Analysis
- max time kernel
83s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:00
Behavioral task
behavioral1
Sample
2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260718-bctmdaez8y
- SHA256 2c628d6e26905ff8d183e2b8e181500b11805086b3fcc33b23dc6cb27f1b937e
- MD5 6fa96213a6facda9b81d73762fd383da
- SHA1 ae78287441b5076534c404062cddd9489ec37475
- SHA512 cc8fc1b4f01de71bcc6969896e5640b4b660441f476c93c4ed99760ab3f25c7aa7b93bd8b863dbf64f1d7cc1ea35be77465fc1b84a4bd9066047a45bd035dbd7
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTu:RPjOa1NxyYtH1u
- TLSH T1E915AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/3360-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c61f-20.dat family_gh0strat behavioral2/memory/3360-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c624-32.dat family_gh0strat behavioral2/files/0x000c00000001c625-40.dat family_gh0strat behavioral2/memory/2860-45-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c628-67.dat family_gh0strat behavioral2/memory/1448-71-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3104-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c62c-88.dat family_gh0strat behavioral2/memory/1448-91-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c631-110.dat family_gh0strat behavioral2/memory/1520-114-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c635-133.dat family_gh0strat behavioral2/memory/2216-137-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c63a-156.dat family_gh0strat behavioral2/files/0x000c00000001c63e-177.dat family_gh0strat behavioral2/memory/3380-182-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c643-200.dat family_gh0strat behavioral2/memory/832-226-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c650-265.dat family_gh0strat behavioral2/memory/4152-292-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c659-310.dat family_gh0strat behavioral2/memory/3044-484-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4860-610-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1236-592-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1476-574-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5672-556-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2576-538-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4372-520-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5760-502-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1568-466-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/444-447-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3244-429-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4264-412-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4480-394-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/940-376-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1192-358-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c662-354.dat family_gh0strat behavioral2/memory/4872-336-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c65e-332.dat family_gh0strat behavioral2/memory/5668-314-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c655-288.dat family_gh0strat behavioral2/memory/5420-270-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2060-248-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c64c-244.dat family_gh0strat behavioral2/files/0x000c00000001c647-222.dat family_gh0strat behavioral2/memory/5968-204-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2432-160-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5DFE6E5-DF2C-4c5a-ACC2-6BEFE0AB6EDD}\stubpath = "C:\\Windows\\system32\\inpbwqegf.exe" ingvetxyk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9E2AC82-D36B-4dde-8828-E1939E1EE062}\stubpath = "C:\\Windows\\system32\\inonisjqf.exe" inoxlbteg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7DB00BAC-F853-4cfb-B0BB-ACF58555AE72}\stubpath = "C:\\Windows\\system32\\ingphynie.exe" inaeepccp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1007653C-0FC4-4412-B15D-64903731426F} invspsmvj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF5965BF-4260-4cb9-AC9C-451F6B552A06} inumafjdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3978C27E-DA8B-4761-B860-4AB65F8C64CF}\stubpath = "C:\\Windows\\system32\\intmsjkwc.exe" inhegsgsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAF96102-5C22-4c61-B21C-3AB61F3C62DB} inaivxrqr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73EA5E5E-3CAD-4e7b-87A4-9FF29E364A95} ingfvhjng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D029EDDD-2D46-459e-BBF9-8CC000629294} ingyagyjp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BE68E655-4E12-4216-90AA-0F281ABB883A} inhngmkjz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F64C6713-ABBD-4843-AEE2-DC14FE7B1E58} inzuolauz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3B10DD68-27F1-49c8-927D-A7F59FDA1E8F} inmtnbdcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ABDBB16C-006C-4834-8CCF-34CE214394AF}\stubpath = "C:\\Windows\\system32\\inortslka.exe" inxjymong.