Analysis
- max time kernel
77s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 00:59
Behavioral task
behavioral1
Sample
2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260718-bces8aa19q
- SHA256 48982ae3041da4f9c2302cef8fe58c8911f41195a40ae267e3570928140b27a6
- MD5 71721f430ee4d8902a536ea6086e21a9
- SHA1 976eeba5e409fd1bc96d8f26117c65e3e5970689
- SHA512 c9e9d7746c39ab9bca7d51f201307862c6610483a6259a4f0063e6203f717442feddcd50e02cc12c051e8df6984c0641976f01ce44a1ce14cba3117282226814
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT2:RPjOa1NxyYtH12
- TLSH T1AC15AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 48 IoCs
resource yara_rule behavioral2/memory/5768-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c5af-19.dat family_gh0strat behavioral2/memory/5768-23-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5b3-31.dat family_gh0strat behavioral2/files/0x000c00000001c5b4-39.dat family_gh0strat behavioral2/memory/5700-46-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5b8-64.dat family_gh0strat behavioral2/memory/2732-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5bd-85.dat family_gh0strat behavioral2/memory/4604-89-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5c0-108.dat family_gh0strat behavioral2/memory/5664-111-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5c4-130.dat family_gh0strat behavioral2/memory/1904-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5c8-156.dat family_gh0strat behavioral2/memory/6100-155-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5cd-176.dat family_gh0strat behavioral2/memory/5692-179-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5d1-198.dat family_gh0strat behavioral2/memory/4496-202-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5d5-219.dat family_gh0strat behavioral2/files/0x000c00000001c5d9-241.dat family_gh0strat behavioral2/files/0x000c00000001c5e2-286.dat family_gh0strat behavioral2/memory/5284-410-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5264-554-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1232-572-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/620-590-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1432-608-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3508-536-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3324-517-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4064-499-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1148-482-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4256-464-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5736-446-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4312-428-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2784-392-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4348-373-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5ef-355.dat family_gh0strat behavioral2/memory/1564-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3448-334-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5eb-330.dat family_gh0strat behavioral2/memory/5848-312-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5e6-308.dat family_gh0strat behavioral2/memory/2480-290-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2608-268-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5dd-264.dat family_gh0strat behavioral2/memory/4104-245-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5256-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B152EED4-B985-470b-A6E3-F690C07C2FB4}\stubpath = "C:\\Windows\\system32\\inhscspdt.exe" injsnioht.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51DD42AD-306F-43ba-BF9D-F7C3F2F8A941} inakrpgjz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9EBB436-09E1-4ca9-82C7-4419F7BE82BE} inmflkmos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9EBB436-09E1-4ca9-82C7-4419F7BE82BE}\stubpath = "C:\\Windows\\system32\\inhxamofz.exe" inmflkmos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8E82059-9CA2-4a34-A1CD-1905F0C330E8}\stubpath = "C:\\Windows\\system32\\inmowclfg.exe" inmlwcerc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{382D093C-10B0-478b-8254-7624710AA2F2} inycopaqa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BD08EA6-F733-41cd-A7F6-E1FA621EA97F}\stubpath = "C:\\Windows\\system32\\inesiwrli.exe" inthjosvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{038D5BBB-0C3F-4c15-8A6F-1F594208DFFD}\stubpath = "C:\\Windows\\system32\\incbrdfjw.exe" inmktaxgs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8867E3D6-4564-4be2-91A8-B2DF391C7AB4} insjarhdx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAD73CAC-15F7-4746-8B7E-559A69299611} inclwgwbt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E82097C2-2C74-4500-9D44-C50AC41CAD97}\stubpath = "C:\\Windows\\system32\\inxuxrboe.exe" innpclapa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C04DED57-93EA-4385-88E0-5CABF59A2940} incehxwfd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{72998A93-2E34-449e-8698-1D13AFC8B893}\stubpath = "C:\\Windows\\system32\\ingkycsra.exe" inlhzufqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12F21A78-D98D-4247-81D9-AB972A555D3F} infhrodsv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{768FB782-C3D3-44ef-8C06-CCC871331B9D}\stubpath = "C:\\Windows\\system32\\incvxxhec.exe" inwtwqazn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2295CC77-79FA-4842-AEB4-117696058F68}\stubpath = "C:\\Windows\\system32\\invmdukgq.exe" inktbmkag.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5872BF9-9F4C-4d4c-A5DE-C1574AF62CF0}\stubpath = "C:\\Windows\\system32\\incbrcegj.exe" inwemzvcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23E6D7F6-1A29-4e98-AFCE-C7F8F0CC274C}\stubpath = "C:\\Windows\\system32\\insavkvmj.exe" innboczda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2E65134E-F6C1-4d27-ADC6-986D48F670D0}\stubpath = "C:\\Windows\\system32\\intuwvzao.exe" inimthpzj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F9372F5-56E4-4851-9B8C-C55375B6497B} indlvgkyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3A30AFF4-09AC-406a-BF95-39197439BC2E} inwauuwtq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DA36971-A615-4307-AC20-87F9F457CD37} inrcscxou.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDACDCB7-2CAA-4a94-81BF-234DA46BCC4E}\stubpath = "C:\\Windows\\system32\\inzloqpih.exe" insbquvhx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05DFF178-8141-4392-AD10-68240F70F638} inwnmuuop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{233FC973-C075-4134-89CC-7E82D66FC666} inhrtbdgd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F3D28A5-2EB5-4221-9D7D-8598405C4002} innezahdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8F4B5D58-7CA1-46c1-A372-2930CB0FF324}\stubpath = "C:\\Windows\\system32\\inqgyjlgf.exe" inpedtegi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD08BC79-D7C3-49b4-81E1-C8A93085B5B7} inoyifzki.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{370900D0-6E93-4e0c-9EED-D56C1ED1BF25} inljyapnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F7CE648-A66B-458c-AC6C-8C6FE54D08B2} inertnmni.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3FC4E9C-7F07-4d53-9C42-9C66285ED13B}\stubpath = "C:\\Windows\\system32\\indlyubtu.exe" inbmkzbqa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D154B50A-A45F-4566-A2AC-3E14C32D29EA} inoxlbteg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{466C37F9-63E4-4def-9753-75B3D0FF99BB} inpnehxjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{74A17186-15F4-4f84-A9A3-53538C7F98D2} indkgfezw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64CB5EFC-492B-47e6-9670-A51F126C781F} inspmpjxs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{538003BE-9EC2-4306-B9BD-FB25D5761736}\stubpath = "C:\\Windows\\system32\\ingvzmksi.exe" inwgusogd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A765D92-E593-4755-A6D6-74D99146F3EE} inucuflpc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58A8D6CE-BC7C-4cce-A395-5E53C7A22B36} inixomukg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{06393ACD-1CE2-47dc-8B20-166BFC1A038C}\stubpath = "C:\\Windows\\system32\\inxzpbsoh.exe" inknhvqeu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F1FFA6E-A8AA-4555-88F2-336D62AEF8C5} inqswbpnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97382DC2-50A0-42f4-BDD7-6BB135B06D1F} inrtwgusw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F3D28A5-2EB5-4221-9D7D-8598405C4002}\stubpath = "C:\\Windows\\system32\\insgoyikn.exe" innezahdx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3359E8BF-AF16-4da0-8FA6-BD83EA63557C} insohtodl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7FBCFAA-93EC-40fb-90C6-C9725F2CC465} inrcangym.