Analysis
- max time kernel
76s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:03
Behavioral task
behavioral1
Sample
2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260718-begqlabs8m
- SHA256 26353e1e5e9a7f41f859e056d989dd05d11eb85ba5987a66e678c7774c59c097
- MD5 60ebdc896a58ad24857bb9505080c97a
- SHA1 77a0a0e8c487bbab954dae7218a2b1716635d8eb
- SHA512 adcba6c9ddef57c776ea64bd2d01c6cd336cc086071350c0b24ecefcb82cb4f7a0175258bdb991e3ca56db20892cc0c7705bbd8a53f14c21f963a0c94b121ae8
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT0:RPjOa1NxyYtH10
- TLSH T11415AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/1048-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4cd-19.dat family_gh0strat behavioral2/memory/1048-21-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d3-30.dat family_gh0strat behavioral2/files/0x000d00000001c4d4-39.dat family_gh0strat behavioral2/files/0x000d00000001c4d8-62.dat family_gh0strat behavioral2/files/0x000d00000001c4dc-85.dat family_gh0strat behavioral2/memory/2916-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e5-129.dat family_gh0strat behavioral2/files/0x000d00000001c4e9-151.dat family_gh0strat behavioral2/memory/764-176-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f6-218.dat family_gh0strat behavioral2/memory/2468-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4700-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5836-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5384-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3560-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1244-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1376-624-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/264-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2828-570-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2936-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4480-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2848-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2488-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5860-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4644-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5716-443-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6080-425-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4260-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4648-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2872-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c50e-350.dat family_gh0strat behavioral2/files/0x000d00000001c50a-328.dat family_gh0strat behavioral2/files/0x000d00000001c506-306.dat family_gh0strat behavioral2/files/0x000d00000001c502-284.dat family_gh0strat behavioral2/files/0x000d00000001c4fe-262.dat family_gh0strat behavioral2/memory/5644-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4fa-240.dat family_gh0strat behavioral2/memory/1708-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3404-199-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4f1-196.dat family_gh0strat behavioral2/files/0x000d00000001c4ed-177.dat family_gh0strat behavioral2/memory/108-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4540-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e0-108.dat family_gh0strat behavioral2/memory/5580-101-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4256-89-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4664-67-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76C241D9-5159-4317-A779-F71746F72DD2}\stubpath = "C:\\Windows\\system32\\inuhqyjhd.exe" inowmiavg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A07055CF-8A5E-4e93-AD26-B6288E754480}\stubpath = "C:\\Windows\\system32\\indtfhlye.exe" inecpcnet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0B7B8BB1-0A79-4e92-8E07-54C6854DF8E0}\stubpath = "C:\\Windows\\system32\\inkfaovfk.exe" inhnmoqun.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{24685A1B-37BA-4773-B835-171F7F1EAFBE} inwtixaeq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{595E3133-B05A-42c5-8800-96FD5FB6A17D} inluxxpmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85DA7BC8-C694-4388-8BC9-EC9752D46E1E} inqjvuqid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D53413C8-4F37-4812-91D2-C8B2EE6B61BC}\stubpath = "C:\\Windows\\system32\\inruwvobn.exe" inigtklnv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2B5E94AF-64A8-4625-8643-633FE7B07387} inxitdtqe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{27F848C7-419F-4b1c-AF63-68228E37E298} infmbihgy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{888C52DC-8C24-4455-A55A-8CC63DE3F185}\stubpath = "C:\\Windows\\system32\\ingcowdkg.exe" inooxsntm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{851C74A8-418C-4cd8-8787-1FC6B7889997}\stubpath = "C:\\Windows\\system32\\inptcowdq.exe" inmvbdomc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA8D236C-CAA9-49b6-B018-F91D251951C6}\stubpath = "C:\\Windows\\system32\\inlcfvhzy.exe" inmrhdpxe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1289CFF3-6586-4b29-9B16-049E77A99561} inyvsxuru.