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1CBEE803-EF16-402f-B632-0C89162B4CCD} inniombtb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7C7E3FE-B341-46cb-8125-5ECEA672BAE1} inckscbjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{96A1254F-B697-4837-8D9B-B0D36B5549D3}\stubpath = "C:\\Windows\\system32\\inueaqidm.exe" inniucjdf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A42FB7D6-32BC-4539-8DAA-67089CAD9362} inrjcgagg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B7F83FFC-F308-4529-A1DE-69559EE313CE} inqfeufhj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C3B01490-EFA6-4447-B0CB-7F4A5B802881}\stubpath = "C:\\Windows\\system32\\inncprues.exe" incbzwztd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B145D56-05EB-4b28-9835-B60B0261339B} injqftzfq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{001A1606-5204-49a0-800D-C8346EEDD4E9} inhhujgdi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{937E6BDB-C433-48c5-BF46-B6ADF2C19F23} invzesqzg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB26E3E8-1AD2-4624-A750-9A93994D7DE1}\stubpath = "C:\\Windows\\system32\\inuiybnpg.exe" inhztqfaz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9A19CE05-467F-4646-9368-6483752A9EC1}\stubpath = "C:\\Windows\\system32\\inlcfvhzy.exe" incgncjih.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{78884826-7211-438b-B387-CE8DA286950B} infmbpvbz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68837942-7F78-491a-B7F8-A94B030100A6}\stubpath = "C:\\Windows\\system32\\inlhpjpqs.exe" infjxbrqx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B63929B1-1D24-4eff-B543-E9C54F185065}\stubpath = "C:\\Windows\\system32\\inrbrocsh.exe" inyvsxuru.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8145C3F0-0E5C-42c1-94C5-349A70CECCA9} inhpdyhbh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D053C6E7-E553-4f0f-BAF9-AED171AAEC50}\stubpath = "C:\\Windows\\system32\\innoaemue.exe" invqlrkwy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C836A9E6-080B-4890-A6C6-84D2A3798EA4}\stubpath = "C:\\Windows\\system32\\inyegtexf.exe" infbnvcjf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24B4B9F8-51A0-482b-946D-C0AAD1B1E15E} intsuvkkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09ECF290-70DE-4614-82D0-AAFEC376C3EE} innpclapa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4CC96EE-CE44-441b-8C2D-7931D894FBFC}\stubpath = "C:\\Windows\\system32\\invgvfzue.exe" invlbrhjx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79EADA7C-E63C-426d-8A91-CEA3EB7009C6} inrvqwujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F1C4D13-D726-4bb1-A1E3-8452BF513675}\stubpath = "C:\\Windows\\system32\\inqgyjlgf.exe" inlgphgbd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E2618E37-2D71-4006-823C-B89626B20E17}\stubpath = "C:\\Windows\\system32\\ingatvyvf.exe" incsnrmiw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1FA0E97-9610-49f3-8460-42FA19E26C4F}\stubpath = "C:\\Windows\\system32\\infrfqjpo.exe" injidfpid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{707DF38F-79FA-4a1f-A74C-D293011350E5} inzuwcuov.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAEF0085-E458-44e6-9AE6-B15117D54692}\stubpath = "C:\\Windows\\system32\\inwhpwale.exe" inomzqrdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B75815C-A625-4af3-A4F4-ACDBF7E39FB6}\stubpath = "C:\\Windows\\system32\\injkrqgyq.exe" incgzwjvl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D69D566-03E0-4a02-8CBF-6050DE8F2F40} inwikohfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0BCBDC3D-C0D0-4adc-A0EF-AB8DCAD51DCE}\stubpath = "C:\\Windows\\system32\\inilcbjwj.exe" intxcqoxe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3DCACB2-61F6-4ac8-8EB1-3AB923255E69} inmlwcerc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C864E212-8EB1-40bb-89E4-1D8000BE3899} inztkqidm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7D983E5-B40A-453e-9FC4-BC68D3D61024} intglbjrf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{097DE7B1-ACAE-46a8-BB89-ED6270BBCA35} inrcscxou.