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D49005D1-2317-42e4-A7F3-DD4952833BBE} iniqzgcyz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33BC3635-71EF-46fa-9B97-738E3143DC19}\stubpath = "C:\\Windows\\system32\\inhsblrqs.exe" inhbuwzwg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1EF1C3D-BC41-4d6f-98FE-C6BB231F6756}\stubpath = "C:\\Windows\\system32\\inwfngdng.exe" inctckufj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAD5C933-634A-49a6-8157-5DE883F1A7F8} inhztqfaz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3269CE21-93B5-434e-9C0A-E6AAB4D3553E} inmpleckt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F4A000B-E5BE-48bb-89D1-6ED11E1D25F3} ineuxonvv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5400D5DD-2783-4a18-86C3-2C66AC5678A4} inoavpdfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29AC56CF-DD9A-4435-8968-E1F9244259DF}\stubpath = "C:\\Windows\\system32\\inaeepccp.exe" inhzrfkoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{75DB4E92-7DC7-44e0-B599-A6D0FB44E5F0} inuydrpyf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DD9E319F-A6D6-4b7f-8356-3AE22FA294BF} ineqbmfxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE1DC987-51BC-4034-BCC5-9FE65A2018E2} inebgydau.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8683DE5-A09E-466a-84DE-8F54A81E7476}\stubpath = "C:\\Windows\\system32\\inmwmixdn.exe" inctpigdo.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDBF4430-D615-4f6e-8B73-4FD9B58F65FF} inmgmynpz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BC936AB-6B1F-4987-B6F7-ED852DDCB050} inwtdautu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2017AC8-A3BC-4c4c-974E-934C0A3FBB4D}\stubpath = "C:\\Windows\\system32\\inmzesqny.exe" inlfbhwkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB074D09-F531-4c43-B726-D3374F9EAC88}\stubpath = "C:\\Windows\\system32\\inunzyumh.exe" inzrqlnxa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465F3297-C211-4965-869B-96AF2948473B} inmxiifwj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85CE1D27-86D7-4975-A04E-6A2E68868175}\stubpath = "C:\\Windows\\system32\\inocokdvj.exe" insrzztuj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9AFAE93A-7114-4bd2-8F2B-D4B8EDF6398B}\stubpath = "C:\\Windows\\system32\\inbmmjnwc.exe" inaqceivb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BFF41E5-487C-410c-8B86-DEE4452153E4} invmsakfo.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0011000000019a98-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5700 inwixlnmf.exe 2732 inzvgovkd.exe 4604 inldtepix.exe 5664 intpaiupe.exe 1904 inbfyviuk.exe 6100 inmtnbdcu.exe 5692 inbqiycju.exe 4496 inwhpwale.exe 5256 inlsmacbt.exe 4104 inaphxbit.exe 2608 inxtemyti.exe 2480 inxjymong.exe 5848 inknedlyl.exe 3448 inuqbjvqf.exe 1564 insbquvhx.exe 4348 inzloqpih.exe 2784 inogwahsa.exe 5284 insvxwpco.exe 4312 ineuxonvv.exe 5736 innqsrkjz.exe 4256 incanalcr.exe 1148 inbuxzyre.exe 4064 inixpjqgj.exe 3324 inqmfrmyb.exe 3508 inruwvobn.exe 5264 infumgnyd.exe 1232 incgzwjvl.exe 620 inortslka.exe 1432 incrjzdkv.exe 3392 infnwdvwr.exe 3100 inxrqyyst.exe 1552 inoavpdfe.exe 4912 inwsdlxsh.exe 1380 ingvnhoze.exe 3852 indhxkwmb.exe 5196 inpsutmlb.exe 5192 intfuikjc.exe 4328 inahuhbcs.exe 1348 innuocedv.exe 5984 insezthji.exe 544 infvypoww.exe 5872 inmeufqjy.exe 1856 inrdysgih.exe 4208 inmxiifwj.exe 2168 inpleqlxa.exe 4956 inljyapnv.exe 1780 ineybxzdp.exe 2876 inpqffxwb.exe 5976 injlxlxig.exe 1708 inmkxopbr.exe 3184 indskelwb.exe 5024 injyiwuqi.exe 1908 inhwnltjf.exe 5804 inadbobmd.exe 5320 intcrvwiy.exe 3012 inigtklnv.exe 2292 innlypqcs.exe 856 indwztgsi.exe 5632 iniizepdz.exe 5916 inwmpgfnn.exe 4576 inapnrseu.exe 3796 inmawkptn.exe 1092 injmdckxk.exe 2464 inzhuwqpq.exe - Loads dropped DLL 64 IoCs
