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{389807AA-FF5D-422d-9B9F-834726516C97}\stubpath = "C:\\Windows\\system32\\inyazesml.exe" inyluacnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FD9BA95-EA5F-4b99-A3E6-48B59991BCFC}\stubpath = "C:\\Windows\\system32\\inhzrfkoi.exe" insvsctst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5AB291EC-9736-47e3-AB9A-F393EE9F9406}\stubpath = "C:\\Windows\\system32\\invshckbs.exe" inudpxert.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B6D2E52-C18D-4765-A2BD-E536071429CE} inwjfatav.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35903F47-C74A-4fc4-98D5-37C03476F2C8} inwtdautu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{55A206AA-783A-4b1c-BF6E-EE7FAA1AA80D}\stubpath = "C:\\Windows\\system32\\inoavpdfe.exe" ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0949F629-3274-446e-BC96-0D113C25E495} inueaqidm.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000600000001b85a-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 1316 ingvnhoze.exe 2680 inoavpdfe.exe 3772 inyufnzuj.exe 1820 inzkcszdo.exe 2268 insohtodl.exe 4076 infumgnyd.exe 2560 inkzrlbas.exe 896 inpbwqegf.exe 2588 inugvjlkd.exe 1812 inpleqlxa.exe 1764 inuqbjvqf.exe 1500 inwixlnmf.exe 5468 inlsmacbt.exe 3380 inbqiycju.exe 1056 inhfsfaqh.exe 2976 injmdckxk.exe 4316 inaphxbit.exe 4724 ingerepgv.exe 860 inilcbjwj.exe 3364 inxnqhgoo.exe 5200 incsvmltt.exe 6124 injyqkarh.exe 2412 inqtvunam.exe 1472 inwgusogd.exe 2364 inefvmlzb.exe 4308 incanalcr.exe 4112 inddmxhxc.exe 1804 inhwfuyzl.exe 1872 injwnoaqy.exe 1460 inxtemyti.exe 5416 inyjbrycn.exe 3144 inogwahsa.exe 2956 inetlfmxc.exe 5228 ingvetxyk.exe 3864 inljyapnv.exe 5704 inwsdlxsh.exe 1272 inaexuhtj.exe 3204 inqmfrmyb.exe 4736 invrckwrg.exe 2004 ingiuiufd.exe 2912 inmeufqjy.exe 5216 inomzqrdt.exe 5452 inhwoipfi.exe 2848 inortslka.exe 2916 inbpxnjbw.exe 5904 ineuxonvv.exe 4972 inldtepix.exe 3768 inpsutmlb.exe 5656 inbuxzyre.exe 3920 inxtleici.exe 4592 inbmkzbqa.exe 2804 inqgdzfrf.exe 4192 inxjymong.exe 2288 inutvwllh.exe 2820 inrdysgih.exe 5576 ingtgabri.exe 4280 ingvzmksi.exe 2228 innlypqcs.exe 2500 incvyzsfr.exe 5168 inkbaivic.exe 5428 invuwaxma.exe 4596 intfuikjc.exe 2152 incgzwjvl.exe 5460 ingtvpopk.exe - Loads dropped DLL 64 IoCs
pid Process 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 1316 ingvnhoze.exe 1316 ingvnhoze.exe 2680 inoavpdfe.exe 2680 inoavpdfe.exe 3772 inyufnzuj.exe 3772 inyufnzuj.exe 1820 inzkcszdo.exe 1820 inzkcszdo.exe 2268 insohtodl.exe 2268 insohtodl.exe 4076 infumgnyd.exe 4076 infumgnyd.exe 2560 inkzrlbas.exe 2560 inkzrlbas.exe 896 inpbwqegf.exe 896 inpbwqegf.exe 2588 inugvjlkd.exe 2588 inugvjlkd.exe 1812 inpleqlxa.exe 1812 inpleqlxa.exe 1764 inuqbjvqf.exe 1764 inuqbjvqf.exe 1500 inwixlnmf.exe 1500 inwixlnmf.exe 5468 inlsmacbt.exe 5468 inlsmacbt.exe 3380 inbqiycju.exe 3380 inbqiycju.exe 1056 inhfsfaqh.exe 1056 inhfsfaqh.exe 2976 injmdckxk.exe 2976 injmdckxk.exe 4316 inaphxbit.exe 4316 inaphxbit.exe 4724 ingerepgv.exe 4724 ingerepgv.exe 860 inilcbjwj.exe 860 inilcbjwj.exe 3364 inxnqhgoo.exe 3364 inxnqhgoo.exe 5200 incsvmltt.exe 5200 incsvmltt.exe 6124 injyqkarh.exe 6124 injyqkarh.exe 2412 inqtvunam.exe 2412 inqtvunam.exe 1472 inwgusogd.exe 1472 inwgusogd.exe 2364 inefvmlzb.exe 2364 inefvmlzb.exe 4308 incanalcr.exe 4308 incanalcr.exe 4112 inddmxhxc.exe 4112 inddmxhxc.exe 1804 inhwfuyzl.exe 1804 inhwfuyzl.exe 1872 injwnoaqy.exe 1872 injwnoaqy.exe 1460 inxtemyti.exe 1460 inxtemyti.exe 5416 inyjbrycn.exe 5416 inyjbrycn.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\invudbffq.exe inujlcwuk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inooxsntm.exe File created C:\Windows\SysWOW64\inwikshbc.exe iniujiyjl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inomzqrdt.exe File created C:\Windows\SysWOW64\indqsmlmh.exe inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\incfdqdof.exe_lang.ini inwmpgfnn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingvfeugi.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innqmfdal.exe File created C:\Windows\SysWOW64\insqkfzec.exe innoqupvt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqnbrgit.exe File opened for modification C:\Windows\SysWOW64\inupalliz.exe_lang.ini inclwgwbt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkietvme.exe File created C:\Windows\SysWOW64\inwmcsiky.exe injtvdfif.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ineqfbqev.exe File created C:\Windows\SysWOW64\inakrpgjz.exe incsdfhkz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat iniszdhvx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insuhmxsm.exe File opened for modification C:\Windows\SysWOW64\inmsevrki.exe_lang.ini inebdvara.exe File opened for modification C:\Windows\SysWOW64\infnxzhjm.exe_lang.ini inykmqjhq.exe File created C:\Windows\SysWOW64\inwgusogd.exe inqtvunam.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infmbihgy.exe File opened for modification C:\Windows\SysWOW64\inqrgtvyi.exe_lang.ini inlvjosms.exe File opened for modification C:\Windows\SysWOW64\ingvnhoze.exe_lang.ini 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe File opened for modification C:\Windows\SysWOW64\inomzqrdt.exe_lang.ini inmeufqjy.exe File created C:\Windows\SysWOW64\inngmlnpt.exe inrhnxdft.exe File created C:\Windows\SysWOW64\inacgtgkr.exe injidfpid.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxlrthqk.exe File opened for modification C:\Windows\SysWOW64\infxsuasm.exe_lang.ini inpatbkcw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insfkvqkr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwyoarng.exe File opened for modification C:\Windows\SysWOW64\inhgncqwc.exe_lang.ini inwonikuc.exe File created C:\Windows\SysWOW64\inrcscxou.exe ineykmuaj.exe File created C:\Windows\SysWOW64\iniizepdz.exe insywlfel.exe File opened for modification C:\Windows\SysWOW64\invdmeyvk.exe_lang.ini inyctgpxi.exe File opened for modification C:\Windows\SysWOW64\inckekwln.exe_lang.ini inlgphgbd.exe File created C:\Windows\SysWOW64\inxdmghfn.exe inwikshbc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwtixaeq.exe File created C:\Windows\SysWOW64\insylvfcw.exe indnibrwr.exe File opened for modification C:\Windows\SysWOW64\inotjfrzg.exe_lang.ini inwldhtuf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infbnevol.exe File opened for modification C:\Windows\SysWOW64\inooxsntm.exe_lang.ini invkhejgd.exe File created C:\Windows\SysWOW64\incsvmltt.exe inxnqhgoo.exe File opened for modification C:\Windows\SysWOW64\inoxdfqoe.exe_lang.ini insbquvhx.exe File opened for modification C:\Windows\SysWOW64\ingrakqpr.exe_lang.ini inmhxsddw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqzfhsqg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inahuhbcs.exe File opened for modification C:\Windows\SysWOW64\inisucehe.exe_lang.ini iniizepdz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyazesml.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzavthnp.exe File opened for modification C:\Windows\SysWOW64\inogwahsa.exe_lang.ini inyjbrycn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invrckwrg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inruwvobn.exe File created C:\Windows\SysWOW64\inyvsxuru.exe inwtzamwg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injfdlthy.exe File created C:\Windows\SysWOW64\inicbilrv.exe inxqcxpkg.exe File created C:\Windows\SysWOW64\innmfqrmj.exe indvdvgmq.exe File created C:\Windows\SysWOW64\innfvgrkz.exe inpkfxleq.exe File created C:\Windows\SysWOW64\indlyubtu.exe inowmiavg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invgvfzue.exe File opened for modification C:\Windows\SysWOW64\intbpxrhx.exe_lang.ini inrxixhwa.exe File opened for modification C:\Windows\SysWOW64\invbdruwx.exe_lang.ini inhzpfbvl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innpkjuac.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwtyvsvp.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infgwnmcy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkxopbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intcrvwiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inncprues.