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E502DDC-B5DB-4752-A9F3-A8128CF14AD1} inefvmlzb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9728B296-AB14-4d8e-924E-50187E43EC7E} inatybwnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33EA75D5-A9BD-4209-A55B-F3F1D5AF2B05} inzzjgeaz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65D921C6-7648-443d-8C0A-66F1DE6EC187}\stubpath = "C:\\Windows\\system32\\inhztqfaz.exe" inmwcesvx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD6BC348-BAC2-4a0b-AE6C-701A363929AC} indeoeuxa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA5EBF2A-AC45-48e0-BC5C-AACDB8C47A34} inpfkwncn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E180CFDD-2D11-4eb0-A68E-E0449153B850}\stubpath = "C:\\Windows\\system32\\inruwvobn.exe" inykznpoh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26F94F67-A2E1-48b0-91C6-2023EB900D5F}\stubpath = "C:\\Windows\\system32\\inhxjlpig.exe" inbjudnts.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{29DF72B7-5393-4a25-B899-267A31A59004} inkmpnlpp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C8E15FFB-F1E9-4ee0-B452-C2D3A99C2579}\stubpath = "C:\\Windows\\system32\\inmsevrki.exe" injgpuugv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B69F9BF6-32E8-47b6-AA76-FE4190161973}\stubpath = "C:\\Windows\\system32\\inbjdjvkm.exe" insfkvqkr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{017D17EE-4131-4a39-9567-615006A52905} inlmnyysj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4E76848-7590-4575-B04D-5A6D1514CF7F} innfajbav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EF7052FB-1ABE-4ba7-BC3B-1310B9C3D251}\stubpath = "C:\\Windows\\system32\\insbquvhx.exe" inmhxsddw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47288A8D-531F-4c8f-9713-1CEEF1E1BFA4} inzhpyfbx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A973ACE9-120F-4ffb-B5FB-8185AC67583B} inwtyvsvp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C386AFD2-2600-4df3-B4D4-4E604591AB7A}\stubpath = "C:\\Windows\\system32\\iniqgcwmo.exe" inlisltat.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E9C2A67-50E7-4aea-B474-1E95FEF4ED9E} inffruvhe.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000019caa-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 2860 insohtodl.exe 3104 inwixlnmf.exe 1448 inaexuhtj.exe 1520 inykznpoh.exe 2216 inruwvobn.exe 2432 inrdysgih.exe 3380 ingiuiufd.exe 5968 innqsrkjz.exe 832 invrckwrg.exe 2060 inqjpgzht.exe 5420 inqmfrmyb.exe 4152 indxawycz.exe 5668 invhwkmle.exe 4872 inmeufqjy.exe 1192 incrjzdkv.exe 940 inzvgovkd.exe 4480 inmtnbdcu.exe 4264 inbqiycju.exe 3244 ingvnhoze.exe 444 intsuvkkg.exe 1568 inqcxrfhg.exe 3044 inhsblrqs.exe 5760 inmprqjiy.exe 4372 inomzqrdt.exe 2576 inwhpwale.exe 5672 inknedlyl.exe 1476 inadbobmd.exe 1236 inhwoipfi.exe 4860 inogwahsa.exe 3288 intfuikjc.exe 204 injyqkarh.exe 4628 innfvgrkz.exe 584 indskelwb.exe 4284 inixpjqgj.exe 1104 innuocedv.exe 124 insezthji.exe 2080 inxjymong.exe 4864 inortslka.exe 3848 inxtemyti.exe 3180 inyjbrycn.exe 2264 inljyapnv.exe 1148 inwsdlxsh.exe 4440 ineuxonvv.exe 1608 inlsmacbt.exe 4120 inyorihpp.exe 5888 inuydrpyf.exe 968 injhulmow.exe 632 inbjwysrs.exe 6044 intcrvwiy.exe 4348 inutvwllh.exe 5228 inatwyxqd.exe 2252 ingtgabri.exe 1196 inpleqlxa.exe 1068 inuqbjvqf.exe 1268 inbrulkss.exe 2572 inkbaivic.exe 5364 inoavpdfe.exe 240 inniyteex.exe 3500 ingoxeawx.exe 1124 inertnmni.exe 4696 inocokdvj.exe 3940 indtwnmuu.exe 3736 inkzrlbas.exe 4464 inlhzufqa.exe - Loads dropped DLL 64 IoCs
pid Process 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe 2860 insohtodl.exe 2860 insohtodl.exe 3104 inwixlnmf.exe 3104 inwixlnmf.exe 1448 inaexuhtj.exe 1448 inaexuhtj.exe 1520 inykznpoh.exe 1520 inykznpoh.exe 2216 inruwvobn.exe 2216 inruwvobn.exe 2432 inrdysgih.exe 2432 inrdysgih.exe 3380 ingiuiufd.exe 3380 ingiuiufd.exe 5968 innqsrkjz.exe 5968 innqsrkjz.exe 832 invrckwrg.exe 832 invrckwrg.exe 2060 inqjpgzht.exe 2060 inqjpgzht.exe 5420 inqmfrmyb.exe 5420 inqmfrmyb.exe 4152 indxawycz.exe 4152 indxawycz.exe 5668 invhwkmle.exe 5668 invhwkmle.exe 4872 inmeufqjy.exe 4872 inmeufqjy.exe 1192 incrjzdkv.exe 1192 incrjzdkv.exe 940 inzvgovkd.exe 940 inzvgovkd.exe 4480 inmtnbdcu.exe 4480 inmtnbdcu.exe 4264 inbqiycju.exe 4264 inbqiycju.exe 3244 ingvnhoze.exe 3244 ingvnhoze.exe 444 intsuvkkg.exe 444 intsuvkkg.exe 1568 inqcxrfhg.exe 1568 inqcxrfhg.exe 3044 inhsblrqs.exe 3044 inhsblrqs.exe 5760 inmprqjiy.exe 5760 inmprqjiy.exe 4372 inomzqrdt.exe 4372 inomzqrdt.exe 2576 inwhpwale.exe 2576 inwhpwale.exe 5672 inknedlyl.exe 5672 inknedlyl.exe 1476 inadbobmd.exe 1476 inadbobmd.exe 1236 inhwoipfi.exe 1236 inhwoipfi.exe 4860 inogwahsa.exe 4860 inogwahsa.exe 3288 intfuikjc.exe 3288 intfuikjc.exe 204 injyqkarh.exe 204 injyqkarh.