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9D5D227-74D6-430e-9C6A-29C1D9B488D9} inuwjozuo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DA52954C-B19E-47d3-8508-3E060B661E7C}\stubpath = "C:\\Windows\\system32\\inuiybnpg.exe" inejnhnnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC4C2AE2-7B5D-4b7c-9C06-FDEA05A33718} insuxuebv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09ABA115-7064-439a-85D6-4FD91EE984FE} inlmosntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{715486A7-46E8-4343-9FB1-AA4BC7E0382D}\stubpath = "C:\\Windows\\system32\\inkmpnlpp.exe" inptcowdq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F44BF59C-151B-476b-A2E2-90F5F34B70F1} ingvfeugi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2741F641-3984-411c-9E26-98492EB3E2DA} inicbilrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{624FAFED-6D57-4d45-B773-3C4C11CC4371}\stubpath = "C:\\Windows\\system32\\inlsmacbt.exe" ingvnhoze.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{463EBEB0-F057-4ed3-BFD0-5B89A68D6913}\stubpath = "C:\\Windows\\system32\\inngbnczn.exe" inivlaoql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8E0C787-79D8-47c2-A643-799AB6405FBC}\stubpath = "C:\\Windows\\system32\\inrvkfwvq.exe" inhlazdts.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84E5E6AA-5804-4286-9824-23495D569A43}\stubpath = "C:\\Windows\\system32\\inujqmuoe.exe" indbkovjr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C72E9D3-6FB7-4b09-AA99-CBD6B001AE5F}\stubpath = "C:\\Windows\\system32\\inytozkkh.exe" inbohznex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741AAF1-08DF-4d8a-8C15-A5D59A4B2C68}\stubpath = "C:\\Windows\\system32\\injprzfoi.exe" inoxlbteg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1DEDD5A-8C53-440d-B127-0BED50683984} inzjwmbpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6414AED5-E091-4427-A9B8-60F3D4A33ED5} inlsmacbt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47A8D578-7BB0-402f-A829-A747D53D5B0B} inbjwysrs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7591AF93-1EA4-4631-8EE8-CBC85657E619}\stubpath = "C:\\Windows\\system32\\inczeboin.exe" inuhqyjhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D518F083-A63E-4516-9D11-FCACBAD3DDDB}\stubpath = "C:\\Windows\\system32\\incajnuiq.exe" innusjmop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68D5B689-80E1-4a7d-A634-D3FB5D8AAA12}\stubpath = "C:\\Windows\\system32\\invzzdxxz.exe" inupalliz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{35941A78-C50D-4d68-8EC1-256EE83B273B} inngbnczn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9939AB9B-FEEB-40e7-A3CD-8B896AE40FE4} inzvlkiyc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{843C9EEF-B873-4003-B61F-68A3CDA0003D}\stubpath = "C:\\Windows\\system32\\inwhpwale.exe" inqcxrfhg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D4A74FB-2CCC-479c-9C33-ECDC09ED5946}\stubpath = "C:\\Windows\\system32\\inxsdoolp.exe" inhwoipfi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{002DC6CA-5006-4d0e-B4DC-3AFA650EF940}\stubpath = "C:\\Windows\\system32\\incsvmltt.exe" innlypqcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB337099-55B4-4ffb-8207-41A53223A13C}\stubpath = "C:\\Windows\\system32\\ineuxonvv.exe" inapnrseu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{686721A3-7370-4be4-AD40-1388E477E17D} intsuvkkg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDEBCCCC-10EF-40d2-A275-A51498A8499D} inyoeaukm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{396FE0F1-B462-4c5f-A5C3-24AB73C73850} inebgydau.