Analysis
- max time kernel
76s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 00:41
Behavioral task
behavioral1
Sample
2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260718-a14ltaew5x
- SHA256 4ac739a530e8aa846dd78c08f47e0f45d9fa02d237d3e68989578cdd7cf4b59a
- MD5 f56f6a46ba298e450fc5819acb49c63a
- SHA1 7a74c37a2c0f2086051c4bb46c98570a191b1004
- SHA512 2f3155f271363b035112293b67a4d97693145afbb273a82dc5c132a480a0321e38ca1b4fcefdb8bfdeb8e95554b961f944627e4b161962e9780630ae726e2bd0
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTR:RPjOa1NxyYtH1R
- TLSH T15D15AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 64 IoCs
resource yara_rule behavioral2/memory/1004-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4cd-19.dat family_gh0strat behavioral2/memory/1004-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d2-41.dat family_gh0strat behavioral2/memory/2520-45-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d7-61.dat family_gh0strat behavioral2/files/0x000d00000001c4db-82.dat family_gh0strat behavioral2/files/0x000d00000001c4e0-104.dat family_gh0strat behavioral2/files/0x000d00000001c4ee-146.dat family_gh0strat behavioral2/files/0x000d00000001c4f2-167.dat family_gh0strat behavioral2/files/0x000d00000001c4f6-188.dat family_gh0strat behavioral2/memory/3496-213-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50a-271.dat family_gh0strat behavioral2/memory/5844-339-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4140-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3228-458-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3684-509-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4172-560-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4672-645-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1916-696-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3280-849-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4356-832-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4636-815-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3252-798-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/432-781-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/704-764-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4348-747-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2308-730-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3436-713-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4204-679-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4668-662-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4244-628-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/612-611-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/260-594-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4540-577-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2364-543-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5108-526-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1492-492-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1944-475-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5344-441-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3100-424-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3524-407-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2712-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3736-356-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c518-335.dat family_gh0strat behavioral2/memory/4420-318-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c513-314.dat family_gh0strat behavioral2/memory/1720-297-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50e-293.dat family_gh0strat behavioral2/memory/3380-276-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3696-255-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c504-251.dat family_gh0strat behavioral2/memory/5248-234-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c500-230.dat family_gh0strat behavioral2/files/0x000d00000001c4fa-209.dat family_gh0strat behavioral2/memory/692-192-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/204-171-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4800-150-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1244-129-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ea-125.dat family_gh0strat behavioral2/memory/3672-108-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5408-87-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5532-65-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d1-30.dat family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76D64FC5-EE99-4a03-A9F4-6AEA0F586AA8}\stubpath = "C:\\Windows\\system32\\inwbpkebv.exe" ingugrwmi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0988D80-A7D4-4951-9746-99E3EF94E877}\stubpath = "C:\\Windows\\system32\\incixldvq.exe" intbosajb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B086B7A7-DE47-4205-8AD0-9589BC80CE60} inpkuzhdr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B76A6738-48EA-4711-8A73-AA59461E4398} indtkzjxv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93AA82D2-E587-41e9-8F97-190C9963D80D} inqjpgzht.