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inedyzakd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwonikuc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intsuvkkg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbobfwma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inycopaqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbalzxgu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inltanpsp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inogxmhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatwyxqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbrcegj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclpwksm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgaoyjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwyoarng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuakpshs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhpkypiu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyufnzuj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbrocsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inruwvobn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrmslxzd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebgydau.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmvblntu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpleqlxa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbohznex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inixomukg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpiofygs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inarenvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtixaeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsdlxsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intbpxrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insywlfel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqlzpgys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpbwqegf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incgzwjvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbrulkss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhjvjvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incehxwfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhlazdts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxbftvlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwtzamwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyjbrycn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inimbeutc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwftrhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invmdukgq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoddvuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invmsakfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyazesml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inutvwllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpeapdzu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyfydwsq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insohtodl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtkzjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inczeboin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewhnrej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgwrccv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtfhlye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injidfpid.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 1316 ingvnhoze.exe 1316 ingvnhoze.exe 2680 inoavpdfe.exe 2680 inoavpdfe.exe 3772 inyufnzuj.exe 3772 inyufnzuj.exe 1820 inzkcszdo.exe 1820 inzkcszdo.exe 2268 insohtodl.exe 2268 insohtodl.exe 4076 infumgnyd.exe 4076 infumgnyd.exe 2560 inkzrlbas.exe 2560 inkzrlbas.exe 896 inpbwqegf.exe 896 inpbwqegf.exe 2588 inugvjlkd.exe 2588 inugvjlkd.exe 1812 inpleqlxa.exe 1812 inpleqlxa.exe 1764 inuqbjvqf.exe 1764 inuqbjvqf.exe 1500 inwixlnmf.exe 1500 inwixlnmf.exe 5468 inlsmacbt.exe 5468 inlsmacbt.exe 3380 inbqiycju.exe 3380 inbqiycju.exe 1056 inhfsfaqh.exe 1056 inhfsfaqh.exe 2976 injmdckxk.exe 2976 injmdckxk.exe 4316 inaphxbit.exe 4316 inaphxbit.exe 4724 ingerepgv.exe 4724 ingerepgv.exe 860 inilcbjwj.exe 860 inilcbjwj.exe 3364 inxnqhgoo.exe 3364 inxnqhgoo.exe 5200 incsvmltt.exe 5200 incsvmltt.exe 6124 injyqkarh.exe 6124 injyqkarh.exe 2412 inqtvunam.exe 2412 inqtvunam.exe 1472 inwgusogd.exe 1472 inwgusogd.exe 2364 inefvmlzb.exe 2364 inefvmlzb.exe 4308 incanalcr.exe 4308 incanalcr.exe 4112 inddmxhxc.exe 4112 inddmxhxc.exe 1804 inhwfuyzl.exe 1804 inhwfuyzl.exe 1872 injwnoaqy.exe 1872 injwnoaqy.exe 1460 inxtemyti.exe 1460 inxtemyti.exe 5416 inyjbrycn.exe 5416 inyjbrycn.