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80DB130E-0F9B-4b78-A87D-3D531B0AAE77} inhoiekzn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E019B4D2-0162-4aea-B8C7-07D6E8F602F2}\stubpath = "C:\\Windows\\system32\\indtwnmuu.exe" injkrqgyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3F391A5-8183-4aac-89E4-56DD7C58D367} inuytzxmg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68D5B689-80E1-4a7d-A634-D3FB5D8AAA12} inupalliz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0FF180F9-9559-4c69-A37C-CE0E015F12B4} inyegtexf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{595E3133-B05A-42c5-8800-96FD5FB6A17D}\stubpath = "C:\\Windows\\system32\\inpkuzhdr.exe" inluxxpmh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1696765A-13C8-4e02-A38E-63BFFD1BD018} inmkxopbr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B8D070A6-EC10-48e2-A963-1557E1B216EC}\stubpath = "C:\\Windows\\system32\\inkdbjsnc.exe" inisucehe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D9D5D227-74D6-430e-9C6A-29C1D9B488D9}\stubpath = "C:\\Windows\\system32\\innboczda.exe" inuwjozuo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EED31D71-2238-4747-B455-96CB9B737D4B}\stubpath = "C:\\Windows\\system32\\inuqbjvqf.exe" injyqkarh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCFC17F4-F435-4546-8845-4A559EC6D375} intglbjrf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53E92D74-2CA2-48de-AADD-53DD40E03747}\stubpath = "C:\\Windows\\system32\\insvsctst.exe" innvcvbrm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80DB130E-0F9B-4b78-A87D-3D531B0AAE77}\stubpath = "C:\\Windows\\system32\\inikojpnc.exe" inhoiekzn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23433FD5-68CB-480f-A489-633638FFE7B4} inikojpnc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A2AC1DA-B50C-40c1-8EB9-3412FDC64B6A} inaikwkwh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4A021D8B-51EA-4989-B77E-87CEB067DFF4} inrshhzyd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F9AA43D-0F73-420c-BFD0-9787DF9C8622} inlhagxpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D5201D34-7B55-4fcc-A315-DE40D80319F5} inoavpdfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D6B11DC-864E-49fe-AE70-E803FC57A7DB}\stubpath = "C:\\Windows\\system32\\inrmslxzd.exe" incbrcegj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3929C7A-957B-4ef2-8AC5-1A2D9E4A3FAF}\stubpath = "C:\\Windows\\system32\\inyvyscpf.exe" injfdlthy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF090A0-A8A4-4e4d-8090-F57E34618FD1} intphcved.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EF62FAC-05E9-46a4-AA69-812EC4E901A0}\stubpath = "C:\\Windows\\system32\\indeoeuxa.exe" inqzfhsqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D3AD7622-2EC0-4f4e-8CE2-2B6C4E37B4CA}\stubpath = "C:\\Windows\\system32\\ingiuiufd.exe" inbqiycju.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000019cb5-2.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 5580 indhxkwmb.exe 4664 inxjymong.exe 4256 inmtnbdcu.exe 2916 inatwyxqd.exe 4540 injyqkarh.exe 108 inuqbjvqf.exe 764 ingvnhoze.exe 3404 inlsmacbt.exe 1708 insvxwpco.exe 5644 inaexuhtj.exe 2468 inmeufqjy.exe 4700 insezthji.exe 5836 incgzwjvl.exe 5384 inogwahsa.exe 3560 inugvjlkd.exe 2872 inpleqlxa.exe 4648 inrdysgih.exe 4260 inhfsfaqh.exe 6080 inldtepix.exe 5716 inqcxrfhg.exe 4644 inwhpwale.exe 5860 inpsutmlb.exe 2488 inbuxzyre.exe 2848 inaikwkwh.exe 4480 inortslka.exe 2936 inpfzcyeq.exe 2828 inbfyviuk.exe 264 inrngsnzc.exe 1244 inwsdlxsh.exe 1376 inkbaivic.exe 3324 inoavpdfe.exe 560 inyufnzuj.exe 1540 inzkcszdo.exe 2732 inaphxbit.exe 4248 invhwkmle.exe 3416 inigtklnv.exe 2484 inruwvobn.exe 5268 indwztgsi.exe 2428 inzloqpih.exe 5516 inqtvunam.exe 4116 inzvgovkd.exe 4496 ingvzmksi.exe 3304 inbqiycju.exe 5400 ingiuiufd.exe 2788 injmdckxk.exe 4392 insohtodl.exe 4684 inqgdzfrf.exe 4316 inljyapnv.exe 720 inxtemyti.exe 5116 indtkzjxv.exe 1204 inwmpgfnn.exe 5524 ineybxzdp.exe 1292 inwixlnmf.exe 5612 innqsrkjz.exe 1496 inyorihpp.exe 2024 inwgusogd.exe 3128 infslrijv.exe 1700 invuwaxma.exe 1168 inbaqtkjr.exe 3584 infvypoww.exe 4900 inhwnltjf.exe 5664 indxawycz.exe 6088 infhthtec.exe 5988 indqsmlmh.exe - Loads dropped DLL 64 IoCs
pid Process 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe 5580 indhxkwmb.exe 5580 indhxkwmb.exe 4664 inxjymong.exe 4664 inxjymong.exe 4256 inmtnbdcu.exe 4256 inmtnbdcu.exe 2916 inatwyxqd.exe 2916 inatwyxqd.exe 4540 injyqkarh.exe 4540 injyqkarh.exe 108 inuqbjvqf.exe 108 inuqbjvqf.exe 764 ingvnhoze.exe 764 ingvnhoze.exe 3404 inlsmacbt.exe 3404 inlsmacbt.exe 1708 insvxwpco.exe 1708 insvxwpco.exe 5644 inaexuhtj.exe 5644 inaexuhtj.exe 2468 inmeufqjy.exe 2468 inmeufqjy.exe 4700 insezthji.exe 4700 insezthji.exe 5836 incgzwjvl.exe 5836 incgzwjvl.exe 5384 inogwahsa.exe 5384 inogwahsa.exe 3560 inugvjlkd.exe 3560 inugvjlkd.exe 2872 inpleqlxa.exe 2872 inpleqlxa.exe 4648 inrdysgih.exe 4648 inrdysgih.exe 4260 inhfsfaqh.exe 4260 inhfsfaqh.exe 6080 inldtepix.exe 6080 inldtepix.exe 5716 inqcxrfhg.exe 5716 inqcxrfhg.exe 4644 inwhpwale.exe 4644 inwhpwale.exe 5860 inpsutmlb.exe 5860 inpsutmlb.exe 2488 inbuxzyre.exe 2488 inbuxzyre.exe 2848 inaikwkwh.exe 2848 inaikwkwh.exe 4480 inortslka.exe 4480 inortslka.exe 2936 inpfzcyeq.exe 2936 inpfzcyeq.exe 2828 inbfyviuk.exe 2828 inbfyviuk.exe 264 inrngsnzc.exe 264 inrngsnzc.exe 1244 inwsdlxsh.exe 1244 inwsdlxsh.exe 1376 inkbaivic.exe 1376 inkbaivic.exe 3324 inoavpdfe.exe 3324 inoavpdfe.