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CE5BA84-E1F4-49ea-BB45-560ADC336B24}\stubpath = "C:\\Windows\\system32\\inzhpyfbx.exe" indbxwxmz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{670C7744-465C-4143-B7CE-BD136292C4A2}\stubpath = "C:\\Windows\\system32\\inilftocs.exe" insvsctst.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D63C73D9-F634-45af-AA8B-1D7B4A3FBF13} inbjwysrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32C60733-A117-438f-B9DE-DCC7EE43BAD3}\stubpath = "C:\\Windows\\system32\\incsdfhkz.exe" innajnacf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B07E756-2931-4fce-8298-CA17F67CD623} incbzwztd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE8F0B2F-DA2C-4d04-8595-B9060A169980} injdwyyif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36BB41FE-2E33-4338-80F9-43AFED71B4D8}\stubpath = "C:\\Windows\\system32\\incvyzsfr.exe" incwvxbyn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{94061583-8707-4e5c-82B0-D012539FFB62} ingkycsra.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6C4CF632-2B53-43a3-AF0D-7B98E889EAF8} invzesqzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1C1E0E47-F180-43a5-999F-0D9B5A09F1D5}\stubpath = "C:\\Windows\\system32\\inlhnqivx.exe" inidwdyvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{715B7313-E5A5-4c1a-A94F-2B19FA5115AC} inutvwllh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81E9914A-C953-4d3b-969B-C1143D5BD8EA}\stubpath = "C:\\Windows\\system32\\inadbobmd.exe" inmtnbdcu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8CCD163-9069-4036-BCB0-0EA2BBF70FF7} inqgdzfrf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30A47D61-6159-4fcf-BE70-940C5D889CEC}\stubpath = "C:\\Windows\\system32\\inrhnxdft.exe" incehxwfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CF13D97-9DEF-40b5-926C-E872224611CC}\stubpath = "C:\\Windows\\system32\\insfkvqkr.exe" infyeupzm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B267933-80BB-4e79-B6BD-8805BE598621} incbrdfjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C61A8E06-66F2-4f49-BF40-D9E0CB38FC0F}\stubpath = "C:\\Windows\\system32\\intpaiupe.exe" indtfhlye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E800AE7-DD40-4a7c-A439-5720DADC10DF}\stubpath = "C:\\Windows\\system32\\inmwepkwe.exe" inxujybfr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{99F8B52B-AA13-4a5c-BE7B-060F43C80C57}\stubpath = "C:\\Windows\\system32\\invhwkmle.exe" inruwvobn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CEE8B67-D0C2-4fe1-9AD3-D2000389C04A} infudswxj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83B7233A-2E49-45ca-99D1-D05D2EA88BDE}\stubpath = "C:\\Windows\\system32\\inmtnbdcu.exe" inqrggyxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{63051DCF-EC38-4132-8D0D-91232FEC7A3E}\stubpath = "C:\\Windows\\system32\\inrfpuysy.exe" inwgusogd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1E9A118D-B5A2-48c9-A21F-5AD2D3A7F829} incajnuiq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D834A90C-4D24-49d5-83FE-A6FCD091DBA6}\stubpath = "C:\\Windows\\system32\\ingugrwmi.exe" infmbpvbz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A0EB26E-5BA5-49dd-AFB6-F0AB7F135D7C} innqmfdal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5664508C-1E02-49b8-87E1-FAEE8FAA5514}\stubpath = "C:\\Windows\\system32\\inphclvql.exe" intxcqoxe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7300508B-71A5-4521-8F15-BCDAD8A67FBB}\stubpath = "C:\\Windows\\system32\\incbrcegj.exe" ingiuiufd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BD00955-0B31-40fa-8F46-11E9F473044C} inijzqpfx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D32D09B-3709-47c6-B454-69C5E79047DF}\stubpath = "C:\\Windows\\system32\\inotqnqky.exe" intojzuff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BDF3CE1-73AA-4a90-8234-0BE1BB7885CB}\stubpath = "C:\\Windows\\system32\\inkfaovfk.exe" inhfbqsjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CC2EC99-C1D9-49a0-AF93-4A24C6FD50BA}\stubpath = "C:\\Windows\\system32\\inndiulal.exe" invkhejgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12A91B33-8788-45dd-B25B-0057D76DA354}\stubpath = "C:\\Windows\\system32\\inakrpgjz.exe" invlhtipl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{622B6BEB-F078-46a2-AF2F-50C4906E229D} inxcfnkrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E73648ED-E9E8-4ddc-B48B-B6A573A5D843} insofpwae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{00D48C4F-B6DA-4faa-9048-148DCE14030A}\stubpath = "C:\\Windows\\system32\\inbmkzbqa.exe" inmprqjiy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C573D722-FDA0-46bc-A9D1-BF77A7EEBE23} infgwnmcy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E66A501C-951F-4a61-87D1-9D62C9A1CF35} inhhujgdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D03A25A3-FB48-4df2-99FD-B1DEA72A6CC0} ineguxzcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D11D9826-B31A-4c6e-BC85-3B617EA02BF1} inpeyhpif.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B945239-EB79-4ab4-8000-F18386375C9C} inzvnieka.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD9DEFB5-9FD8-4847-8C13-79C155416D4D} inhbuwzwg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D266D37-6B8C-491f-A03A-1C06B230F74C} ingtjmoji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A571574A-44A8-4829-8C70-C4C4906D6905} inimthpzj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE7CBD18-071F-4085-89AD-096AC3982482} infxsuasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{93CDAC96-9B51-4e88-918F-879AF7BDA798} injavkrnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAAA7407-26AE-4e3f-B1BE-450E6D99028E} infbnevol.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{70FF3D79-7EA2-4057-9FA9-60BD6504FAB2}\stubpath = "C:\\Windows\\system32\\inykxcqol.exe" inewrcnnk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16992223-D042-4680-8C10-4486040548AA} invwyxcqk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{368C2AFA-2D23-4c0a-A37B-DB9D3B69FB4E} invqlrkwy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D2C3BA9-FAFA-4649-8716-2E8875EC2FC2} ineupaato.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9B048B3-CD01-4684-A0E5-C72351BE6F6F}\stubpath = "C:\\Windows\\system32\\inmhgesgy.exe" invtfsnjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02D3D2F5-81C5-4e87-8E61-D7680181F365} inxjymong.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3CF4AA01-5EEF-47ea-A8DD-57992EEE16BA} inbmkzbqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5E0166A4-3F6D-4898-B97D-3FCA16CC7095} inpqffxwb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B024932D-8656-4842-B212-B4E2713C9CA1} inupkqjvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B38C4F8B-7866-414e-9302-74B78DB8192E} iniqgcwmo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD971F71-D656-43a9-91BC-46CCEB0F07A2}\stubpath = "C:\\Windows\\system32\\inlgphgbd.exe" inddqfcew.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BA6A983-BB43-45e8-8053-FA4E991B9112} inlmosntr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E51F8FA-10EE-45ea-8CD4-3229601838D1} inngbnczn.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00070000000113d4-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 2520 inpleqlxa.exe 5532 inrdysgih.exe 5408 inbfyviuk.exe 3672 inoavpdfe.exe 1244 inetlfmxc.exe 4800 inxiaqxbm.exe 204 innfvgrkz.exe 692 insvxwpco.exe 3496 ingvnhoze.exe 5248 inlsmacbt.exe 3696 insohtodl.exe 3380 inxtemyti.exe 1720 inxjymong.exe 4420 inortslka.exe 5844 incrjzdkv.exe 3736 inzvgovkd.exe 4140 inzloqpih.exe 2712 inogwahsa.exe 3524 inwsdlxsh.exe 3100 inwixlnmf.exe 5344 injmdckxk.exe 3228 inbqiycju.exe 1944 inyufnzuj.exe 1492 inykznpoh.exe 3684 inqmfrmyb.exe 5108 inruwvobn.exe 2364 invhwkmle.exe 4172 inyjbrycn.exe 4540 inutvwllh.exe 260 inazpsjiq.exe 612 insbquvhx.exe 4244 inigtklnv.exe 4672 inwmpgfnn.exe 4668 infdqdofu.exe 4204 infudswxj.exe 1916 injhulmow.exe 3436 ineybxzdp.exe 2308 indtwnmuu.exe 4348 inefvmlzb.exe 704 inaphxbit.exe 432 inbqostfv.exe 3252 incgzwjvl.exe 4636 indlyubtu.exe 4356 inhjvjvge.exe 3280 innqsrkjz.exe 3424 inqklaasr.exe 5660 infnwdvwr.exe 4192 ingwzqpxx.exe 6136 inhiypoew.exe 2572 invrckwrg.exe 4988 inaexuhtj.exe 6032 inxtleici.exe 2644 injwnoaqy.exe 820 inbuxzyre.exe 5068 infvypoww.exe 1748 inmeufqjy.exe 3144 indxawycz.exe 2952 inesqmezb.exe 4732 ingvetxyk.exe 5876 inljyapnv.exe 2784 inapnrseu.exe 4068 ineuxonvv.exe 5712 inirmhzng.exe 3096 inomzqrdt.exe - Loads dropped DLL 64 IoCs