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat incgncjih.exe File created C:\Windows\SysWOW64\ineugyxhj.exe inkwblfyk.exe File created C:\Windows\SysWOW64\inoropope.exe invirzkie.exe File opened for modification C:\Windows\SysWOW64\inwonikuc.exe_lang.ini inpdimgmm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpdlvxfh.exe File created C:\Windows\SysWOW64\inorbpnrr.exe inwpkmkez.exe File created C:\Windows\SysWOW64\inibjtjzf.exe indkntxkp.exe File opened for modification C:\Windows\SysWOW64\inadlmaxb.exe_lang.ini inanbwzzr.exe File opened for modification C:\Windows\SysWOW64\injyixbhg.exe_lang.ini infudswxj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwonikuc.exe File opened for modification C:\Windows\SysWOW64\inibjtjzf.exe_lang.ini indkntxkp.exe File created C:\Windows\SysWOW64\inpiqqmhr.exe inffruvhe.exe File created C:\Windows\SysWOW64\inmgmynpz.exe inonisjqf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intetdxsy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat intwamnoz.exe File opened for modification C:\Windows\SysWOW64\inqfmalkm.exe_lang.ini inmzesqny.exe File opened for modification C:\Windows\SysWOW64\inykznpoh.exe_lang.ini inaexuhtj.exe File opened for modification C:\Windows\SysWOW64\ingatvyvf.exe_lang.ini incsnrmiw.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqswbpnw.exe File created C:\Windows\SysWOW64\inhbuwzwg.exe insbznvcp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzuwcuov.exe File created C:\Windows\SysWOW64\inmtnbdcu.exe inzvgovkd.exe File opened for modification C:\Windows\SysWOW64\inwhpwale.exe_lang.ini inomzqrdt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqklaasr.exe File opened for modification C:\Windows\SysWOW64\inzfhvydh.exe_lang.ini inaxvzzdx.exe File created C:\Windows\SysWOW64\intwamnoz.exe invdmeyvk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inilftocs.exe File opened for modification C:\Windows\SysWOW64\invawifmu.exe_lang.ini inrvvttvs.exe File created C:\Windows\SysWOW64\indkntxkp.exe inzolinkh.exe File created C:\Windows\SysWOW64\innfvgrkz.exe injyqkarh.exe File opened for modification C:\Windows\SysWOW64\inpwglkgm.exe_lang.ini inibjtjzf.exe File opened for modification C:\Windows\SysWOW64\inzzjgeaz.exe_lang.ini inzfhvydh.exe File created C:\Windows\SysWOW64\inueaqidm.exe inniucjdf.exe File opened for modification C:\Windows\SysWOW64\inedyzakd.exe_lang.ini inrbvqwap.exe File created C:\Windows\SysWOW64\insahbdsg.exe inzavthnp.exe File opened for modification C:\Windows\SysWOW64\inxqlnlfy.exe_lang.ini inwanaevl.exe File created C:\Windows\SysWOW64\inaeepccp.exe invpwbqbc.exe File opened for modification C:\Windows\SysWOW64\inmprqjiy.exe_lang.ini inhsblrqs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyorihpp.exe File opened for modification C:\Windows\SysWOW64\indhxkwmb.exe_lang.ini inmnccutj.exe File created C:\Windows\SysWOW64\inowmiavg.exe inhhujgdi.exe File created C:\Windows\SysWOW64\inbwxiybi.exe inhyqlaum.exe File opened for modification C:\Windows\SysWOW64\inivlaoql.exe_lang.ini inwezaozq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzbahzkq.exe File opened for modification C:\Windows\SysWOW64\inooxsntm.exe_lang.ini inasgqvzt.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkdbjsnc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inczogbkc.exe File created C:\Windows\SysWOW64\inkwlklan.exe inokiqcye.