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.dat 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe File opened for modification C:\Windows\SysWOW64\inqklaasr.exe_lang.ini inkivmnpx.exe File opened for modification C:\Windows\SysWOW64\innptoush.exe_lang.ini invbdruwx.exe File created C:\Windows\SysWOW64\infyeupzm.exe invirzkie.exe File created C:\Windows\SysWOW64\insezthji.exe inmeufqjy.exe File created C:\Windows\SysWOW64\invhwkmle.exe inaphxbit.exe File opened for modification C:\Windows\SysWOW64\inniombtb.exe_lang.ini inkwblfyk.exe File opened for modification C:\Windows\SysWOW64\inxgaoyjn.exe_lang.ini iniszaxor.exe File created C:\Windows\SysWOW64\indeoeuxa.exe inqzfhsqg.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inzvgovkd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrfpuysy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxiaqxbm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inkjzlnrk.exe File created C:\Windows\SysWOW64\inljswfrz.exe intekobge.exe File opened for modification C:\Windows\SysWOW64\incbzwztd.exe_lang.ini insacfcod.exe File opened for modification C:\Windows\SysWOW64\ingtvpopk.exe_lang.ini inhhujgdi.exe File opened for modification C:\Windows\SysWOW64\inaeepccp.exe_lang.ini inirveqyf.exe File opened for modification C:\Windows\SysWOW64\incraptug.exe_lang.ini inzhuwqpq.exe File opened for modification C:\Windows\SysWOW64\inqpqfsux.exe_lang.ini inzhfgmfs.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqhodfle.exe File opened for modification C:\Windows\SysWOW64\inuizasnp.exe_lang.ini inmkimmxk.exe File created C:\Windows\SysWOW64\insulctjf.exe inbsfowhf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyegtexf.exe File opened for modification C:\Windows\SysWOW64\iniszaxor.exe_lang.ini inwjfatav.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invzesqzg.exe File created C:\Windows\SysWOW64\inmrxryds.exe inzvlkiyc.exe File created C:\Windows\SysWOW64\inoioprby.exe inyaereiz.exe File created C:\Windows\SysWOW64\inadbobmd.exe inknedlyl.exe File created C:\Windows\SysWOW64\incajnuiq.exe innusjmop.exe File created C:\Windows\SysWOW64\intndtuwg.exe inhegsgsd.exe File opened for modification C:\Windows\SysWOW64\inrcscxou.exe_lang.ini inzvnieka.exe File created C:\Windows\SysWOW64\intlkfhrk.exe inzuolauz.exe File opened for modification C:\Windows\SysWOW64\inucxmxol.exe_lang.ini invspsmvj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuypzsaf.exe File opened for modification C:\Windows\SysWOW64\inzhfgmfs.exe_lang.ini innezovdr.exe File created C:\Windows\SysWOW64\inqesbyaz.exe inbjibmnx.exe File opened for modification C:\Windows\SysWOW64\incvxxhec.exe_lang.ini inrvkfwvq.exe File created C:\Windows\SysWOW64\innuocedv.exe insnyjjgx.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infumgnyd.exe File opened for modification C:\Windows\SysWOW64\infhthtec.exe_lang.ini indxawycz.exe File opened for modification C:\Windows\SysWOW64\invbdruwx.exe_lang.ini inhbcsjyi.exe File opened for modification C:\Windows\SysWOW64\insywlfel.exe_lang.ini inljswfrz.exe File opened for modification C:\Windows\SysWOW64\insbznvcp.exe_lang.ini inuydrpyf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indscwrxb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inejnhnnw.exe File opened for modification C:\Windows\SysWOW64\inxrqyyst.exe_lang.ini indlyubtu.exe File created C:\Windows\SysWOW64\inomvcziu.exe indtosnaj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inknedlyl.exe File opened for modification C:\Windows\SysWOW64\inqmfrmyb.exe_lang.ini inpqffxwb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inochlfll.exe File created C:\Windows\SysWOW64\intmsjkwc.exe invatpnbv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpiqqmhr.exe File opened for modification C:\Windows\SysWOW64\inljyapnv.exe_lang.ini inqgdzfrf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indwezqep.exe File created C:\Windows\SysWOW64\injfqeotx.exe inyoeaukm.exe File created C:\Windows\SysWOW64\ingcowdkg.exe inooxsntm.exe File opened for modification C:\Windows\SysWOW64\inupalliz.exe_lang.ini inuinrlrc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injidfpid.