pid Process 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe 5700 inwixlnmf.exe 5700 inwixlnmf.exe 2732 inzvgovkd.exe 2732 inzvgovkd.exe 4604 inldtepix.exe 4604 inldtepix.exe 5664 intpaiupe.exe 5664 intpaiupe.exe 1904 inbfyviuk.exe 1904 inbfyviuk.exe 6100 inmtnbdcu.exe 6100 inmtnbdcu.exe 5692 inbqiycju.exe 5692 inbqiycju.exe 4496 inwhpwale.exe 4496 inwhpwale.exe 5256 inlsmacbt.exe 5256 inlsmacbt.exe 4104 inaphxbit.exe 4104 inaphxbit.exe 2608 inxtemyti.exe 2608 inxtemyti.exe 2480 inxjymong.exe 2480 inxjymong.exe 5848 inknedlyl.exe 5848 inknedlyl.exe 3448 inuqbjvqf.exe 3448 inuqbjvqf.exe 1564 insbquvhx.exe 1564 insbquvhx.exe 4348 inzloqpih.exe 4348 inzloqpih.exe 2784 inogwahsa.exe 2784 inogwahsa.exe 5284 insvxwpco.exe 5284 insvxwpco.exe 4312 ineuxonvv.exe 4312 ineuxonvv.exe 5736 innqsrkjz.exe 5736 innqsrkjz.exe 4256 incanalcr.exe 4256 incanalcr.exe 1148 inbuxzyre.exe 1148 inbuxzyre.exe 4064 inixpjqgj.exe 4064 inixpjqgj.exe 3324 inqmfrmyb.exe 3324 inqmfrmyb.exe 3508 inruwvobn.exe 3508 inruwvobn.exe 5264 infumgnyd.exe 5264 infumgnyd.exe 1232 incgzwjvl.exe 1232 incgzwjvl.exe 620 inortslka.exe 620 inortslka.exe 1432 incrjzdkv.exe 1432 incrjzdkv.exe 3392 infnwdvwr.exe 3392 infnwdvwr.exe 3100 inxrqyyst.exe 3100 inxrqyyst.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inblsqhkm.exe intwamnoz.exe File created C:\Windows\SysWOW64\inycykdza.exe invdmeyvk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invqlrkwy.exe File created C:\Windows\SysWOW64\inrtkbsie.exe innvcvbrm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inngbnczn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat insvxwpco.exe File opened for modification C:\Windows\SysWOW64\inrmslxzd.exe_lang.ini inenraymu.exe File opened for modification C:\Windows\SysWOW64\inuwjozuo.exe_lang.ini infhfyusg.exe File created C:\Windows\SysWOW64\inwtwqazn.exe inczogbkc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inomzqrdt.exe File opened for modification C:\Windows\SysWOW64\infzzbyva.exe_lang.ini inocymrvp.exe File created C:\Windows\SysWOW64\inztkqidm.exe inrtwgusw.exe File created C:\Windows\SysWOW64\inrzweovz.exe inzrcejxv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmxdfsdw.exe File created C:\Windows\SysWOW64\inuqbjvqf.exe inknedlyl.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inaeepccp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inocymrvp.exe File created C:\Windows\SysWOW64\inhhujgdi.exe inkmpmynm.exe File opened for modification C:\Windows\SysWOW64\ineguxzcg.exe_lang.ini inpwglkgm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inycopaqa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwjfatav.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrcscxou.exe File opened for modification C:\Windows\SysWOW64\inpleqlxa.exe_lang.ini inmxiifwj.exe File opened for modification C:\Windows\SysWOW64\injausioy.exe_lang.ini inuaizlgb.exe File opened for modification C:\Windows\SysWOW64\inyxynpgc.exe_lang.ini invmsakfo.exe File opened for modification C:\Windows\SysWOW64\inijzqpfx.exe_lang.ini inilcbjwj.exe File created C:\Windows\SysWOW64\ingfvhjng.exe ingrakqpr.exe File opened for modification C:\Windows\SysWOW64\innfvgrkz.exe_lang.ini invgvfzue.exe File created C:\Windows\SysWOW64\infhfyusg.exe inwhxahtz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpxucmtx.exe File created C:\Windows\SysWOW64\inqgyjlgf.exe inpedtegi.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini injhulmow.exe File opened for modification C:\Windows\SysWOW64\infrgacrf.exe_lang.ini inzuolauz.exe File created C:\Windows\SysWOW64\indzleble.exe inebgydau.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invdmeyvk.exe File opened for modification C:\Windows\SysWOW64\inqzaupvo.exe_lang.ini inykmqjhq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingkycsra.exe File opened for modification C:\Windows\SysWOW64\indbxwxmz.exe_lang.ini inwtyvsvp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbpxnjbw.exe File opened for modification C:\Windows\SysWOW64\inlmnyysj.exe_lang.ini inlnqnzon.exe File opened for modification C:\Windows\SysWOW64\insbquvhx.exe_lang.ini inuqbjvqf.exe File opened for modification C:\Windows\SysWOW64\inscqyokc.exe_lang.ini inlofemzm.exe File created C:\Windows\SysWOW64\invlhtipl.exe inuydrpyf.exe File created C:\Windows\SysWOW64\inbnjcuis.exe infacmfam.exe File created C:\Windows\SysWOW64\inyoeaukm.exe injkrqgyq.exe File opened for modification C:\Windows\SysWOW64\inkxmjgli.exe_lang.ini inytozkkh.exe File created C:\Windows\SysWOW64\ineugyxhj.exe inuinrlrc.exe File created C:\Windows\SysWOW64\injvkjzkm.exe infzicqlp.exe File created C:\Windows\SysWOW64\inmzfdmqx.exe inhfbqsjb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkesnbrx.exe File created C:\Windows\SysWOW64\indhxkwmb.exe ingvnhoze.exe File created C:\Windows\SysWOW64\inpkvggzd.exe invqlrkwy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inthmqkqb.exe File created C:\Windows\SysWOW64\inhhsffsh.exe inivlaoql.exe File created C:\Windows\SysWOW64\inuwjozuo.exe infhfyusg.exe File created C:\Windows\SysWOW64\inugvjlkd.exe inxnqhgoo.exe File opened for modification C:\Windows\SysWOW64\inucuflpc.exe_lang.ini invecggre.exe File created C:\Windows\SysWOW64\iniqjgqjr.exe inixomukg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat iniqzgcyz.