Analysis
- max time kernel
78s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 20:16
Behavioral task
behavioral1
Sample
2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260727-y2b5ysda96
- SHA256 b8bc8a65dbcef102e27e4637c74936804bd48bcfd61d5aced0d2a346f02f0e63
- MD5 2bce5bd652327faf928f170edd4a3115
- SHA1 6bf748c33631cfaa615a157d6a37ff52dbf9c55e
- SHA512 6a40c5691d3710861cfeb897f17ca77c58952ac26d554622c09fda4164a35fcd74e5626a66bc76c77a96ce44136815f5a155faca885d98350e6321a5c773b7a7
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTh:RPjOa1NxyYtH1h
- TLSH T17215AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/1572-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1572-21-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c5f8-19.dat family_gh0strat behavioral2/files/0x000c00000001c5fd-30.dat family_gh0strat behavioral2/files/0x000c00000001c5fe-39.dat family_gh0strat behavioral2/files/0x000c00000001c602-64.dat family_gh0strat behavioral2/files/0x000c00000001c607-86.dat family_gh0strat behavioral2/files/0x000c00000001c60f-130.dat family_gh0strat behavioral2/memory/4872-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c617-173.dat family_gh0strat behavioral2/files/0x000c00000001c61f-218.dat family_gh0strat behavioral2/files/0x000c00000001c637-349.dat family_gh0strat behavioral2/memory/6096-371-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2236-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2408-624-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2632-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1752-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3244-570-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4336-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5012-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2948-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1060-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2240-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1780-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1240-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3716-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5124-389-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4976-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4532-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c633-328.dat family_gh0strat behavioral2/memory/4456-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c62f-306.dat family_gh0strat behavioral2/memory/4140-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c62b-284.dat family_gh0strat behavioral2/memory/5468-266-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c627-262.dat family_gh0strat behavioral2/memory/804-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c623-240.dat family_gh0strat behavioral2/memory/4524-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1580-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c61b-196.dat family_gh0strat behavioral2/memory/3516-178-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c613-152.dat family_gh0strat behavioral2/memory/3964-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4752-112-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c60b-108.dat family_gh0strat behavioral2/memory/4180-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1272-68-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4348-44-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD6A5938-D31E-4350-8F31-6CED1D1954E7} inixpjqgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D7AAE9D2-E92A-4bb5-8BEE-ED0237350BFA}\stubpath = "C:\\Windows\\system32\\indrzpldy.exe" infcwfnxi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F432359D-73A6-4b75-8927-33EAA46B0775}\stubpath = "C:\\Windows\\system32\\inqzfhsqg.exe" inwauuwtq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D390737-098D-4387-8331-A28F698C837D} injflluak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4EDD5210-3C46-4941-89F1-6117EF1949E4}\stubpath = "C:\\Windows\\system32\\inqtvunam.exe" injyqkarh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FEF2A66F-C5B8-4888-9D83-BDDE4983FF0F}\stubpath = "C:\\Windows\\system32\\inwixlnmf.exe" inrdysgih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{16D88CF2-EC05-41d6-A541-F706B8D195A7}\stubpath = "C:\\Windows\\system32\\ineuxonvv.exe" inazpsjiq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CEF1E60-5BC6-482a-86A4-ED6C2635EB4F} inwemzvcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{33EC351E-E4D2-40eb-9602-422C9A8013F8}\stubpath = "C:\\Windows\\system32\\iniwaqpwa.exe" inoxlbteg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{686DF0C5-7AB0-4337-9057-3B665844F0BA}\stubpath = "C:\\Windows\\system32\\ingyagyjp.exe" invkhejgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DE81F10-9179-490c-9CAE-871632FA2308}\stubpath = "C:\\Windows\\system32\\inddqfcew.exe" inztjzmib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D6E925D-C4EA-4588-83F9-EFBFCDC61C66}\stubpath = "C:\\Windows\\system32\\inpleqlxa.exe" ingoxeawx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AAAFE73A-B6FB-414d-BF13-4529A1A6467E}\stubpath = "C:\\Windows\\system32\\inhscspdt.exe" inoxdfqoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A54B4057-4B67-4a28-AAD2-E090345325B2} inbfffozj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3179638B-2650-48c1-A728-8F355FC3B17D}\stubpath = "C:\\Windows\\system32\\inbalzxgu.exe" inmlwcerc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01965CAE-0DB4-43cc-983B-FE4395650889}\stubpath = "C:\\Windows\\system32\\inwfngdng.exe" inogxmhdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{984DE065-73CE-4c3a-9ACD-75484ED78B57}\stubpath = "C:\\Windows\\system32\\inhyqlaum.exe" inwanaevl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41B39F4E-1199-4233-BBE5-9A645F034BC3}\stubpath = "C:\\Windows\\system32\\inpdlvxfh.exe" inokbwlsa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E470BBC2-A7AA-4134-B2CB-50F5E660A333}\stubpath = "C:\\Windows\\system32\\invnbgkek.exe" inzjwmbpr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4C4CCAA0-4380-4c0b-A0BA-9BFB79AA8A1C}\stubpath = "C:\\Windows\\system32\\injausioy.exe" inbalzxgu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{028CFCF7-D672-4d97-8EE3-7D83D3A09777}\stubpath = "C:\\Windows\\system32\\inasgqvzt.exe" inmvbdomc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C533F818-8D46-4ca3-99DF-CA5735135FA8}\stubpath = "C:\\Windows\\system32\\inhgncqwc.exe" inyctgpxi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C64E805A-5F3D-4d7e-887D-113D18719D9D} inwhpwale.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6690011F-C616-4606-8C0D-C2437B8E5721} inopeewva.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1AD4009E-C1B0-4f22-B0D2-2DF08A2DC3C7} inlaxcmgz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43325688-4365-462d-8E14-DAF02740D9F9} insacfcod.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B0BFD096-A4AB-42a2-988F-D3E85B213D58} intmsjkwc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7CA83A6-D8BB-4e7c-8952-933DC9C7EBEF}\stubpath = "C:\\Windows\\system32\\inrvqwujd.exe" injprzfoi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52D5202C-AD48-4de5-86A6-46CC4E2E1BBD} inooxsntm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{497886EB-BEC1-4cfb-8B9A-002A9E9AEC3C} intekobge.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CADB6280-736B-46e4-B766-3E9EEC01D023} inowmiavg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD586D8-2E61-42a0-8CD2-A2709910FDD9}\stubpath = "C:\\Windows\\system32\\incibocxs.exe" inbkyszdb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6ED00AA-0151-4df9-9804-A8314337C180} indjvakex.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9D80A18E-65F1-4120-8B3A-097D1A1E321A}\stubpath = "C:\\Windows\\system32\\inhomdgwi.exe" inhoiekzn.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D8D6900-A5B0-4605-85C5-7D7CAFDA746C} incanalcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7BEC7661-0D17-4c93-AFDA-F65962C71E10}\stubpath = "C:\\Windows\\system32\\inmtnbdcu.exe" insbquvhx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CEF1E60-5BC6-482a-86A4-ED6C2635EB4F}\stubpath = "C:\\Windows\\system32\\inczeboin.exe" inwemzvcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E818E19-7CFE-4b02-97C0-0F9C95DAAF20}\stubpath = "C:\\Windows\\system32\\insjarhdx.exe" inpfzcyeq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2F5928A3-5AA1-4de2-A0D5-B8CD2A8647C2}\stubpath = "C:\\Windows\\system32\\inxuxrboe.exe" inoropope.