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injwbpnkv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat innuocedv.exe File opened for modification C:\Windows\SysWOW64\inlmosntr.exe_lang.ini injsnioht.exe File opened for modification C:\Windows\SysWOW64\infudswxj.exe_lang.ini ingcmtril.exe File opened for modification C:\Windows\SysWOW64\ineupaato.exe_lang.ini inctpigdo.exe File opened for modification C:\Windows\SysWOW64\inmsevrki.exe_lang.ini invqlwhhe.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insywlfel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuvxhdct.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfevnir.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxikfepk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invqlwhhe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intdzdpys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inztkqidm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrdysgih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmibthrw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaeepccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkietvme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtosnaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlmnyysj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsdfhkz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkoozmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkbaivic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoyokzfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inltanpsp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inucuflpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invudbffq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgacrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwnltjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpiofygs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injfdlthy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incrjzdkv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuloqrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlaxcmgz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxrycagn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inotqnqky.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpnehxjk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineuxonvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innusjmop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtfhlye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyofxrod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indwbuqoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infyeupzm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inldtepix.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingugrwmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbmyhvlc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language intlkfhrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inidwdyvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzkzjyci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invlhtipl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrgispe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlgphgbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhjedoj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhpjpqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inikbvtjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innikicxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inokiqcye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insbquvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoeaukm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmxiifwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkivmnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwylczx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inacgtgkr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injidfpid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzvnieka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhiypoew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingwzqpxx.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe 5580 indhxkwmb.exe 5580 indhxkwmb.exe 4664 inxjymong.exe 4664 inxjymong.exe 4256 inmtnbdcu.exe 4256 inmtnbdcu.exe 2916 inatwyxqd.exe 2916 inatwyxqd.exe 4540 injyqkarh.exe 4540 injyqkarh.exe 108 inuqbjvqf.exe 108 inuqbjvqf.exe 764 ingvnhoze.exe 764 ingvnhoze.exe 3404 inlsmacbt.exe 3404 inlsmacbt.exe 1708 insvxwpco.exe 1708 insvxwpco.exe 5644 inaexuhtj.exe 5644 inaexuhtj.exe 2468 inmeufqjy.exe 2468 inmeufqjy.exe 4700 insezthji.exe 4700 insezthji.exe 5836 incgzwjvl.exe 5836 incgzwjvl.exe 5384 inogwahsa.exe 5384 inogwahsa.exe 3560 inugvjlkd.exe 3560 inugvjlkd.exe 2872 inpleqlxa.exe 2872 inpleqlxa.exe 4648 inrdysgih.exe 4648 inrdysgih.exe 4260 inhfsfaqh.exe 4260 inhfsfaqh.exe 6080 inldtepix.exe 6080 inldtepix.exe 5716 inqcxrfhg.exe 5716 inqcxrfhg.exe 4644 inwhpwale.exe 4644 inwhpwale.exe 5860 inpsutmlb.exe 5860 inpsutmlb.exe 2488 inbuxzyre.exe 2488 inbuxzyre.exe 2848 inaikwkwh.exe 2848 inaikwkwh.exe 4480 inortslka.exe 4480 inortslka.exe 2936 inpfzcyeq.exe 2936 inpfzcyeq.exe 2828 inbfyviuk.exe 2828 inbfyviuk.exe 264 inrngsnzc.exe 264 inrngsnzc.exe 1244 inwsdlxsh.exe 1244 inwsdlxsh.exe 1376 inkbaivic.exe 1376 inkbaivic.exe 3324 inoavpdfe.exe 3324 inoavpdfe.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 5580 indhxkwmb.exe Token: SeDebugPrivilege 4664 inxjymong.exe Token: SeDebugPrivilege 4256 inmtnbdcu.exe Token: SeDebugPrivilege 2916 inatwyxqd.exe Token: SeDebugPrivilege 4540 injyqkarh.exe Token: SeDebugPrivilege 108 inuqbjvqf.exe Token: SeDebugPrivilege 764 ingvnhoze.exe Token: SeDebugPrivilege 3404 inlsmacbt.exe Token: SeDebugPrivilege 1708 insvxwpco.exe Token: SeDebugPrivilege 5644 inaexuhtj.exe Token: SeDebugPrivilege 2468 inmeufqjy.exe Token: SeDebugPrivilege 4700 insezthji.exe Token: SeDebugPrivilege 5836 incgzwjvl.exe Token: SeDebugPrivilege 5384 inogwahsa.exe Token: SeDebugPrivilege 3560 inugvjlkd.exe Token: SeDebugPrivilege 2872 inpleqlxa.exe Token: SeDebugPrivilege 4648 inrdysgih.exe Token: SeDebugPrivilege 4260 inhfsfaqh.exe Token: SeDebugPrivilege 6080 inldtepix.exe Token: SeDebugPrivilege 5716 inqcxrfhg.exe Token: SeDebugPrivilege 4644 inwhpwale.exe Token: SeDebugPrivilege 5860 inpsutmlb.exe Token: SeDebugPrivilege 2488 inbuxzyre.exe Token: SeDebugPrivilege 2848 inaikwkwh.exe Token: SeDebugPrivilege 4480 inortslka.exe Token: SeDebugPrivilege 2936 inpfzcyeq.exe Token: SeDebugPrivilege 2828 inbfyviuk.exe Token: SeDebugPrivilege 264 inrngsnzc.exe Token: SeDebugPrivilege 1244 inwsdlxsh.exe Token: SeDebugPrivilege 1376 inkbaivic.exe Token: SeDebugPrivilege 3324 inoavpdfe.exe Token: SeDebugPrivilege 560 inyufnzuj.exe Token: SeDebugPrivilege 1540 inzkcszdo.exe Token: SeDebugPrivilege 2732 inaphxbit.exe Token: SeDebugPrivilege 4248 invhwkmle.exe Token: SeDebugPrivilege 3416 inigtklnv.exe Token: SeDebugPrivilege 2484 inruwvobn.exe Token: SeDebugPrivilege 5268 indwztgsi.exe Token: SeDebugPrivilege 2428 inzloqpih.exe Token: SeDebugPrivilege 5516 inqtvunam.exe Token: SeDebugPrivilege 4116 inzvgovkd.exe Token: SeDebugPrivilege 4496 ingvzmksi.exe Token: SeDebugPrivilege 3304 inbqiycju.exe Token: SeDebugPrivilege 5400 ingiuiufd.exe Token: SeDebugPrivilege 2788 injmdckxk.exe Token: SeDebugPrivilege 4392 insohtodl.exe Token: SeDebugPrivilege 4684 inqgdzfrf.exe Token: SeDebugPrivilege 4316 inljyapnv.exe Token: SeDebugPrivilege 720 inxtemyti.exe Token: SeDebugPrivilege 5116 indtkzjxv.exe Token: SeDebugPrivilege 1204 inwmpgfnn.exe Token: SeDebugPrivilege 5524 ineybxzdp.exe Token: SeDebugPrivilege 1292 inwixlnmf.exe Token: SeDebugPrivilege 5612 innqsrkjz.exe Token: SeDebugPrivilege 1496 inyorihpp.exe Token: SeDebugPrivilege 2024 inwgusogd.exe Token: SeDebugPrivilege 3128 infslrijv.exe Token: SeDebugPrivilege 1700 invuwaxma.exe Token: SeDebugPrivilege 1168 inbaqtkjr.exe Token: SeDebugPrivilege 3584 infvypoww.exe Token: SeDebugPrivilege 4900 inhwnltjf.exe Token: SeDebugPrivilege 5664 indxawycz.exe Token: SeDebugPrivilege 6088 infhthtec.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe 5580 indhxkwmb.exe 4664 inxjymong.exe 4256 inmtnbdcu.exe 2916 inatwyxqd.exe 4540 injyqkarh.exe 108 inuqbjvqf.exe 764 ingvnhoze.exe 3404 inlsmacbt.exe 1708 insvxwpco.exe 5644 inaexuhtj.exe 2468 inmeufqjy.exe 4700 insezthji.exe 5836 incgzwjvl.exe 5384 inogwahsa.exe 3560 inugvjlkd.exe 2872 inpleqlxa.exe 4648 inrdysgih.exe 4260 inhfsfaqh.exe 6080 inldtepix.exe 5716 inqcxrfhg.exe 4644 inwhpwale.exe 5860 inpsutmlb.exe 2488 inbuxzyre.exe 2848 inaikwkwh.exe 4480 inortslka.exe 2936 inpfzcyeq.exe 2828 inbfyviuk.