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmtnbdcu.exe File created C:\Windows\SysWOW64\ingtgabri.exe inatwyxqd.exe File created C:\Windows\SysWOW64\inucuflpc.exe inmrhdpxe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat ingcowdkg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inmeufqjy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inixomukg.exe File opened for modification C:\Windows\SysWOW64\inmrhdpxe.exe_lang.ini inbuzcxoc.exe File opened for modification C:\Windows\SysWOW64\indkgfezw.exe_lang.ini invpovkyk.exe File created C:\Windows\SysWOW64\inyteppma.exe inytozkkh.exe File opened for modification C:\Windows\SysWOW64\inokbwlsa.exe_lang.ini intuwvzao.exe File created C:\Windows\SysWOW64\inmzesqny.exe inlbjrbai.exe File created C:\Windows\SysWOW64\inkvbdqbu.exe insahbdsg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkvbdqbu.exe File created C:\Windows\SysWOW64\inilcbjwj.exe intxcqoxe.exe File created C:\Windows\SysWOW64\iniqjgqjr.exe infsuonoj.exe File created C:\Windows\SysWOW64\inytozkkh.exe inyccnaan.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invrckwrg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inecpcnet.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infvypoww.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmktaxgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infbnevol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebmvqfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrwawibx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgphgbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insuknjca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incvyzsfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfyviuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkxmjgli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injgpuugv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infqlxfmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intchxupt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkvbdqbu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrshhzyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyccnaan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invwyxcqk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intfwsljg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inedyzakd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzbfsfjq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhnqivx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbxslgig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insvxwpco.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyaereiz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgispe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlentqqz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhfyusg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxkpvpwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indlyubtu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inetlfmxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlofemzm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbhrywnq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxgaoyjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqesbyaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inigtklnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infudswxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoxdfqoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inncprues.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzfhvydh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzesqzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intglbjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrnisxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaxvzzdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhpdyhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineupaato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtkzjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inisglpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intlkfhrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmzfdmqx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inazpsjiq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inochlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incehxwfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqswbpnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkietvme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwpkmkez.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmsuirlm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwnoaqy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incqysiyz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inivlaoql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyljidn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innqsqpku.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwoipfi.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe 2860 insohtodl.exe 2860 insohtodl.exe 3104 inwixlnmf.exe 3104 inwixlnmf.exe 1448 inaexuhtj.exe 1448 inaexuhtj.exe 1520 inykznpoh.exe 1520 inykznpoh.exe 2216 inruwvobn.exe 2216 inruwvobn.exe 2432 inrdysgih.exe 2432 inrdysgih.exe 3380 ingiuiufd.exe 3380 ingiuiufd.exe 5968 innqsrkjz.exe 5968 innqsrkjz.exe 832 invrckwrg.exe 832 invrckwrg.exe 2060 inqjpgzht.exe 2060 inqjpgzht.exe 5420 inqmfrmyb.exe 5420 inqmfrmyb.exe 4152 indxawycz.exe 4152 indxawycz.exe 5668 invhwkmle.exe 5668 invhwkmle.exe 4872 inmeufqjy.exe 4872 inmeufqjy.exe 1192 incrjzdkv.exe 1192 incrjzdkv.exe 940 inzvgovkd.exe 940 inzvgovkd.exe 4480 inmtnbdcu.exe 4480 inmtnbdcu.exe 4264 inbqiycju.exe 4264 inbqiycju.exe 3244 ingvnhoze.exe 3244 ingvnhoze.exe 444 intsuvkkg.exe 444 intsuvkkg.exe 1568 inqcxrfhg.exe 1568 inqcxrfhg.exe 3044 inhsblrqs.exe 3044 inhsblrqs.exe 5760 inmprqjiy.exe 5760 inmprqjiy.exe 4372 inomzqrdt.exe 4372 inomzqrdt.exe 2576 inwhpwale.exe 2576 inwhpwale.exe 5672 inknedlyl.exe 5672 inknedlyl.exe 1476 inadbobmd.exe 1476 inadbobmd.exe 1236 inhwoipfi.exe 1236 inhwoipfi.exe 4860 inogwahsa.exe 4860 inogwahsa.exe 3288 intfuikjc.exe 3288 intfuikjc.exe 204 injyqkarh.exe 204 injyqkarh.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 2860 insohtodl.exe Token: SeDebugPrivilege 3104 inwixlnmf.exe Token: SeDebugPrivilege 1448 inaexuhtj.exe Token: SeDebugPrivilege 1520 inykznpoh.exe Token: SeDebugPrivilege 2216 inruwvobn.exe Token: SeDebugPrivilege 2432 inrdysgih.exe Token: SeDebugPrivilege 3380 ingiuiufd.exe Token: SeDebugPrivilege 5968 innqsrkjz.exe Token: SeDebugPrivilege 832 invrckwrg.exe Token: SeDebugPrivilege 2060 inqjpgzht.exe Token: SeDebugPrivilege 5420 inqmfrmyb.exe Token: SeDebugPrivilege 4152 indxawycz.exe Token: SeDebugPrivilege 5668 invhwkmle.exe Token: SeDebugPrivilege 4872 inmeufqjy.exe Token: SeDebugPrivilege 1192 incrjzdkv.exe Token: SeDebugPrivilege 940 inzvgovkd.exe Token: SeDebugPrivilege 4480 inmtnbdcu.exe Token: SeDebugPrivilege 4264 inbqiycju.exe Token: SeDebugPrivilege 3244 ingvnhoze.exe Token: SeDebugPrivilege 444 intsuvkkg.exe Token: SeDebugPrivilege 1568 inqcxrfhg.exe Token: SeDebugPrivilege 3044 inhsblrqs.exe Token: SeDebugPrivilege 5760 inmprqjiy.exe Token: SeDebugPrivilege 4372 inomzqrdt.exe Token: SeDebugPrivilege 2576 inwhpwale.exe Token: SeDebugPrivilege 5672 inknedlyl.exe Token: SeDebugPrivilege 1476 inadbobmd.exe Token: SeDebugPrivilege 1236 inhwoipfi.exe Token: SeDebugPrivilege 4860 inogwahsa.exe Token: SeDebugPrivilege 3288 intfuikjc.exe Token: SeDebugPrivilege 204 injyqkarh.exe Token: SeDebugPrivilege 4628 innfvgrkz.exe Token: SeDebugPrivilege 584 indskelwb.exe Token: SeDebugPrivilege 4284 inixpjqgj.exe Token: SeDebugPrivilege 1104 innuocedv.exe Token: SeDebugPrivilege 124 insezthji.exe Token: SeDebugPrivilege 2080 inxjymong.exe Token: SeDebugPrivilege 4864 inortslka.exe Token: SeDebugPrivilege 3848 inxtemyti.exe Token: SeDebugPrivilege 3180 inyjbrycn.exe Token: SeDebugPrivilege 2264 inljyapnv.exe Token: SeDebugPrivilege 1148 inwsdlxsh.exe Token: SeDebugPrivilege 4440 ineuxonvv.exe Token: SeDebugPrivilege 1608 inlsmacbt.exe Token: SeDebugPrivilege 4120 inyorihpp.exe Token: SeDebugPrivilege 5888 inuydrpyf.exe Token: SeDebugPrivilege 968 injhulmow.exe Token: SeDebugPrivilege 632 inbjwysrs.exe Token: SeDebugPrivilege 6044 intcrvwiy.exe Token: SeDebugPrivilege 4348 inutvwllh.exe Token: SeDebugPrivilege 5228 inatwyxqd.exe Token: SeDebugPrivilege 2252 ingtgabri.exe Token: SeDebugPrivilege 1196 inpleqlxa.exe Token: SeDebugPrivilege 1068 inuqbjvqf.exe Token: SeDebugPrivilege 1268 inbrulkss.exe Token: SeDebugPrivilege 2572 inkbaivic.exe Token: SeDebugPrivilege 5364 inoavpdfe.exe Token: SeDebugPrivilege 240 inniyteex.exe Token: SeDebugPrivilege 3500 ingoxeawx.exe Token: SeDebugPrivilege 1124 inertnmni.exe Token: SeDebugPrivilege 4696 inocokdvj.exe Token: SeDebugPrivilege 3940 indtwnmuu.exe Token: SeDebugPrivilege 3736 inkzrlbas.