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFB69EB4-A113-495a-9874-B081B05CFF34}\stubpath = "C:\\Windows\\system32\\infsuonoj.exe" iniizepdz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{464F1265-2EB6-4fbb-BD75-17407525A9C7} inczogbkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B156CFF2-D74B-4c93-8747-A359ABC71E8E}\stubpath = "C:\\Windows\\system32\\ingtjmoji.exe" injausioy.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D6BF89F-E32F-4a73-ACB8-48930F28C5A2} injwbpnkv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D6A36348-D4EA-49db-8084-A2DFBC2FC329}\stubpath = "C:\\Windows\\system32\\inbfyviuk.exe" inetlfmxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03D9858D-FC23-4bf9-AC70-8DC3E480B994}\stubpath = "C:\\Windows\\system32\\indhxkwmb.exe" inmxiifwj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1890749F-74C3-4090-9BED-954000BDB674} inaqceivb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18229AB5-88B1-4c2b-8B41-88105FC9A234}\stubpath = "C:\\Windows\\system32\\inxqcxpkg.exe" ininzqfqh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EED76D89-A963-41cc-97D9-551E8576BDDB} inujqmuoe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D2C2FFE-BA79-4acf-B49F-A7C57686F232}\stubpath = "C:\\Windows\\system32\\inthmqkqb.exe" injwylczx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B95A40D6-7F37-44fd-B3F2-C93324901172} inzewkdpr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E7E2CA03-3684-4008-B13C-DA8101D3494B} inmqlrpew.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F82DDC89-7E84-4926-B62C-EEC050E24211}\stubpath = "C:\\Windows\\system32\\inctpigdo.exe" incldxuje.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1FFA2105-45F4-4095-9C28-8957F0EE2A24} inrcscxou.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D60BB36-9375-4149-8F5B-08D6A8266CDE} injrhdzvq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{01C683E5-5963-4371-A2B4-7F5C8F743278} infumgnyd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDC1E760-F304-4b39-9C62-6A29ECCFDB4F}\stubpath = "C:\\Windows\\system32\\inloiwrfv.exe" inpeapdzu.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{03AA59A2-45E8-47aa-AB91-34C032AB22F2} intfwsljg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6A218162-8532-421c-A0D6-F41FA8DA80F2}\stubpath = "C:\\Windows\\system32\\inkfaovfk.exe" innvcvbrm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0D5DE1D5-52E9-4a09-BA0F-7CD39262B7B2} inhomdgwi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{934F9F5D-24E7-4b06-85B9-EF93529B9A11} injqftzfq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D33807BC-65A8-4781-8B10-B7D48C4817FE} inhnmoqun.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34E626EF-08FF-443b-BD94-76AC48E5B482} inwikshbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48C22510-FE21-4bf8-A79A-0BDC34878DAB} intuwvzao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C5BB2289-95D8-4476-8387-AEC4F39E19F1}\stubpath = "C:\\Windows\\system32\\inuhmcksg.exe" inupkqjvx.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000011371-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 4348 inqcxrfhg.exe 1272 inlsmacbt.exe 4180 insezthji.exe 4752 incgzwjvl.exe 3964 inogwahsa.exe 4872 inugvjlkd.exe 3516 injyqkarh.exe 1580 inqtvunam.exe 4524 inzvgovkd.exe 804 inldtepix.exe 5468 inyorihpp.exe 4140 inaexuhtj.exe 4456 inqmfrmyb.exe 4532 invrckwrg.exe 4976 inwhpwale.exe 6096 inmeufqjy.exe 5124 incrjzdkv.exe 3716 insbquvhx.exe 2236 inmtnbdcu.exe 1240 inrdysgih.exe 1780 inwixlnmf.exe 2240 injmdckxk.exe 1060 injkrqgyq.exe 2948 invhwkmle.exe 5012 inefvmlzb.exe 4336 inejnhnnw.exe 3244 indwztgsi.exe 1752 inhwnltjf.exe 2632 inazpsjiq.exe 2408 ineuxonvv.exe 3380 inknedlyl.exe 1716 inqklaasr.exe 1084 inpqffxwb.exe 5168 innqsrkjz.exe 2688 insvxwpco.exe 3148 ingiuiufd.exe 5344 injhulmow.exe 3184 inomzqrdt.exe 4088 intcrvwiy.exe 3376 infgwnmcy.exe 1196 inhzrfkoi.exe 2656 inmawkptn.exe 1480 inumafjdj.exe 5372 inwsdlxsh.exe 932 indskelwb.exe 5936 inixpjqgj.exe 1428 innuocedv.exe 2388 inbjwysrs.exe 3848 infhthtec.exe 2880 inmprqjiy.exe 4312 inruwvobn.exe 2340 infnwdvwr.exe 3708 ingvzmksi.exe 4236 ineybxzdp.exe 5972 inqjpgzht.exe 4788 inewrcnnk.exe 3880 inbqiycju.exe 8 inbuxzyre.exe 3476 inahuhbcs.exe 4320 inpsutmlb.exe 1920 inadbobmd.exe 5592 ingoxeawx.exe 5552 inpleqlxa.exe 4252 indxawycz.exe - Loads dropped DLL 64 IoCs