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuytzxmg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlubyhti.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbjdjvkm.exe File opened for modification C:\Windows\SysWOW64\innoaemue.exe_lang.ini inbjdjvkm.exe File opened for modification C:\Windows\SysWOW64\inxajcwrn.exe_lang.ini inuhmcksg.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomvcziu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incldxuje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inprouzhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuprejup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbuzcxoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuprpjqa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkhtihxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrqyyst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingkycsra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inixomukg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkvbdqbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlvgkyq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innqmfdal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inergdafx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infcnwrgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfsfaqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupkqjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intlkfhrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inucxmxol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyixbhg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoeaukm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inakrpgjz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indzyzoqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inihodrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxncqsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infsuonoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injzuzsez.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtgabri.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfdlthy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmvbdomc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incbrdfjw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzesqzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indrzpldy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbjudnts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inujlcwuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingrakqpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrjcgagg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infcwfnxi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injprzfoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invowdwcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqfeufhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmktaxgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuydrpyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzfdmqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkdbjsnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwjozuo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxshctsn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infqzujev.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaikwkwh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzewkdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljswfrz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inopkfvqb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwrmkgem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inortslka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invecggre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaouaylq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbsfowhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpeapdzu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpxucmtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingcowdkg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe 5700 inwixlnmf.exe 