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 5580 1048 2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 5580 wrote to memory of 4664 5580 indhxkwmb.exe 90 PID 4664 wrote to memory of 4256 4664 inxjymong.exe 91 PID 4256 wrote to memory of 2916 4256 inmtnbdcu.exe 92 PID 2916 wrote to memory of 4540 2916 inatwyxqd.exe 93 PID 4540 wrote to memory of 108 4540 injyqkarh.exe 94 PID 108 wrote to memory of 764 108 inuqbjvqf.exe 95 PID 764 wrote to memory of 3404 764 ingvnhoze.exe 96 PID 3404 wrote to memory of 1708 3404 inlsmacbt.exe 97 PID 1708 wrote to memory of 5644 1708 insvxwpco.exe 98 PID 5644 wrote to memory of 2468 5644 inaexuhtj.exe 99 PID 2468 wrote to memory of 4700 2468 inmeufqjy.exe 100 PID 4700 wrote to memory of 5836 4700 insezthji.exe 101 PID 5836 wrote to memory of 5384 5836 incgzwjvl.exe 102 PID 5384 wrote to memory of 3560 5384 inogwahsa.exe 103 PID 3560 wrote to memory of 2872 3560 inugvjlkd.exe 104 PID 2872 wrote to memory of 4648 2872 inpleqlxa.exe 105 PID 4648 wrote to memory of 4260 4648 inrdysgih.exe 106 PID 4260 wrote to memory of 6080 4260 inhfsfaqh.exe 107 PID 6080 wrote to memory of 5716 6080 inldtepix.exe 108 PID 5716 wrote to memory of 4644 5716 inqcxrfhg.exe 109 PID 4644 wrote to memory of 5860 4644 inwhpwale.exe 110 PID 5860 wrote to memory of 2488 5860 inpsutmlb.exe 111 PID 2488 wrote to memory of 2848 2488 inbuxzyre.exe 112 PID 2848 wrote to memory of 4480 2848 inaikwkwh.exe 113 PID 4480 wrote to memory of 2936 4480 inortslka.exe 114 PID 2936 wrote to memory of 2828 2936 inpfzcyeq.exe 115 PID 2828 wrote to memory of 264 2828 inbfyviuk.exe 116 PID 264 wrote to memory of 1244 264 inrngsnzc.exe 117 PID 1244 wrote to memory of 1376 1244 inwsdlxsh.exe 118 PID 1376 wrote to memory of 3324 1376 inkbaivic.exe 119 PID 3324 wrote to memory of 560 3324 inoavpdfe.exe 120 PID 560 wrote to memory of 1540 560 inyufnzuj.exe 121 PID 1540 wrote to memory of 2732 1540 inzkcszdo.exe 122 PID 2732 wrote to memory of 4248 2732 inaphxbit.exe 123 PID 4248 wrote to memory of 3416 4248 invhwkmle.exe 124 PID 3416 wrote to memory of 2484 3416 inigtklnv.exe 125 PID 2484 wrote to memory of 5268 2484 inruwvobn.exe 126 PID 5268 wrote to memory of 2428 5268 indwztgsi.exe 127 PID 2428 wrote to memory of 5516 2428 inzloqpih.exe 128 PID 5516 wrote to memory of 4116 5516 inqtvunam.exe 129 PID 4116 wrote to memory of 4496 4116 inzvgovkd.exe 130 PID 4496 wrote to memory of 3304 4496 ingvzmksi.exe 131 PID 3304 wrote to memory of 5400 3304 inbqiycju.exe 132 PID 5400 wrote to memory of 2788 5400 ingiuiufd.exe 133 PID 2788 wrote to memory of 4392 2788 injmdckxk.exe 134 PID 4392 wrote to memory of 4684 4392 insohtodl.exe 135 PID 4684 wrote to memory of 4316 4684 inqgdzfrf.exe 136 PID 4316 wrote to memory of 720 4316 inljyapnv.exe 137 PID 720 wrote to memory of 5116 720 inxtemyti.exe 138 PID 5116 wrote to memory of 1204 5116 indtkzjxv.exe 139 PID 1204 wrote to memory of 5524 1204 inwmpgfnn.exe 140 PID 5524 wrote to memory of 1292 5524 ineybxzdp.exe 141 PID 1292 wrote to memory of 5612 1292 inwixlnmf.exe 142 PID 5612 wrote to memory of 1496 5612 innqsrkjz.exe 143 PID 1496 wrote to memory of 2024 1496 inyorihpp.exe 144 PID 2024 wrote to memory of 3128 2024 inwgusogd.exe 145 PID 3128 wrote to memory of 1700 3128 infslrijv.exe 146 PID 1700 wrote to memory of 1168 1700 invuwaxma.exe 147 PID 1168 wrote to memory of 3584 1168 inbaqtkjr.exe 148 PID 3584 wrote to memory of 4900 3584 infvypoww.exe 149 PID 4900 wrote to memory of 5664 4900 inhwnltjf.exe 150 PID 5664 wrote to memory of 6088 5664 indxawycz.exe 151 PID 6088 wrote to memory of 5988 6088 infhthtec.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_60ebdc896a58ad24857bb9505080c97a_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\system32\inatwyxqd.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe21⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe25⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\system32\inortslka.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\system32\inpfzcyeq.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe32⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\system32\inaphxbit.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe37⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe44⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\system32\infvypoww.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe65⤵
- Executes dropped EXE
PID:5988 -
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe66⤵PID:432
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe67⤵PID:3172