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 1316 ingvnhoze.exe Token: SeDebugPrivilege 2680 inoavpdfe.exe Token: SeDebugPrivilege 3772 inyufnzuj.exe Token: SeDebugPrivilege 1820 inzkcszdo.exe Token: SeDebugPrivilege 2268 insohtodl.exe Token: SeDebugPrivilege 4076 infumgnyd.exe Token: SeDebugPrivilege 2560 inkzrlbas.exe Token: SeDebugPrivilege 896 inpbwqegf.exe Token: SeDebugPrivilege 2588 inugvjlkd.exe Token: SeDebugPrivilege 1812 inpleqlxa.exe Token: SeDebugPrivilege 1764 inuqbjvqf.exe Token: SeDebugPrivilege 1500 inwixlnmf.exe Token: SeDebugPrivilege 5468 inlsmacbt.exe Token: SeDebugPrivilege 3380 inbqiycju.exe Token: SeDebugPrivilege 1056 inhfsfaqh.exe Token: SeDebugPrivilege 2976 injmdckxk.exe Token: SeDebugPrivilege 4316 inaphxbit.exe Token: SeDebugPrivilege 4724 ingerepgv.exe Token: SeDebugPrivilege 860 inilcbjwj.exe Token: SeDebugPrivilege 3364 inxnqhgoo.exe Token: SeDebugPrivilege 5200 incsvmltt.exe Token: SeDebugPrivilege 6124 injyqkarh.exe Token: SeDebugPrivilege 2412 inqtvunam.exe Token: SeDebugPrivilege 1472 inwgusogd.exe Token: SeDebugPrivilege 2364 inefvmlzb.exe Token: SeDebugPrivilege 4308 incanalcr.exe Token: SeDebugPrivilege 4112 inddmxhxc.exe Token: SeDebugPrivilege 1804 inhwfuyzl.exe Token: SeDebugPrivilege 1872 injwnoaqy.exe Token: SeDebugPrivilege 1460 inxtemyti.exe Token: SeDebugPrivilege 5416 inyjbrycn.exe Token: SeDebugPrivilege 3144 inogwahsa.exe Token: SeDebugPrivilege 2956 inetlfmxc.exe Token: SeDebugPrivilege 5228 ingvetxyk.exe Token: SeDebugPrivilege 3864 inljyapnv.exe Token: SeDebugPrivilege 5704 inwsdlxsh.exe Token: SeDebugPrivilege 1272 inaexuhtj.exe Token: SeDebugPrivilege 3204 inqmfrmyb.exe Token: SeDebugPrivilege 4736 invrckwrg.exe Token: SeDebugPrivilege 2004 ingiuiufd.exe Token: SeDebugPrivilege 2912 inmeufqjy.exe Token: SeDebugPrivilege 5216 inomzqrdt.exe Token: SeDebugPrivilege 5452 inhwoipfi.exe Token: SeDebugPrivilege 2848 inortslka.exe Token: SeDebugPrivilege 2916 inbpxnjbw.exe Token: SeDebugPrivilege 5904 ineuxonvv.exe Token: SeDebugPrivilege 4972 inldtepix.exe Token: SeDebugPrivilege 3768 inpsutmlb.exe Token: SeDebugPrivilege 5656 inbuxzyre.exe Token: SeDebugPrivilege 3920 inxtleici.exe Token: SeDebugPrivilege 4592 inbmkzbqa.exe Token: SeDebugPrivilege 2804 inqgdzfrf.exe Token: SeDebugPrivilege 4192 inxjymong.exe Token: SeDebugPrivilege 2288 inutvwllh.exe Token: SeDebugPrivilege 2820 inrdysgih.exe Token: SeDebugPrivilege 5576 ingtgabri.exe Token: SeDebugPrivilege 4280 ingvzmksi.exe Token: SeDebugPrivilege 2228 innlypqcs.exe Token: SeDebugPrivilege 2500 incvyzsfr.exe Token: SeDebugPrivilege 5168 inkbaivic.exe Token: SeDebugPrivilege 5428 invuwaxma.exe Token: SeDebugPrivilege 4596 intfuikjc.exe Token: SeDebugPrivilege 2152 incgzwjvl.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 1316 ingvnhoze.exe 2680 inoavpdfe.exe 3772 inyufnzuj.exe 1820 inzkcszdo.exe 2268 insohtodl.exe 4076 infumgnyd.exe 2560 inkzrlbas.exe 896 inpbwqegf.exe 2588 inugvjlkd.exe 1812 inpleqlxa.exe 1764 inuqbjvqf.exe 1500 inwixlnmf.exe 5468 inlsmacbt.exe 3380 inbqiycju.exe 1056 inhfsfaqh.exe 2976 injmdckxk.exe 4316 inaphxbit.exe 4724 ingerepgv.exe 860 inilcbjwj.exe 3364 inxnqhgoo.exe 5200 incsvmltt.exe 6124 injyqkarh.exe 2412 inqtvunam.exe 1472 inwgusogd.exe 2364 inefvmlzb.exe 4308 incanalcr.exe 4112 inddmxhxc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 484 wrote to memory of 1316 484 2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe 90 PID 1316 wrote to memory of 2680 1316 ingvnhoze.exe 91 PID 2680 wrote to memory of 3772 2680 inoavpdfe.exe 92 PID 3772 wrote to memory of 1820 3772 inyufnzuj.exe 93 PID 1820 wrote to memory of 2268 1820 inzkcszdo.exe 94 PID 2268 wrote to memory of 4076 2268 insohtodl.exe 