pid Process 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe 4348 inqcxrfhg.exe 4348 inqcxrfhg.exe 1272 inlsmacbt.exe 1272 inlsmacbt.exe 4180 insezthji.exe 4180 insezthji.exe 4752 incgzwjvl.exe 4752 incgzwjvl.exe 3964 inogwahsa.exe 3964 inogwahsa.exe 4872 inugvjlkd.exe 4872 inugvjlkd.exe 3516 injyqkarh.exe 3516 injyqkarh.exe 1580 inqtvunam.exe 1580 inqtvunam.exe 4524 inzvgovkd.exe 4524 inzvgovkd.exe 804 inldtepix.exe 804 inldtepix.exe 5468 inyorihpp.exe 5468 inyorihpp.exe 4140 inaexuhtj.exe 4140 inaexuhtj.exe 4456 inqmfrmyb.exe 4456 inqmfrmyb.exe 4532 invrckwrg.exe 4532 invrckwrg.exe 4976 inwhpwale.exe 4976 inwhpwale.exe 6096 inmeufqjy.exe 6096 inmeufqjy.exe 5124 incrjzdkv.exe 5124 incrjzdkv.exe 3716 insbquvhx.exe 3716 insbquvhx.exe 2236 inmtnbdcu.exe 2236 inmtnbdcu.exe 1240 inrdysgih.exe 1240 inrdysgih.exe 1780 inwixlnmf.exe 1780 inwixlnmf.exe 2240 injmdckxk.exe 2240 injmdckxk.exe 1060 injkrqgyq.exe 1060 injkrqgyq.exe 2948 invhwkmle.exe 2948 invhwkmle.exe 5012 inefvmlzb.exe 5012 inefvmlzb.exe 4336 inejnhnnw.exe 4336 inejnhnnw.exe 3244 indwztgsi.exe 3244 indwztgsi.exe 1752 inhwnltjf.exe 1752 inhwnltjf.exe 2632 inazpsjiq.exe 2632 inazpsjiq.exe 2408 ineuxonvv.exe 2408 ineuxonvv.exe 3380 inknedlyl.exe 3380 inknedlyl.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\inazpsjiq.exe_lang.ini inhwnltjf.exe File created C:\Windows\SysWOW64\inyaereiz.exe inrngsnzc.exe File opened for modification C:\Windows\SysWOW64\inomvcziu.exe_lang.ini inwtdautu.exe File created C:\Windows\SysWOW64\inqgdzfrf.exe invuwaxma.exe File created C:\Windows\SysWOW64\inczogbkc.exe inacgtgkr.exe File opened for modification C:\Windows\SysWOW64\inyegtexf.exe_lang.ini ingtjmoji.exe File created C:\Windows\SysWOW64\ingoxeawx.exe inadbobmd.exe File created C:\Windows\SysWOW64\insohtodl.exe inzkcszdo.exe File opened for modification C:\Windows\SysWOW64\inkmpnlpp.exe_lang.ini inrurbsrs.exe File created C:\Windows\SysWOW64\inakrpgjz.exe inngbnczn.exe File opened for modification C:\Windows\SysWOW64\inacgtgkr.exe_lang.ini innrmsqfx.exe File opened for modification C:\Windows\SysWOW64\inrvkfwvq.exe_lang.ini inbsbjtei.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inleqpldr.exe File opened for modification C:\Windows\SysWOW64\inljyapnv.exe_lang.ini inuwftrhn.exe File created C:\Windows\SysWOW64\innfvgrkz.exe inlaxcmgz.exe File created C:\Windows\SysWOW64\inzprbebn.exe inlvjosms.exe File created C:\Windows\SysWOW64\inujlcwuk.exe inghxondz.exe File opened for modification C:\Windows\SysWOW64\innqmfdal.exe_lang.ini inzolinkh.exe File opened for modification C:\Windows\SysWOW64\syslog.dat instvzuyn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbrulkss.exe File created C:\Windows\SysWOW64\inpfzcyeq.exe inpnehxjk.exe File created C:\Windows\SysWOW64\inuytzxmg.exe inemwygil.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inlgwrccv.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqrggyxc.exe File opened for modification C:\Windows\SysWOW64\inxrycagn.exe_lang.ini iniqgcwmo.exe File created C:\Windows\SysWOW64\ineupaato.exe inctpigdo.exe File created C:\Windows\SysWOW64\inauxfdek.exe inmkoozmm.exe File opened for modification C:\Windows\SysWOW64\incbrcegj.exe_lang.ini inligcrtk.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inuiybnpg.exe File created C:\Windows\SysWOW64\incpcgxnb.exe inefvqvoa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inxshctsn.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inulkzdji.exe File opened for modification C:\Windows\SysWOW64\inxiaqxbm.exe_lang.ini indpalewk.exe File created C:\Windows\SysWOW64\inatybwnb.exe inzprbebn.exe File created C:\Windows\SysWOW64\inaqgiwze.exe inxuxrboe.exe File opened for modification C:\Windows\SysWOW64\syslog.dat infbnevol.exe File opened for modification C:\Windows\SysWOW64\inhuwzjax.exe_lang.ini inzhpyfbx.exe File opened for modification C:\Windows\SysWOW64\infrgacrf.exe_lang.ini inkfaovfk.exe File created C:\Windows\SysWOW64\inrfvkmdx.exe inkxmjgli.exe File opened for modification C:\Windows\SysWOW64\insaljfpw.exe_lang.ini inaivxrqr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrxixhwa.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inokbwlsa.exe File created C:\Windows\SysWOW64\inhzpfbvl.exe inlisltat.exe File opened for modification C:\Windows\SysWOW64\innajnacf.exe_lang.ini inpkuzhdr.exe File created C:\Windows\SysWOW64\indqsmlmh.exe inuinrlrc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbqostfv.exe File opened for modification C:\Windows\SysWOW64\inpkvggzd.exe_lang.ini inowqgwxz.exe File created C:\Windows\SysWOW64\inyteppma.exe inebgydau.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inhgwhjlo.exe File created C:\Windows\SysWOW64\inxdmghfn.exe invecggre.exe File opened for modification C:\Windows\SysWOW64\inxdmghfn.exe_lang.ini invecggre.exe File created C:\Windows\SysWOW64\inbmyhvlc.exe inrpyflax.exe File opened for modification C:\Windows\SysWOW64\inrjcgagg.exe_lang.ini ingrakqpr.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inpkvggzd.exe File opened for modification C:\Windows\SysWOW64\inuvxhdct.exe_lang.ini infmbpvbz.exe File created C:\Windows\SysWOW64\inwyoarng.exe incvxxhec.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrgfvgik.exe File opened for modification C:\Windows\SysWOW64\inyctgpxi.exe_lang.ini inhomdgwi.exe File created C:\Windows\SysWOW64\inzvgovkd.exe inqtvunam.exe File created C:\Windows\SysWOW64\incrjzdkv.exe inmeufqjy.exe File created C:\Windows\SysWOW64\innikicxv.exe indlvgkyq.exe File created C:\Windows\SysWOW64\inilcbjwj.exe ingerepgv.exe File created C:\Windows\SysWOW64\inxrqyyst.exe inkwlklan.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invspsmvj.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infmbpvbz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrcangym.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtiwity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injlxlxig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkietvme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhrodsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inebdvara.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlisltat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwhpwale.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innuocedv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxjymong.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkxopbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatybwnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inatwyxqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injyhwnlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfsfaqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbfffozj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniombtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innaftrao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inauxfdek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvkfwvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyazesml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtosnaj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoxlbteg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infbnevol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ininzqfqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkoozmm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invzesqzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuhmcksg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innrmsqfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrtkbsie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvnhoze.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inljyapnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invudbffq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuprejup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inprouzhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language insacfcod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzloqpih.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxnewqnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inergdafx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyaereiz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhegsgsd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhztqfaz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuwegjgs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injtvdfif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invaiaqlz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoyifzki.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ineybxzdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxtemyti.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invgvfzue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuytzxmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inucuflpc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inzvgovkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpqffxwb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inomzqrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhwfuyzl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupkqjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inwsdlxsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykznpoh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injrhdzvq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inoioprby.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuisngbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpnlpp.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe 4348 inqcxrfhg.exe 4348 inqcxrfhg.exe 1272 inlsmacbt.exe 1272 inlsmacbt.exe 4180 insezthji.exe 4180 insezthji.exe 4752 incgzwjvl.exe 4752 incgzwjvl.exe 3964 inogwahsa.exe 3964 inogwahsa.exe 4872 inugvjlkd.exe 4872 inugvjlkd.exe 3516 injyqkarh.exe 3516 injyqkarh.exe 1580 inqtvunam.exe 1580 inqtvunam.exe 4524 inzvgovkd.exe 4524 inzvgovkd.exe 804 inldtepix.exe 804 inldtepix.exe 5468 inyorihpp.exe 5468 inyorihpp.exe 4140 inaexuhtj.exe 4140 inaexuhtj.exe 4456 inqmfrmyb.exe 4456 inqmfrmyb.exe 4532 invrckwrg.exe 4532 invrckwrg.exe 4976 inwhpwale.exe 4976 inwhpwale.exe 6096 inmeufqjy.exe 6096 inmeufqjy.exe 5124 incrjzdkv.exe 5124 incrjzdkv.exe 3716 insbquvhx.exe 3716 insbquvhx.exe 2236 inmtnbdcu.exe 2236 inmtnbdcu.exe 1240 inrdysgih.exe 1240 inrdysgih.exe 1780 inwixlnmf.exe 1780 inwixlnmf.exe 2240 injmdckxk.exe 2240 injmdckxk.exe 1060 injkrqgyq.exe 1060 injkrqgyq.exe 2948 invhwkmle.exe 2948 invhwkmle.exe 5012 inefvmlzb.exe 5012 inefvmlzb.exe 4336 inejnhnnw.exe 4336 inejnhnnw.exe 3244 indwztgsi.exe 3244 indwztgsi.exe 1752 inhwnltjf.exe 1752 inhwnltjf.exe 2632 inazpsjiq.exe 2632 inazpsjiq.exe 2408 ineuxonvv.exe 2408 ineuxonvv.exe 3380 inknedlyl.exe 3380 inknedlyl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 4348 inqcxrfhg.exe Token: SeDebugPrivilege 1272 inlsmacbt.exe Token: SeDebugPrivilege 4180 insezthji.exe Token: SeDebugPrivilege 4752 incgzwjvl.exe Token: SeDebugPrivilege 3964 inogwahsa.exe Token: SeDebugPrivilege 4872 inugvjlkd.exe Token: SeDebugPrivilege 3516 injyqkarh.exe Token: SeDebugPrivilege 1580 inqtvunam.exe Token: SeDebugPrivilege 4524 inzvgovkd.exe Token: SeDebugPrivilege 804 inldtepix.exe Token: SeDebugPrivilege 5468 inyorihpp.exe Token: SeDebugPrivilege 4140 inaexuhtj.exe Token: SeDebugPrivilege 4456 inqmfrmyb.exe Token: SeDebugPrivilege 4532 invrckwrg.exe Token: SeDebugPrivilege 4976 inwhpwale.exe Token: SeDebugPrivilege 6096 inmeufqjy.exe Token: SeDebugPrivilege 5124 incrjzdkv.exe Token: SeDebugPrivilege 3716 insbquvhx.exe Token: SeDebugPrivilege 2236 inmtnbdcu.exe Token: SeDebugPrivilege 1240 inrdysgih.exe Token: SeDebugPrivilege 1780 inwixlnmf.exe Token: SeDebugPrivilege 2240 injmdckxk.exe Token: SeDebugPrivilege 1060 injkrqgyq.exe Token: SeDebugPrivilege 2948 invhwkmle.exe Token: SeDebugPrivilege 5012 inefvmlzb.exe Token: SeDebugPrivilege 4336 inejnhnnw.exe Token: SeDebugPrivilege 3244 indwztgsi.exe Token: SeDebugPrivilege 1752 inhwnltjf.exe Token: SeDebugPrivilege 2632 inazpsjiq.exe Token: SeDebugPrivilege 2408 ineuxonvv.exe Token: SeDebugPrivilege 3380 inknedlyl.exe Token: SeDebugPrivilege 1716 inqklaasr.exe Token: SeDebugPrivilege 1084 inpqffxwb.exe Token: SeDebugPrivilege 5168 innqsrkjz.exe Token: SeDebugPrivilege 2688 insvxwpco.exe Token: SeDebugPrivilege 3148 ingiuiufd.exe Token: SeDebugPrivilege 5344 injhulmow.exe Token: SeDebugPrivilege 3184 inomzqrdt.exe Token: SeDebugPrivilege 4088 intcrvwiy.exe Token: SeDebugPrivilege 3376 infgwnmcy.exe Token: SeDebugPrivilege 1196 inhzrfkoi.exe Token: SeDebugPrivilege 2656 inmawkptn.exe Token: SeDebugPrivilege 1480 inumafjdj.exe Token: SeDebugPrivilege 5372 inwsdlxsh.exe Token: SeDebugPrivilege 932 indskelwb.exe