pid Process 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe 2520 inpleqlxa.exe 2520 inpleqlxa.exe 5532 inrdysgih.exe 5532 inrdysgih.exe 5408 inbfyviuk.exe 5408 inbfyviuk.exe 3672 inoavpdfe.exe 3672 inoavpdfe.exe 1244 inetlfmxc.exe 1244 inetlfmxc.exe 4800 inxiaqxbm.exe 4800 inxiaqxbm.exe 204 innfvgrkz.exe 204 innfvgrkz.exe 692 insvxwpco.exe 692 insvxwpco.exe 3496 ingvnhoze.exe 3496 ingvnhoze.exe 5248 inlsmacbt.exe 5248 inlsmacbt.exe 3696 insohtodl.exe 3696 insohtodl.exe 3380 inxtemyti.exe 3380 inxtemyti.exe 1720 inxjymong.exe 1720 inxjymong.exe 4420 inortslka.exe 4420 inortslka.exe 5844 incrjzdkv.exe 5844 incrjzdkv.exe 3736 inzvgovkd.exe 3736 inzvgovkd.exe 4140 inzloqpih.exe 4140 inzloqpih.exe 2712 inogwahsa.exe 2712 inogwahsa.exe 3524 inwsdlxsh.exe 3524 inwsdlxsh.exe 3100 inwixlnmf.exe 3100 inwixlnmf.exe 5344 injmdckxk.exe 5344 injmdckxk.exe 3228 inbqiycju.exe 3228 inbqiycju.exe 1944 inyufnzuj.exe 1944 inyufnzuj.exe 1492 inykznpoh.exe 1492 inykznpoh.exe 3684 inqmfrmyb.exe 3684 inqmfrmyb.exe 5108 inruwvobn.exe 5108 inruwvobn.exe 2364 invhwkmle.exe 2364 invhwkmle.exe 4172 inyjbrycn.exe 4172 inyjbrycn.exe 4540 inutvwllh.exe 4540 inutvwllh.exe 260 inazpsjiq.exe 260 inazpsjiq.exe 612 insbquvhx.exe 612 insbquvhx.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inbqiycju.exe_lang.ini injmdckxk.exe File opened for modification C:\Windows\SysWOW64\inenraymu.exe_lang.ini inopeewva.exe File created C:\Windows\SysWOW64\inrtwgusw.exe ingcowdkg.exe File created C:\Windows\SysWOW64\inrdysgih.exe inpleqlxa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmeufqjy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indqsmlmh.exe File created C:\Windows\SysWOW64\ingugrwmi.exe infmbpvbz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inboqtqar.exe File created C:\Windows\SysWOW64\incmhaqvq.exe inkihxsdk.exe File created C:\Windows\SysWOW64\inljyapnv.exe ingvetxyk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrfpuysy.exe File opened for modification C:\Windows\SysWOW64\inrngsnzc.exe_lang.ini incbrdfjw.exe File created C:\Windows\SysWOW64\intglbjrf.exe inmwmixdn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indzyzoqh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inijzqpfx.exe File opened for modification C:\Windows\SysWOW64\ineyyaxuz.exe_lang.ini inlnqnzon.exe File opened for modification C:\Windows\SysWOW64\ingvzmksi.exe_lang.ini inyoeaukm.exe File opened for modification C:\Windows\SysWOW64\infsuonoj.exe_lang.ini inmbydanh.exe File created C:\Windows\SysWOW64\ineugyxhj.exe insnyjjgx.exe File created C:\Windows\SysWOW64\innbxlquo.exe inisglpjp.exe File created C:\Windows\SysWOW64\inkmhgrmq.exe inzuolauz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbuxzyre.exe File created C:\Windows\SysWOW64\infvqbbup.exe inzkcszdo.exe File opened for modification C:\Windows\SysWOW64\inejnhnnw.exe_lang.ini injfqeotx.exe File created C:\Windows\SysWOW64\inhfnbzwf.exe invecggre.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infmbihgy.exe File opened for modification C:\Windows\SysWOW64\intfuikjc.exe_lang.ini inqtvunam.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqcxrfhg.exe File opened for modification C:\Windows\SysWOW64\iniwaqpwa.exe_lang.ini inzydrlkr.exe File opened for modification C:\Windows\SysWOW64\ingugrwmi.exe_lang.ini infmbpvbz.exe File created C:\Windows\SysWOW64\infjmomlg.exe invspsmvj.exe File created C:\Windows\SysWOW64\intqwjtdz.exe inwhjedoj.exe File opened for modification C:\Windows\SysWOW64\innqsrkjz.exe_lang.ini inhjvjvge.exe File created C:\Windows\SysWOW64\intetdxsy.exe inbuzcxoc.exe File created C:\Windows\SysWOW64\inbpxnjbw.exe insacfcod.exe File opened for modification C:\Windows\SysWOW64\invudbffq.exe_lang.ini inatwyxqd.exe File created C:\Windows\SysWOW64\inmjhdsul.exe inkdbjsnc.exe File created C:\Windows\SysWOW64\inzrqlnxa.exe inbjdjvkm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indkgfezw.exe File created C:\Windows\SysWOW64\indvpwggs.exe inmxdfsdw.exe File opened for modification C:\Windows\SysWOW64\inqcxrfhg.exe_lang.ini inzprbebn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inupeyqpk.exe File created C:\Windows\SysWOW64\inbdhuahl.exe inckscbjk.exe File created C:\Windows\SysWOW64\innrmsqfx.exe inzuwcuov.