95 PID 4076 wrote to memory of 2560 4076 infumgnyd.exe 96 PID 2560 wrote to memory of 896 2560 inkzrlbas.exe 97 PID 896 wrote to memory of 2588 896 inpbwqegf.exe 98 PID 2588 wrote to memory of 1812 2588 inugvjlkd.exe 99 PID 1812 wrote to memory of 1764 1812 inpleqlxa.exe 100 PID 1764 wrote to memory of 1500 1764 inuqbjvqf.exe 101 PID 1500 wrote to memory of 5468 1500 inwixlnmf.exe 102 PID 5468 wrote to memory of 3380 5468 inlsmacbt.exe 103 PID 3380 wrote to memory of 1056 3380 inbqiycju.exe 104 PID 1056 wrote to memory of 2976 1056 inhfsfaqh.exe 105 PID 2976 wrote to memory of 4316 2976 injmdckxk.exe 106 PID 4316 wrote to memory of 4724 4316 inaphxbit.exe 107 PID 4724 wrote to memory of 860 4724 ingerepgv.exe 108 PID 860 wrote to memory of 3364 860 inilcbjwj.exe 109 PID 3364 wrote to memory of 5200 3364 inxnqhgoo.exe 110 PID 5200 wrote to memory of 6124 5200 incsvmltt.exe 111 PID 6124 wrote to memory of 2412 6124 injyqkarh.exe 112 PID 2412 wrote to memory of 1472 2412 inqtvunam.exe 113 PID 1472 wrote to memory of 2364 1472 inwgusogd.exe 114 PID 2364 wrote to memory of 4308 2364 inefvmlzb.exe 115 PID 4308 wrote to memory of 4112 4308 incanalcr.exe 116 PID 4112 wrote to memory of 1804 4112 inddmxhxc.exe 117 PID 1804 wrote to memory of 1872 1804 inhwfuyzl.exe 118 PID 1872 wrote to memory of 1460 1872 injwnoaqy.exe 119 PID 1460 wrote to memory of 5416 1460 inxtemyti.exe 120 PID 5416 wrote to memory of 3144 5416 inyjbrycn.exe 121 PID 3144 wrote to memory of 2956 3144 inogwahsa.exe 122 PID 2956 wrote to memory of 5228 2956 inetlfmxc.exe 123 PID 5228 wrote to memory of 3864 5228 ingvetxyk.exe 124 PID 3864 wrote to memory of 5704 3864 inljyapnv.exe 125 PID 5704 wrote to memory of 1272 5704 inwsdlxsh.exe 126 PID 1272 wrote to memory of 3204 1272 inaexuhtj.exe 127 PID 3204 wrote to memory of 4736 3204 inqmfrmyb.exe 128 PID 4736 wrote to memory of 2004 4736 invrckwrg.exe 129 PID 2004 wrote to memory of 2912 2004 ingiuiufd.exe 130 PID 2912 wrote to memory of 5216 2912 inmeufqjy.exe 131 PID 5216 wrote to memory of 5452 5216 inomzqrdt.exe 132 PID 5452 wrote to memory of 2848 5452 inhwoipfi.exe 133 PID 2848 wrote to memory of 2916 2848 inortslka.exe 134 PID 2916 wrote to memory of 5904 2916 inbpxnjbw.exe 135 PID 5904 wrote to memory of 4972 5904 ineuxonvv.exe 136 PID 4972 wrote to memory of 3768 4972 inldtepix.exe 137 PID 3768 wrote to memory of 5656 3768 inpsutmlb.exe 138 PID 5656 wrote to memory of 3920 5656 inbuxzyre.exe 139 PID 3920 wrote to memory of 4592 3920 inxtleici.exe 140 PID 4592 wrote to memory of 2804 4592 inbmkzbqa.exe 141 PID 2804 wrote to memory of 4192 2804 inqgdzfrf.exe 142 PID 4192 wrote to memory of 2288 4192 inxjymong.exe 143 PID 2288 wrote to memory of 2820 2288 inutvwllh.exe 144 PID 2820 wrote to memory of 5576 2820 inrdysgih.exe 145 PID 5576 wrote to memory of 4280 5576 ingtgabri.exe 146 PID 4280 wrote to memory of 2228 4280 ingvzmksi.exe 147 PID 2228 wrote to memory of 2500 2228 innlypqcs.exe 148 PID 2500 wrote to memory of 5168 2500 incvyzsfr.exe 149 PID 5168 wrote to memory of 5428 5168 inkbaivic.exe 150 PID 5428 wrote to memory of 4596 5428 invuwaxma.exe 151 PID 4596 wrote to memory of 2152 4596 intfuikjc.exe 152 PID 2152 wrote to memory of 5460 2152 incgzwjvl.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_14964e46e90e4561e0997978f2dbaedf_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe24⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\inhwfuyzl.exeC:\Windows\system32\inhwfuyzl.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe35⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe39⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe40⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe52⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe64⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe65⤵
- Executes dropped EXE
PID:5460 -
C:\Windows\SysWOW64\inftrnfcc.exeC:\Windows\system32\inftrnfcc.exe66⤵PID:2380
-
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\system32\indeulkya.exe67⤵PID:4612
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe68⤵PID:2712