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\system32\injlxlxig.exe68⤵PID:2328
-
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe69⤵
- Boot or Logon Autostart Execution: Active Setup
PID:8 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe70⤵PID:5788
-
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe71⤵PID:5068
-
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\system32\inbmkzbqa.exe72⤵PID:4412
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe73⤵PID:2044
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe74⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5296 -
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe75⤵PID:1784
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe76⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1464 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe77⤵PID:5796
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\system32\inrjcgagg.exe78⤵PID:1064
-
C:\Windows\SysWOW64\inlhzufqa.exeC:\Windows\system32\inlhzufqa.exe79⤵PID:2436
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe80⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1172 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe81⤵
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe82⤵PID:3640
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe83⤵
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe84⤵
- Drops file in System32 directory
PID:5956 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe85⤵PID:5744
-
C:\Windows\SysWOW64\inulkzdji.exeC:\Windows\system32\inulkzdji.exe86⤵PID:1396
-
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe87⤵
- System Location Discovery: System Language Discovery
PID:4384 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe88⤵PID:4204
-
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe89⤵
- Drops file in System32 directory
PID:4696 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe90⤵PID:2880
-
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe91⤵
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\system32\incsnrmiw.exe92⤵PID:2132
-
C:\Windows\SysWOW64\inbnjcuis.exeC:\Windows\system32\inbnjcuis.exe93⤵PID:2784
-
C:\Windows\SysWOW64\intfuikjc.exeC:\Windows\system32\intfuikjc.exe94⤵PID:2656
-
C:\Windows\SysWOW64\inpkfxleq.exeC:\Windows\system32\inpkfxleq.exe95⤵PID:988
-
C:\Windows\SysWOW64\inykmqjhq.exeC:\Windows\system32\inykmqjhq.exe96⤵PID:1084
-
C:\Windows\SysWOW64\inddmxhxc.exeC:\Windows\system32\inddmxhxc.exe97⤵PID:4652
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe98⤵PID:5532
-
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe99⤵PID:1544
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe100⤵PID:4268
-
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe101⤵PID:4820
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\system32\inaivxrqr.exe102⤵PID:2148
-
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe103⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\inqxbfmkb.exeC:\Windows\system32\inqxbfmkb.exe104⤵PID:4948
-
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe105⤵PID:4928
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe106⤵PID:5764
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe107⤵
- Boot or Logon Autostart Execution: Active Setup
PID:804 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe108⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in System32 directory
PID:1792 -
C:\Windows\SysWOW64\inuiybnpg.exeC:\Windows\system32\inuiybnpg.exe109⤵PID:3384
-
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe110⤵PID:1220
-
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe111⤵PID:4488
-
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe112⤵PID:5920
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\system32\inutvwllh.exe113⤵PID:3912
-
C:\Windows\SysWOW64\inbqostfv.exeC:\Windows\system32\inbqostfv.exe114⤵PID:4628
-
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe115⤵PID:2768
-
C:\Windows\SysWOW64\inxavmale.exeC:\Windows\system32\inxavmale.exe116⤵PID:2724
-
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe117⤵
- Drops file in System32 directory
PID:4452 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe118⤵PID:5784
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe119⤵PID:5652
-
C:\Windows\SysWOW64\insnyjjgx.exeC:\Windows\system32\insnyjjgx.exe120⤵
- Drops file in System32 directory
PID:3644 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe121⤵
- Drops file in System32 directory
PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-