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwikshbc.exe File opened for modification C:\Windows\SysWOW64\inscqyokc.exe_lang.ini inqxbfmkb.exe File opened for modification C:\Windows\SysWOW64\innusjmop.exe_lang.ini inpnehxjk.exe File opened for modification C:\Windows\SysWOW64\inkzrlbas.exe_lang.ini infumgnyd.exe File created C:\Windows\SysWOW64\iniqgcwmo.exe invlbrhjx.exe File opened for modification C:\Windows\SysWOW64\ingoxeawx.exe_lang.ini inblsqhkm.exe File created C:\Windows\SysWOW64\inzuolauz.exe injgpuugv.exe File opened for modification C:\Windows\SysWOW64\injbpivej.exe_lang.ini intqwjtdz.exe File opened for modification C:\Windows\SysWOW64\inmwepkwe.exe_lang.ini inxujybfr.exe File created C:\Windows\SysWOW64\ineeenyiy.exe inbaqtkjr.exe File opened for modification C:\Windows\SysWOW64\inkivmnpx.exe_lang.ini invzesqzg.exe File created C:\Windows\SysWOW64\inalzlawr.exe inykmqjhq.exe File opened for modification C:\Windows\SysWOW64\inacgtgkr.exe_lang.ini inakrpgjz.exe File created C:\Windows\SysWOW64\infzzbyva.exe intndtuwg.exe File opened for modification C:\Windows\SysWOW64\inpfvwyie.exe_lang.ini inhgncqwc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxiaqxbm.exe File opened for modification C:\Windows\SysWOW64\insbquvhx.exe_lang.ini inazpsjiq.exe File opened for modification C:\Windows\SysWOW64\ineuxonvv.exe_lang.ini inapnrseu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpbwqegf.exe File created C:\Windows\SysWOW64\inxujybfr.exe inxuxrboe.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injhulmow.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyiwuqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language initcmsrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqhodfle.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuogleaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnwdvwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyixbhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupkqjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoddvuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsbjtei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intndtuwg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intglbjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inckagkpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniyteex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzprbebn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaqgiwze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwuyycww.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injausioy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpzchsnz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrycagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invecggre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbalzxgu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxqlnlfy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlyubtu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineeenyiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaeepccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnqhgoo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incrjzdkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injkrqgyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insbquvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwnltjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhqyjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwauuwtq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzdngio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlludanj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqofiykl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyteppma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineamubie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykmqjhq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgispe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indvpwggs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrurbsrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invwyxcqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxncqsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infxsuasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inooqnkpm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaikwkwh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inapytoun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbobfwma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inalzlawr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infdqdofu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inthmqkqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyegtexf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infaqhwgu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebdvara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incmhaqvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inowqgwxz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyjbrycn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invrckwrg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvqbbup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe 2520 inpleqlxa.exe 2520 inpleqlxa.exe 5532 inrdysgih.exe 5532 inrdysgih.exe 5408 inbfyviuk.exe 5408 inbfyviuk.exe 3672 inoavpdfe.exe 3672 inoavpdfe.exe 1244 inetlfmxc.exe 1244 inetlfmxc.exe 4800 inxiaqxbm.exe 4800 inxiaqxbm.exe 204 innfvgrkz.exe 204 innfvgrkz.exe 692 insvxwpco.exe 692 insvxwpco.exe 3496 ingvnhoze.exe 3496 ingvnhoze.exe 5248 inlsmacbt.exe 5248 inlsmacbt.exe 3696 insohtodl.exe 3696 insohtodl.exe 3380 inxtemyti.exe 3380 inxtemyti.exe 1720 inxjymong.exe 1720 inxjymong.exe 4420 inortslka.exe 4420 inortslka.exe 5844 incrjzdkv.exe 5844 incrjzdkv.exe 3736 inzvgovkd.exe 3736 inzvgovkd.exe 4140 inzloqpih.exe 4140 inzloqpih.exe 2712 inogwahsa.exe 2712 inogwahsa.exe 3524 inwsdlxsh.exe 3524 inwsdlxsh.exe 3100 inwixlnmf.exe 3100 inwixlnmf.exe 5344 injmdckxk.exe 5344 injmdckxk.exe 3228 inbqiycju.exe 3228 inbqiycju.exe 1944 inyufnzuj.exe 1944 inyufnzuj.exe 1492 inykznpoh.exe 1492 inykznpoh.exe 3684 inqmfrmyb.exe 3684 inqmfrmyb.exe 5108 inruwvobn.exe 5108 inruwvobn.exe 2364 invhwkmle.exe 2364 invhwkmle.exe 4172 inyjbrycn.exe 4172 inyjbrycn.exe 4540 inutvwllh.exe 4540 inutvwllh.exe 260 inazpsjiq.exe 260 inazpsjiq.exe 612 insbquvhx.exe 612 insbquvhx.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 2520 inpleqlxa.exe Token: SeDebugPrivilege 5532 inrdysgih.exe Token: SeDebugPrivilege 5408 inbfyviuk.exe Token: SeDebugPrivilege 3672 inoavpdfe.exe Token: SeDebugPrivilege 1244 inetlfmxc.exe Token: SeDebugPrivilege 4800 inxiaqxbm.exe Token: SeDebugPrivilege 204 innfvgrkz.exe Token: SeDebugPrivilege 692 insvxwpco.exe Token: SeDebugPrivilege 3496 ingvnhoze.exe Token: SeDebugPrivilege 5248 inlsmacbt.exe Token: SeDebugPrivilege 3696 insohtodl.exe Token: SeDebugPrivilege 3380 inxtemyti.exe Token: SeDebugPrivilege 1720 inxjymong.exe Token: SeDebugPrivilege 4420 inortslka.exe Token: SeDebugPrivilege 5844 incrjzdkv.exe Token: SeDebugPrivilege 3736 inzvgovkd.exe Token: SeDebugPrivilege 4140 inzloqpih.exe Token: SeDebugPrivilege 2712 inogwahsa.exe Token: SeDebugPrivilege 3524 inwsdlxsh.exe Token: SeDebugPrivilege 3100 inwixlnmf.exe Token: SeDebugPrivilege 5344 injmdckxk.exe Token: SeDebugPrivilege 3228 inbqiycju.exe Token: SeDebugPrivilege 1944 inyufnzuj.exe Token: SeDebugPrivilege 1492 inykznpoh.exe Token: SeDebugPrivilege 3684 inqmfrmyb.exe Token: SeDebugPrivilege 5108 inruwvobn.exe Token: SeDebugPrivilege 2364 invhwkmle.exe Token: SeDebugPrivilege 4172 inyjbrycn.exe Token: SeDebugPrivilege 4540 inutvwllh.exe Token: SeDebugPrivilege 260 inazpsjiq.exe Token: SeDebugPrivilege 612 insbquvhx.exe Token: SeDebugPrivilege 4244 inigtklnv.exe Token: SeDebugPrivilege 4672 inwmpgfnn.exe Token: SeDebugPrivilege 4668 infdqdofu.exe Token: SeDebugPrivilege 4204 infudswxj.exe Token: SeDebugPrivilege 1916 injhulmow.exe Token: SeDebugPrivilege 3436 ineybxzdp.exe Token: SeDebugPrivilege 2308 indtwnmuu.exe Token: SeDebugPrivilege 4348 inefvmlzb.exe Token: SeDebugPrivilege 704 inaphxbit.exe Token: SeDebugPrivilege 432 inbqostfv.exe Token: SeDebugPrivilege 3252 incgzwjvl.exe Token: SeDebugPrivilege 4636 indlyubtu.exe Token: SeDebugPrivilege 4356 inhjvjvge.exe Token: SeDebugPrivilege 3280 innqsrkjz.exe Token: SeDebugPrivilege 3424 inqklaasr.exe Token: SeDebugPrivilege 5660 infnwdvwr.exe Token: SeDebugPrivilege 4192 ingwzqpxx.exe Token: SeDebugPrivilege 6136 inhiypoew.exe Token: SeDebugPrivilege 2572 invrckwrg.exe Token: SeDebugPrivilege 4988 inaexuhtj.exe Token: SeDebugPrivilege 6032 inxtleici.exe Token: SeDebugPrivilege 2644 injwnoaqy.exe Token: SeDebugPrivilege 820 inbuxzyre.exe Token: SeDebugPrivilege 5068 infvypoww.exe Token: SeDebugPrivilege 1748 inmeufqjy.exe Token: SeDebugPrivilege 3144 indxawycz.exe Token: SeDebugPrivilege 2952 inesqmezb.exe Token: SeDebugPrivilege 4732 ingvetxyk.exe Token: SeDebugPrivilege 5876 inljyapnv.exe Token: SeDebugPrivilege 2784 inapnrseu.exe Token: SeDebugPrivilege 4068 ineuxonvv.exe Token: SeDebugPrivilege 5712 inirmhzng.