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe 2860 insohtodl.exe 3104 inwixlnmf.exe 1448 inaexuhtj.exe 1520 inykznpoh.exe 2216 inruwvobn.exe 2432 inrdysgih.exe 3380 ingiuiufd.exe 5968 innqsrkjz.exe 832 invrckwrg.exe 2060 inqjpgzht.exe 5420 inqmfrmyb.exe 4152 indxawycz.exe 5668 invhwkmle.exe 4872 inmeufqjy.exe 1192 incrjzdkv.exe 940 inzvgovkd.exe 4480 inmtnbdcu.exe 4264 inbqiycju.exe 3244 ingvnhoze.exe 444 intsuvkkg.exe 1568 inqcxrfhg.exe 3044 inhsblrqs.exe 5760 inmprqjiy.exe 4372 inomzqrdt.exe 2576 inwhpwale.exe 5672 inknedlyl.exe 1476 inadbobmd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3360 wrote to memory of 2860 3360 2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 2860 wrote to memory of 3104 2860 insohtodl.exe 90 PID 3104 wrote to memory of 1448 3104 inwixlnmf.exe 91 PID 1448 wrote to memory of 1520 1448 inaexuhtj.exe 92 PID 1520 wrote to memory of 2216 1520 inykznpoh.exe 93 PID 2216 wrote to memory of 2432 2216 inruwvobn.exe 94 PID 2432 wrote to memory of 3380 2432 inrdysgih.exe 95 PID 3380 wrote to memory of 5968 3380 ingiuiufd.exe 96 PID 5968 wrote to memory of 832 5968 innqsrkjz.exe 97 PID 832 wrote to memory of 2060 832 invrckwrg.exe 98 PID 2060 wrote to memory of 5420 2060 inqjpgzht.exe 99 PID 5420 wrote to memory of 4152 5420 inqmfrmyb.exe 100 PID 4152 wrote to memory of 5668 4152 indxawycz.exe 101 PID 5668 wrote to memory of 4872 5668 invhwkmle.exe 102 PID 4872 wrote to memory of 1192 4872 inmeufqjy.exe 103 PID 1192 wrote to memory of 940 1192 incrjzdkv.exe 104 PID 940 wrote to memory of 4480 940 inzvgovkd.exe 105 PID 4480 wrote to memory of 4264 4480 inmtnbdcu.exe 106 PID 4264 wrote to memory of 3244 4264 inbqiycju.exe 107 PID 3244 wrote to memory of 444 3244 ingvnhoze.exe 108 PID 444 wrote to memory of 1568 444 intsuvkkg.exe 109 PID 1568 wrote to memory of 3044 1568 inqcxrfhg.exe 110 PID 3044 wrote to memory of 5760 3044 inhsblrqs.exe 111 PID 5760 wrote to memory of 4372 5760 inmprqjiy.exe 112 PID 4372 wrote to memory of 2576 4372 inomzqrdt.exe 113 PID 2576 wrote to memory of 5672 2576 inwhpwale.exe 114 PID 5672 wrote to memory of 1476 5672 inknedlyl.exe 115 PID 1476 wrote to memory of 1236 1476 inadbobmd.exe 116 PID 1236 wrote to memory of 4860 1236 inhwoipfi.exe 117 PID 4860 wrote to memory of 3288 4860 inogwahsa.exe 118 PID 3288 wrote to memory of 204 3288 intfuikjc.exe 119 PID 204 wrote to memory of 4628 204 injyqkarh.exe 120 PID 4628 wrote to memory of 584 4628 innfvgrkz.exe 121 PID 584 wrote to memory of 4284 584 indskelwb.exe 122 PID 4284 wrote to memory of 1104 4284 inixpjqgj.exe 123 PID 1104 wrote to memory of 124 1104 innuocedv.exe 124 PID 124 wrote to memory of 2080 124 insezthji.exe 125 PID 2080 wrote to memory of 4864 2080 inxjymong.exe 126 PID 4864 wrote to memory of 3848 4864 inortslka.exe 127 PID 3848 wrote to memory of 3180 3848 inxtemyti.exe 128 PID 3180 wrote to memory of 2264 3180 inyjbrycn.exe 129 PID 2264 wrote to memory of 1148 2264 inljyapnv.exe 130 PID 1148 wrote to memory of 4440 1148 inwsdlxsh.exe 131 PID 4440 wrote to memory of 1608 4440 ineuxonvv.exe 132 PID 1608 wrote to memory of 4120 1608 inlsmacbt.exe 133 PID 4120 wrote to memory of 5888 4120 inyorihpp.exe 134 PID 5888 wrote to memory of 968 5888 inuydrpyf.exe 135 PID 968 wrote to memory of 632 968 injhulmow.exe 136 PID 632 wrote to memory of 6044 632 inbjwysrs.exe 137 PID 6044 wrote to memory of 4348 6044 intcrvwiy.exe 138 PID 4348 wrote to memory of 5228 4348 inutvwllh.exe 139 PID 5228 wrote to memory of 2252 5228 inatwyxqd.exe 140 PID 2252 wrote to memory of 1196 2252 ingtgabri.exe 141 PID 1196 wrote to memory of 1068 1196 inpleqlxa.exe 142 PID 1068 wrote to memory of 1268 1068 inuqbjvqf.exe 143 PID 1268 wrote to memory of 2572 1268 inbrulkss.exe 144 PID 2572 wrote to memory of 5364 2572 inkbaivic.exe 145 PID 5364 wrote to memory of 240 5364 inoavpdfe.exe 146 PID 240 wrote to memory of 3500 240 inniyteex.exe 147 PID 3500 wrote to memory of 1124 3500 ingoxeawx.exe 148 PID 1124 wrote to memory of 4696 1124 inertnmni.exe 149 PID 4696 wrote to memory of 3940 4696 inocokdvj.exe 150 PID 3940 wrote to memory of 3736 3940 indtwnmuu.exe 151 PID 3736 wrote to memory of 4464 3736 inkzrlbas.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_6fa96213a6facda9b81d73762fd383da_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe21⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe25⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\system32\innfvgrkz.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe38⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe46⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\inuydrpyf.exeC:\Windows\system32\inuydrpyf.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\inbrulkss.exeC:\Windows\system32\inbrulkss.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe65⤵
- Executes dropped EXE