Token: SeDebugPrivilege 5936 inixpjqgj.exe Token: SeDebugPrivilege 1428 innuocedv.exe Token: SeDebugPrivilege 2388 inbjwysrs.exe Token: SeDebugPrivilege 3848 infhthtec.exe Token: SeDebugPrivilege 2880 inmprqjiy.exe Token: SeDebugPrivilege 4312 inruwvobn.exe Token: SeDebugPrivilege 2340 infnwdvwr.exe Token: SeDebugPrivilege 3708 ingvzmksi.exe Token: SeDebugPrivilege 4236 ineybxzdp.exe Token: SeDebugPrivilege 5972 inqjpgzht.exe Token: SeDebugPrivilege 4788 inewrcnnk.exe Token: SeDebugPrivilege 3880 inbqiycju.exe Token: SeDebugPrivilege 8 inbuxzyre.exe Token: SeDebugPrivilege 3476 inahuhbcs.exe Token: SeDebugPrivilege 4320 inpsutmlb.exe Token: SeDebugPrivilege 1920 inadbobmd.exe Token: SeDebugPrivilege 5592 ingoxeawx.exe Token: SeDebugPrivilege 5552 inpleqlxa.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe 4348 inqcxrfhg.exe 1272 inlsmacbt.exe 4180 insezthji.exe 4752 incgzwjvl.exe 3964 inogwahsa.exe 4872 inugvjlkd.exe 3516 injyqkarh.exe 1580 inqtvunam.exe 4524 inzvgovkd.exe 804 inldtepix.exe 5468 inyorihpp.exe 4140 inaexuhtj.exe 4456 inqmfrmyb.exe 4532 invrckwrg.exe 4976 inwhpwale.exe 6096 inmeufqjy.exe 5124 incrjzdkv.exe 3716 insbquvhx.exe 2236 inmtnbdcu.exe 1240 inrdysgih.exe 1780 inwixlnmf.exe 2240 injmdckxk.exe 1060 injkrqgyq.exe 2948 invhwkmle.exe 5012 inefvmlzb.exe 4336 inejnhnnw.exe 3244 indwztgsi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 4348 1572 2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe 90 PID 4348 wrote to memory of 1272 4348 inqcxrfhg.exe 91 PID 1272 wrote to memory of 4180 1272 inlsmacbt.exe 92 PID 4180 wrote to memory of 4752 4180 insezthji.exe 93 PID 4752 wrote to memory of 3964 4752 incgzwjvl.exe 94 PID 3964 wrote to memory of 4872 3964 inogwahsa.exe 95 PID 4872 wrote to memory of 3516 4872 inugvjlkd.exe 96 PID 3516 wrote to memory of 1580 3516 injyqkarh.exe 97 PID 1580 wrote to memory of 4524 1580 inqtvunam.exe 98 PID 4524 wrote to memory of 804 4524 inzvgovkd.exe 99 PID 804 wrote to memory of 5468 804 inldtepix.exe 100 PID 5468 wrote to memory of 4140 5468 inyorihpp.exe 101 PID 4140 wrote to memory of 4456 4140 inaexuhtj.exe 102 PID 4456 wrote to memory of 4532 4456 inqmfrmyb.exe 103 PID 4532 wrote to memory of 4976 4532 invrckwrg.exe 104 PID 4976 wrote to memory of 6096 4976 inwhpwale.exe 105 PID 6096 wrote to memory of 5124 6096 inmeufqjy.exe 106 PID 5124 wrote to memory of 3716 5124 incrjzdkv.exe 107 PID 3716 wrote to memory of 2236 3716 insbquvhx.exe 108 PID 2236 wrote to memory of 1240 2236 inmtnbdcu.exe 109 PID 1240 wrote to memory of 1780 1240 inrdysgih.exe 110 PID 1780 wrote to memory of 2240 1780 inwixlnmf.exe 111 PID 2240 wrote to memory of 1060 2240 injmdckxk.exe 112 PID 1060 wrote to memory of 2948 1060 injkrqgyq.exe 113 PID 2948 wrote to memory of 5012 2948 invhwkmle.exe 114 PID 5012 wrote to memory of 4336 5012 inefvmlzb.exe 115 PID 4336 wrote to memory of 3244 4336 inejnhnnw.exe 116 PID 3244 wrote to memory of 1752 3244 indwztgsi.exe 117 PID 1752 wrote to memory of 2632 1752 inhwnltjf.exe 118 PID 2632 wrote to memory of 2408 2632 inazpsjiq.exe 119 PID 2408 wrote to memory of 3380 2408 ineuxonvv.exe 120 PID 3380 wrote to memory of 1716 3380 inknedlyl.exe 121 PID 1716 wrote to memory of 1084 1716 inqklaasr.exe 122 PID 1084 wrote to memory of 5168 1084 inpqffxwb.exe 123 PID 5168 wrote to memory of 2688 5168 innqsrkjz.exe 124 PID 2688 wrote to memory of 3148 2688 insvxwpco.exe 125 PID 3148 wrote to memory of 5344 3148 ingiuiufd.exe 126 PID 5344 wrote to memory of 3184 5344 injhulmow.exe 127 PID 3184 wrote to memory of 4088 3184 inomzqrdt.exe 128 PID 4088 wrote to memory of 3376 4088 intcrvwiy.exe 129 PID 3376 wrote to memory of 1196 3376 infgwnmcy.exe 130 PID 1196 wrote to memory of 2656 1196 inhzrfkoi.exe 131 PID 2656 wrote to memory of 1480 2656 inmawkptn.exe 132 PID 1480 wrote to memory of 5372 1480 inumafjdj.exe 133 PID 5372 wrote to memory of 932 5372 inwsdlxsh.exe 134 PID 932 wrote to memory of 5936 932 indskelwb.exe 135 PID 5936 wrote to memory of 1428 5936 inixpjqgj.exe 136 PID 1428 wrote to memory of 2388 1428 innuocedv.exe 137 PID 2388 wrote to memory of 3848 2388 inbjwysrs.exe 138 PID 3848 wrote to memory of 2880 3848 infhthtec.exe 139 PID 2880 wrote to memory of 4312 2880 inmprqjiy.exe 140 PID 4312 wrote to