5700 inwixlnmf.exe 2732 inzvgovkd.exe 2732 inzvgovkd.exe 4604 inldtepix.exe 4604 inldtepix.exe 5664 intpaiupe.exe 5664 intpaiupe.exe 1904 inbfyviuk.exe 1904 inbfyviuk.exe 6100 inmtnbdcu.exe 6100 inmtnbdcu.exe 5692 inbqiycju.exe 5692 inbqiycju.exe 4496 inwhpwale.exe 4496 inwhpwale.exe 5256 inlsmacbt.exe 5256 inlsmacbt.exe 4104 inaphxbit.exe 4104 inaphxbit.exe 2608 inxtemyti.exe 2608 inxtemyti.exe 2480 inxjymong.exe 2480 inxjymong.exe 5848 inknedlyl.exe 5848 inknedlyl.exe 3448 inuqbjvqf.exe 3448 inuqbjvqf.exe 1564 insbquvhx.exe 1564 insbquvhx.exe 4348 inzloqpih.exe 4348 inzloqpih.exe 2784 inogwahsa.exe 2784 inogwahsa.exe 5284 insvxwpco.exe 5284 insvxwpco.exe 4312 ineuxonvv.exe 4312 ineuxonvv.exe 5736 innqsrkjz.exe 5736 innqsrkjz.exe 4256 incanalcr.exe 4256 incanalcr.exe 1148 inbuxzyre.exe 1148 inbuxzyre.exe 4064 inixpjqgj.exe 4064 inixpjqgj.exe 3324 inqmfrmyb.exe 3324 inqmfrmyb.exe 3508 inruwvobn.exe 3508 inruwvobn.exe 5264 infumgnyd.exe 5264 infumgnyd.exe 1232 incgzwjvl.exe 1232 incgzwjvl.exe 620 inortslka.exe 620 inortslka.exe 1432 incrjzdkv.exe 1432 incrjzdkv.exe 3392 infnwdvwr.exe 3392 infnwdvwr.exe 3100 inxrqyyst.exe 3100 inxrqyyst.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 5700 inwixlnmf.exe Token: SeDebugPrivilege 2732 inzvgovkd.exe Token: SeDebugPrivilege 4604 inldtepix.exe Token: SeDebugPrivilege 5664 intpaiupe.exe Token: SeDebugPrivilege 1904 inbfyviuk.exe Token: SeDebugPrivilege 6100 inmtnbdcu.exe Token: SeDebugPrivilege 5692 inbqiycju.exe Token: SeDebugPrivilege 4496 inwhpwale.exe Token: SeDebugPrivilege 5256 inlsmacbt.exe Token: SeDebugPrivilege 4104 inaphxbit.exe Token: SeDebugPrivilege 2608 inxtemyti.exe Token: SeDebugPrivilege 2480 inxjymong.exe Token: SeDebugPrivilege 5848 inknedlyl.exe Token: SeDebugPrivilege 3448 inuqbjvqf.exe Token: SeDebugPrivilege 1564 insbquvhx.exe Token: SeDebugPrivilege 4348 inzloqpih.exe Token: SeDebugPrivilege 2784 inogwahsa.exe Token: SeDebugPrivilege 5284 insvxwpco.exe Token: SeDebugPrivilege 4312 ineuxonvv.exe Token: SeDebugPrivilege 5736 innqsrkjz.exe Token: SeDebugPrivilege 4256 incanalcr.exe Token: SeDebugPrivilege 1148 inbuxzyre.exe Token: SeDebugPrivilege 4064 inixpjqgj.exe Token: SeDebugPrivilege 3324 inqmfrmyb.exe Token: SeDebugPrivilege 3508 inruwvobn.exe Token: SeDebugPrivilege 5264 infumgnyd.exe Token: SeDebugPrivilege 1232 incgzwjvl.exe Token: SeDebugPrivilege 620 inortslka.exe Token: SeDebugPrivilege 1432 incrjzdkv.exe Token: SeDebugPrivilege 3392 infnwdvwr.exe Token: SeDebugPrivilege 3100 inxrqyyst.exe Token: SeDebugPrivilege 1552 inoavpdfe.exe Token: SeDebugPrivilege 4912 inwsdlxsh.exe Token: SeDebugPrivilege 1380 ingvnhoze.exe Token: SeDebugPrivilege 3852 indhxkwmb.exe Token: SeDebugPrivilege 5196 inpsutmlb.exe Token: SeDebugPrivilege 5192 intfuikjc.exe Token: SeDebugPrivilege 4328 inahuhbcs.exe Token: SeDebugPrivilege 1348 innuocedv.exe Token: SeDebugPrivilege 5984 insezthji.exe Token: SeDebugPrivilege 544 infvypoww.exe Token: SeDebugPrivilege 5872 inmeufqjy.exe Token: SeDebugPrivilege 1856 inrdysgih.exe Token: SeDebugPrivilege 4208 inmxiifwj.exe Token: SeDebugPrivilege 2168 inpleqlxa.exe Token: SeDebugPrivilege 4956 inljyapnv.exe Token: SeDebugPrivilege 1780 ineybxzdp.exe Token: SeDebugPrivilege 2876 inpqffxwb.exe Token: SeDebugPrivilege 5976 injlxlxig.exe Token: SeDebugPrivilege 1708 inmkxopbr.exe Token: SeDebugPrivilege 3184 indskelwb.exe Token: SeDebugPrivilege 5024 injyiwuqi.exe Token: SeDebugPrivilege 1908 inhwnltjf.exe Token: SeDebugPrivilege 5804 inadbobmd.exe Token: SeDebugPrivilege 5320 intcrvwiy.exe Token: SeDebugPrivilege 3012 inigtklnv.exe Token: SeDebugPrivilege 2292 innlypqcs.exe Token: SeDebugPrivilege 856 indwztgsi.exe Token: SeDebugPrivilege 5632 iniizepdz.exe Token: SeDebugPrivilege 5916 inwmpgfnn.exe Token: SeDebugPrivilege 4576 inapnrseu.exe Token: SeDebugPrivilege 3796 inmawkptn.exe Token: SeDebugPrivilege 1092 injmdckxk.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe 5700 inwixlnmf.exe 2732 inzvgovkd.exe 4604 inldtepix.exe 5664 intpaiupe.exe 1904 inbfyviuk.exe 6100 inmtnbdcu.exe 5692 inbqiycju.exe 4496 inwhpwale.exe 5256 inlsmacbt.exe 4104 inaphxbit.exe 2608 inxtemyti.exe 2480 inxjymong.exe 5848 inknedlyl.exe 3448 inuqbjvqf.exe 1564 insbquvhx.exe 4348 inzloqpih.exe 2784 inogwahsa.exe 5284 insvxwpco.exe 4312 ineuxonvv.exe 5736 innqsrkjz.exe 4256 incanalcr.exe 1148 inbuxzyre.exe 4064 inixpjqgj.exe 3324 inqmfrmyb.exe 3508 inruwvobn.exe 5264 infumgnyd.exe 1232 incgzwjvl.