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe69⤵PID:3468
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe70⤵
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe71⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:364 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe72⤵PID:4672
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe73⤵PID:2720
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe74⤵PID:2656
-
C:\Windows\SysWOW64\inuiybnpg.exeC:\Windows\system32\inuiybnpg.exe75⤵PID:5964
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe76⤵PID:1916
-
C:\Windows\SysWOW64\inowmiavg.exeC:\Windows\system32\inowmiavg.exe77⤵
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe78⤵PID:5876
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe79⤵PID:1328
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe80⤵PID:5192
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe81⤵
- System Location Discovery: System Language Discovery
PID:1224 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe82⤵PID:4756
-
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe83⤵PID:3096
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe84⤵PID:3900
-
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe85⤵PID:5240
-
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe86⤵PID:5788
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe87⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1552 -
C:\Windows\SysWOW64\inyoeaukm.exeC:\Windows\system32\inyoeaukm.exe88⤵PID:3616
-
C:\Windows\SysWOW64\insulctjf.exeC:\Windows\system32\insulctjf.exe89⤵PID:4664
-
C:\Windows\SysWOW64\inrbrocsh.exeC:\Windows\system32\inrbrocsh.exe90⤵
- System Location Discovery: System Language Discovery
PID:5444 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe91⤵PID:5640
-
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe92⤵PID:1748
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe93⤵PID:2872
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe94⤵PID:1184
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe95⤵PID:2612
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe96⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe97⤵PID:4604
-
C:\Windows\SysWOW64\inzhpyfbx.exeC:\Windows\system32\inzhpyfbx.exe98⤵PID:1988
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe99⤵PID:6028
-
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe100⤵PID:4436
-
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe101⤵PID:4984
-
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe102⤵PID:2764
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe103⤵PID:4312
-
C:\Windows\SysWOW64\inqrggyxc.exeC:\Windows\system32\inqrggyxc.exe104⤵PID:3100
-
C:\Windows\SysWOW64\inasgqvzt.exeC:\Windows\system32\inasgqvzt.exe105⤵PID:4912
-
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe106⤵PID:5772
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe107⤵PID:1436
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe108⤵
- Drops file in System32 directory
PID:4616 -
C:\Windows\SysWOW64\incfdqdof.exeC:\Windows\system32\incfdqdof.exe109⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2512 -
C:\Windows\SysWOW64\inpkfxleq.exeC:\Windows\system32\inpkfxleq.exe110⤵
- Drops file in System32 directory
PID:5632 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe111⤵PID:4300
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe112⤵PID:4232
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe113⤵PID:1336
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe114⤵PID:4196
-
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe115⤵PID:1412
-
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe116⤵PID:2744
-
C:\Windows\SysWOW64\inpnehxjk.exeC:\Windows\system32\inpnehxjk.exe117⤵PID:3948
-
C:\Windows\SysWOW64\inuhqyjhd.exeC:\Windows\system32\inuhqyjhd.exe118⤵PID:4820
-
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe119⤵PID:4484
-
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe120⤵PID:4180
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe121⤵
- System Location Discovery: System Language Discovery
PID:4108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-