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe 2520 inpleqlxa.exe 5532 inrdysgih.exe 5408 inbfyviuk.exe 3672 inoavpdfe.exe 1244 inetlfmxc.exe 4800 inxiaqxbm.exe 204 innfvgrkz.exe 692 insvxwpco.exe 3496 ingvnhoze.exe 5248 inlsmacbt.exe 3696 insohtodl.exe 3380 inxtemyti.exe 1720 inxjymong.exe 4420 inortslka.exe 5844 incrjzdkv.exe 3736 inzvgovkd.exe 4140 inzloqpih.exe 2712 inogwahsa.exe 3524 inwsdlxsh.exe 3100 inwixlnmf.exe 5344 injmdckxk.exe 3228 inbqiycju.exe 1944 inyufnzuj.exe 1492 inykznpoh.exe 3684 inqmfrmyb.exe 5108 inruwvobn.exe 2364 invhwkmle.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1004 wrote to memory of 2520 1004 2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 2520 wrote to memory of 5532 2520 inpleqlxa.exe 90 PID 5532 wrote to memory of 5408 5532 inrdysgih.exe 91 PID 5408 wrote to memory of 3672 5408 inbfyviuk.exe 92 PID 3672 wrote to memory of 1244 3672 inoavpdfe.exe 93 PID 1244 wrote to memory of 4800 1244 inetlfmxc.exe 94 PID 4800 wrote to memory of 204 4800 inxiaqxbm.exe 95 PID 204 wrote to memory of 692 204 innfvgrkz.exe 96 PID 692 wrote to memory of 3496 692 insvxwpco.exe 97 PID 3496 wrote to memory of 5248 3496 ingvnhoze.exe 98 PID 5248 wrote to memory of 3696 5248 inlsmacbt.exe 99 PID 3696 wrote to memory of 3380 3696 insohtodl.exe 100 PID 3380 wrote to memory of 1720 3380 inxtemyti.exe 101 PID 1720 wrote to memory of 4420 1720 inxjymong.exe 102 PID 4420 wrote to memory of 5844 4420 inortslka.exe 103 PID 5844 wrote to memory of 3736 5844 incrjzdkv.exe 104 PID 3736 wrote to memory of 4140 3736 inzvgovkd.exe 105 PID 4140 wrote to memory of 2712 4140 inzloqpih.exe 106 PID 2712 wrote to memory of 3524 2712 inogwahsa.exe 107 PID 3524 wrote to memory of 3100 3524 inwsdlxsh.exe 108 PID 3100 wrote to memory of 5344 3100 inwixlnmf.exe 109 PID 5344 wrote to memory of 3228 5344 injmdckxk.exe 110 PID 3228 wrote to memory of 1944 3228 inbqiycju.exe 111 PID 1944 wrote to memory of 1492 1944 inyufnzuj.exe 112 PID 1492 wrote to memory of 3684 1492 inykznpoh.exe 113 PID 3684 wrote to memory of 5108 3684 inqmfrmyb.exe 114 PID 5108 wrote to memory of 2364 5108 inruwvobn.exe 115 PID 2364 wrote to memory of 4172 2364 invhwkmle.exe 116 PID 4172 wrote to memory of 4540 4172 inyjbrycn.exe 117 PID 4540 wrote to memory of 260 4540 inutvwllh.exe 118 PID 260 wrote to memory of 612 260 inazpsjiq.exe 119 PID 612 wrote to memory of 4244 612 insbquvhx.exe 120 PID 4244 wrote to memory of 4672 4244 inigtklnv.exe 121 PID 4672 wrote to memory of 4668 4672 inwmpgfnn.exe 122 PID 4668 wrote to memory of 4204 4668 infdqdofu.exe 123 PID 4204 wrote to memory of 1916 4204 infudswxj.exe 124 PID 1916 wrote to memory of 3436 1916 injhulmow.exe 125 PID 3436 wrote to memory of 2308 3436 ineybxzdp.exe 126 PID 2308 wrote to memory of 4348 2308 indtwnmuu.exe 127 PID 4348 wrote to memory of 704 4348 inefvmlzb.exe 128 PID 704 wrote to memory of 432 704 inaphxbit.exe 129 PID 432 wrote to memory of 3252 432 inbqostfv.exe 130 PID 3252 wrote to memory of 4636 3252 incgzwjvl.exe 131 PID 4636 wrote to memory of 4356 4636 indlyubtu.exe 132 PID 4356 wrote to memory of 3280 4356 inhjvjvge.exe 133 PID 3280 wrote to memory of 3424 3280 innqsrkjz.exe 134 PID 3424 wrote to memory of 5660 3424 inqklaasr.exe 135 PID 5660 wrote to memory of 4192 5660 infnwdvwr.exe 136 PID 4192 wrote to memory of 6136 4192 ingwzqpxx.exe 137 PID 6136 wrote to memory of 2572 6136 inhiypoew.exe 138 PID 2572 wrote to memory of 4988 2572 invrckwrg.exe 139 PID 4988 wrote to memory of 6032 4988 inaexuhtj.exe 140 PID 6032 wrote to memory of 2644 6032 inxtleici.exe 141 PID 2644 wrote to memory of 820 2644 injwnoaqy.exe 142 PID 820 wrote to memory of 5068 820 inbuxzyre.exe 143 PID 5068 wrote to memory of 1748 5068 infvypoww.exe 144 PID 1748 wrote to memory of 3144 1748 inmeufqjy.exe 145 PID 3144 wrote to memory of 2952 3144 indxawycz.exe 146 PID 2952 wrote to memory of 4732 2952 inesqmezb.exe 147 PID 4732 wrote to memory of 5876 4732 ingvetxyk.exe 148 PID 5876 wrote to memory of 2784 5876 inljyapnv.exe 149 PID 2784 wrote to memory of 4068 2784 inapnrseu.exe 150 PID 4068 wrote to memory of 5712 4068 ineuxonvv.exe 151 PID 5712 wrote to memory of 3096 5712 inirmhzng.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_f56f6a46ba298e450fc5819acb49c63a_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe14⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe27⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe30⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe36⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe65⤵
- Executes dropped EXE
PID:3096 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe66⤵PID:3804