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5768 wrote to memory of 5700 5768 2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe 88 PID 5700 wrote to memory of 2732 5700 inwixlnmf.exe 89 PID 2732 wrote to memory of 4604 2732 inzvgovkd.exe 90 PID 4604 wrote to memory of 5664 4604 inldtepix.exe 91 PID 5664 wrote to memory of 1904 5664 intpaiupe.exe 92 PID 1904 wrote to memory of 6100 1904 inbfyviuk.exe 93 PID 6100 wrote to memory of 5692 6100 inmtnbdcu.exe 94 PID 5692 wrote to memory of 4496 5692 inbqiycju.exe 95 PID 4496 wrote to memory of 5256 4496 inwhpwale.exe 96 PID 5256 wrote to memory of 4104 5256 inlsmacbt.exe 97 PID 4104 wrote to memory of 2608 4104 inaphxbit.exe 98 PID 2608 wrote to memory of 2480 2608 inxtemyti.exe 99 PID 2480 wrote to memory of 5848 2480 inxjymong.exe 100 PID 5848 wrote to memory of 3448 5848 inknedlyl.exe 101 PID 3448 wrote to memory of 1564 3448 inuqbjvqf.exe 102 PID 1564 wrote to memory of 4348 1564 insbquvhx.exe 103 PID 4348 wrote to memory of 2784 4348 inzloqpih.exe 104 PID 2784 wrote to memory of 5284 2784 inogwahsa.exe 105 PID 5284 wrote to memory of 4312 5284 insvxwpco.exe 106 PID 4312 wrote to memory of 5736 4312 ineuxonvv.exe 107 PID 5736 wrote to memory of 4256 5736 innqsrkjz.exe 108 PID 4256 wrote to memory of 1148 4256 incanalcr.exe 109 PID 1148 wrote to memory of 4064 1148 inbuxzyre.exe 110 PID 4064 wrote to memory of 3324 4064 inixpjqgj.exe 111 PID 3324 wrote to memory of 3508 3324 inqmfrmyb.exe 112 PID 3508 wrote to memory of 5264 3508 inruwvobn.exe 113 PID 5264 wrote to memory of 1232 5264 infumgnyd.exe 114 PID 1232 wrote to memory of 620 1232 incgzwjvl.exe 115 PID 620 wrote to memory of 1432 620 inortslka.exe 116 PID 1432 wrote to memory of 3392 1432 incrjzdkv.exe 117 PID 3392 wrote to memory of 3100 3392 infnwdvwr.exe 118 PID 3100 wrote to memory of 1552 3100 inxrqyyst.exe 119 PID 1552 wrote to memory of 4912 1552 inoavpdfe.exe 120 PID 4912 wrote to memory of 1380 4912 inwsdlxsh.exe 121 PID 1380 wrote to memory of 3852 1380 ingvnhoze.exe 122 PID 3852 wrote to memory of 5196 3852 indhxkwmb.exe 123 PID 5196 wrote to memory of 5192 5196 inpsutmlb.exe 124 PID 5192 wrote to memory of 4328 5192 intfuikjc.exe 125 PID 4328 wrote to memory of 1348 4328 inahuhbcs.exe 126 PID 1348 wrote to memory of 5984 1348 innuocedv.exe 127 PID 5984 wrote to memory of 544 5984 insezthji.exe 128 PID 544 wrote to memory of 5872 544 infvypoww.exe 129 PID 5872 wrote to memory of 1856 5872 inmeufqjy.exe 130 PID 1856 wrote to memory of 4208 1856 inrdysgih.exe 131 PID 4208 wrote to memory of 2168 4208 inmxiifwj.exe 132 PID 2168 wrote to memory of 4956 2168 inpleqlxa.exe 133 PID 4956 wrote to memory of 1780 4956 inljyapnv.exe 134 PID 1780 wrote to memory of 2876 1780 ineybxzdp.exe 135 PID 2876 wrote to memory of 5976 2876 inpqffxwb.exe 136 PID 5976 wrote to memory of 1708 5976 injlxlxig.exe 137 PID 1708 wrote to memory of 3184 1708 inmkxopbr.exe 138 PID 3184 wrote to memory of 5024 3184 indskelwb.exe 139 PID 5024 wrote to memory of 1908 5024 injyiwuqi.exe 140 PID 1908 wrote to memory of 5804 1908 inhwnltjf.exe 141 PID 5804 wrote to memory of 5320 5804 inadbobmd.exe 142 PID 5320 wrote to memory of 3012 5320 intcrvwiy.exe 143 PID 3012 wrote to memory of 2292 3012 inigtklnv.exe 144 PID 2292 wrote to memory of 856 2292 innlypqcs.exe 145 PID 856 wrote to memory of 5632 856 indwztgsi.exe 146 PID 5632 wrote to memory of 5916 5632 iniizepdz.exe 147 PID 5916 wrote to memory of 4576 5916 inwmpgfnn.exe 148 PID 4576 wrote to memory of 3796 4576 inapnrseu.exe 149 PID 3796 wrote to memory of 1092 3796 inmawkptn.exe 150 PID 1092 wrote to memory of 2464 1092 injmdckxk.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_71721f430ee4d8902a536ea6086e21a9_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe16⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe20⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\inxrqyyst.exeC:\Windows\system32\inxrqyyst.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe33⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe45⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe47⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\injyiwuqi.exeC:\Windows\system32\injyiwuqi.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\iniizepdz.exeC:\Windows\system32\iniizepdz.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\inzhuwqpq.exeC:\Windows\system32\inzhuwqpq.exe65⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe66⤵