PID:4464 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe66⤵PID:3520
-
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe67⤵PID:5720
-
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe68⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe69⤵PID:6068
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe70⤵PID:4176
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe71⤵PID:5640
-
C:\Windows\SysWOW64\inlaxcmgz.exeC:\Windows\system32\inlaxcmgz.exe72⤵PID:4940
-
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe73⤵PID:976
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe74⤵PID:5560
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\system32\ingvetxyk.exe75⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4236 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe76⤵PID:6016
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe77⤵PID:3748
-
C:\Windows\SysWOW64\iniqzgcyz.exeC:\Windows\system32\iniqzgcyz.exe78⤵PID:1052
-
C:\Windows\SysWOW64\inqnbrgit.exeC:\Windows\system32\inqnbrgit.exe79⤵PID:3464
-
C:\Windows\SysWOW64\indpalewk.exeC:\Windows\system32\indpalewk.exe80⤵PID:4676
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe81⤵PID:3300
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe82⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1144 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe83⤵PID:1720
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe84⤵PID:1384
-
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe85⤵PID:4132
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe86⤵
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe87⤵PID:5188
-
C:\Windows\SysWOW64\inupalliz.exeC:\Windows\system32\inupalliz.exe88⤵PID:1680
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe89⤵PID:2808
-
C:\Windows\SysWOW64\indlyubtu.exeC:\Windows\system32\indlyubtu.exe90⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe91⤵
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe92⤵PID:1484
-
C:\Windows\SysWOW64\inmnccutj.exeC:\Windows\system32\inmnccutj.exe93⤵
- Drops file in System32 directory
PID:2020 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe94⤵PID:200
-
C:\Windows\SysWOW64\inhiypoew.exeC:\Windows\system32\inhiypoew.exe95⤵PID:1344
-
C:\Windows\SysWOW64\inecpcnet.exeC:\Windows\system32\inecpcnet.exe96⤵
- System Location Discovery: System Language Discovery
PID:696 -
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe97⤵PID:3280
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe98⤵PID:568
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe99⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4212 -
C:\Windows\SysWOW64\inktbmkag.exeC:\Windows\system32\inktbmkag.exe100⤵PID:5224
-
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe101⤵PID:4852
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe102⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\ineeenyiy.exeC:\Windows\system32\ineeenyiy.exe103⤵PID:6056
-
C:\Windows\SysWOW64\inochlfll.exeC:\Windows\system32\inochlfll.exe104⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe105⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe106⤵PID:4592
-
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe107⤵PID:2816
-
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe108⤵PID:1540
-
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe109⤵PID:4156
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe110⤵PID:3980
-
C:\Windows\SysWOW64\inpkvggzd.exeC:\Windows\system32\inpkvggzd.exe111⤵PID:4868
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe112⤵PID:1872
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\system32\inscqyokc.exe113⤵PID:256
-
C:\Windows\SysWOW64\inmvbdomc.exeC:\Windows\system32\inmvbdomc.exe114⤵PID:3376
-
C:\Windows\SysWOW64\inupkqjvx.exeC:\Windows\system32\inupkqjvx.exe115⤵PID:2500
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe116⤵
- System Location Discovery: System Language Discovery
PID:3188 -
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe117⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5500 -
C:\Windows\SysWOW64\inbobfwma.exeC:\Windows\system32\inbobfwma.exe118⤵PID:2644
-
C:\Windows\SysWOW64\incraptug.exeC:\Windows\system32\incraptug.exe119⤵PID:4468
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe120⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2444 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe121⤵PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-