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe67⤵PID:2960
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe68⤵PID:5404
-
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe69⤵PID:2912
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe70⤵
- Drops file in System32 directory
PID:1064 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe71⤵
- Drops file in System32 directory
PID:276 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe72⤵PID:896
-
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe73⤵PID:5976
-
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\system32\inixomukg.exe74⤵PID:2156
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe75⤵PID:3676
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe76⤵PID:1936
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe77⤵
- Boot or Logon Autostart Execution: Active Setup
PID:608 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe78⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5904 -
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe79⤵PID:456
-
C:\Windows\SysWOW64\inqrggyxc.exeC:\Windows\system32\inqrggyxc.exe80⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2852 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe81⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2900 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe82⤵PID:5884
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe83⤵PID:1536
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe84⤵PID:1848
-
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe85⤵PID:6000
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe86⤵PID:5744
-
C:\Windows\SysWOW64\insulctjf.exeC:\Windows\system32\insulctjf.exe87⤵PID:1544
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe88⤵PID:6108
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe89⤵PID:5664
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe90⤵
- Drops file in System32 directory
PID:4656 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe91⤵
- System Location Discovery: System Language Discovery
PID:4764 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe92⤵PID:2692
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe93⤵PID:5552
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe94⤵PID:928
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe95⤵PID:5548
-
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe96⤵PID:4292
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe97⤵PID:700
-
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe98⤵PID:52
-
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe99⤵PID:4780
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe100⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5136 -
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe101⤵PID:3016
-
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe102⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4480 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe103⤵PID:1932
-
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe104⤵PID:4092
-
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe105⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe106⤵PID:4756
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe107⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1132 -
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe108⤵PID:6008
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe109⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2680 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe110⤵PID:1688
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe111⤵PID:2408
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe112⤵
- Boot or Logon Autostart Execution: Active Setup
PID:3968 -
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe113⤵
- Drops file in System32 directory
PID:2508 -
C:\Windows\SysWOW64\inbsfowhf.exeC:\Windows\system32\inbsfowhf.exe114⤵PID:6088
-
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe115⤵PID:1408
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe116⤵
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe117⤵
- Drops file in System32 directory
PID:5396 -
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe118⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\Windows\SysWOW64\inqxbfmkb.exeC:\Windows\system32\inqxbfmkb.exe119⤵
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe120⤵PID:4788
-
C:\Windows\SysWOW64\indvjzcoq.exeC:\Windows\system32\indvjzcoq.exe121⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-