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe67⤵
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe68⤵
- Drops file in System32 directory
PID:2972 -
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe69⤵PID:4908
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe70⤵PID:4820
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe71⤵PID:2516
-
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe72⤵PID:5964
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe73⤵PID:1424
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe74⤵PID:3552
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe75⤵PID:2324
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe76⤵PID:2556
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe77⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4300 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe78⤵PID:5744
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe79⤵PID:4812
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe80⤵PID:3204
-
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe81⤵PID:2956
-
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe82⤵
- Drops file in System32 directory
PID:1860 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe83⤵PID:2148
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\system32\ingerepgv.exe84⤵PID:1428
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe85⤵PID:2976
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe86⤵PID:1720
-
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe87⤵PID:6124
-
C:\Windows\SysWOW64\insaljfpw.exeC:\Windows\system32\insaljfpw.exe88⤵PID:1500
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe89⤵PID:2928
-
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe90⤵PID:2620
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe91⤵PID:6104
-
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe92⤵PID:5780
-
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe93⤵PID:6044
-
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe94⤵PID:4504
-
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe95⤵PID:2300
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe96⤵PID:3592
-
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1140 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe98⤵PID:4108
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe99⤵PID:1528
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\system32\inxnqhgoo.exe100⤵
- Drops file in System32 directory
PID:4124 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe101⤵PID:4880
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe102⤵PID:5308
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe103⤵PID:4276
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe104⤵PID:5784
-
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe105⤵PID:4488
-
C:\Windows\SysWOW64\inlgwrccv.exeC:\Windows\system32\inlgwrccv.exe106⤵PID:4928
-
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe107⤵PID:5728
-
C:\Windows\SysWOW64\inbfffozj.exeC:\Windows\system32\inbfffozj.exe108⤵PID:2700
-
C:\Windows\SysWOW64\inghxondz.exeC:\Windows\system32\inghxondz.exe109⤵PID:4560
-
C:\Windows\SysWOW64\inxitdtqe.exeC:\Windows\system32\inxitdtqe.exe110⤵PID:5996
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe111⤵PID:4588
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe112⤵PID:4980
-
C:\Windows\SysWOW64\inmhxsddw.exeC:\Windows\system32\inmhxsddw.exe113⤵PID:4500
-
C:\Windows\SysWOW64\inuloqrtx.exeC:\Windows\system32\inuloqrtx.exe114⤵PID:5704
-
C:\Windows\SysWOW64\innswqwhw.exeC:\Windows\system32\innswqwhw.exe115⤵PID:1956
-
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe116⤵PID:2588
-
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe117⤵PID:2948
-
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe118⤵PID:2720
-
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe119⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4796 -
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe120⤵
- Drops file in System32 directory
PID:3620 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe121⤵PID:988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-