memory of 2340 4312 inruwvobn.exe 141 PID 2340 wrote to memory of 3708 2340 infnwdvwr.exe 142 PID 3708 wrote to memory of 4236 3708 ingvzmksi.exe 143 PID 4236 wrote to memory of 5972 4236 ineybxzdp.exe 144 PID 5972 wrote to memory of 4788 5972 inqjpgzht.exe 145 PID 4788 wrote to memory of 3880 4788 inewrcnnk.exe 146 PID 3880 wrote to memory of 8 3880 inbqiycju.exe 147 PID 8 wrote to memory of 3476 8 inbuxzyre.exe 148 PID 3476 wrote to memory of 4320 3476 inahuhbcs.exe 149 PID 4320 wrote to memory of 1920 4320 inpsutmlb.exe 150 PID 1920 wrote to memory of 5592 1920 inadbobmd.exe 151 PID 5592 wrote to memory of 5552 5592 ingoxeawx.exe 152 PID 5552 wrote to memory of 4252 5552 inpleqlxa.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_2bce5bd652327faf928f170edd4a3115_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\system32\insezthji.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe16⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\system32\inmeufqjy.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe19⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe21⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\injkrqgyq.exeC:\Windows\system32\injkrqgyq.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\system32\inefvmlzb.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\inejnhnnw.exeC:\Windows\system32\inejnhnnw.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\system32\inhwnltjf.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe30⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\system32\ineuxonvv.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\inknedlyl.exeC:\Windows\system32\inknedlyl.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\inqklaasr.exeC:\Windows\system32\inqklaasr.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\system32\inpqffxwb.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\system32\insvxwpco.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\infgwnmcy.exeC:\Windows\system32\infgwnmcy.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\inhzrfkoi.exeC:\Windows\system32\inhzrfkoi.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\system32\inmawkptn.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\inumafjdj.exeC:\Windows\system32\inumafjdj.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\system32\inixpjqgj.exe47⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\system32\ineybxzdp.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\system32\inahuhbcs.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe62⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe63⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe65⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe66⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2508 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe67⤵PID:4352
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe68⤵PID:3248
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe69⤵PID:1228
-
C:\Windows\SysWOW64\intetdxsy.exeC:\Windows\system32\intetdxsy.exe70⤵PID:5960
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\system32\inxtleici.exe71⤵PID:2512
-
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe72⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5608 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\system32\inyufnzuj.exe73⤵PID:5796
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\system32\inaikwkwh.exe74⤵PID:5276
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe75⤵
- Drops file in System32 directory
PID:3360 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe76⤵PID:4360
-
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe77⤵
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Windows\SysWOW64\injsnioht.exeC:\Windows\system32\injsnioht.exe78⤵PID:2348
-
C:\Windows\SysWOW64\inooxsntm.exeC:\Windows\system32\inooxsntm.exe79⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5088 -
C:\Windows\SysWOW64\incbrdfjw.exeC:\Windows\system32\incbrdfjw.exe80⤵PID:860
-
C:\Windows\SysWOW64\inrngsnzc.exeC:\Windows\system32\inrngsnzc.exe81⤵
- Drops file in System32 directory
PID:3008 -
C:\Windows\SysWOW64\inyaereiz.exeC:\Windows\system32\inyaereiz.exe82⤵
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Windows\SysWOW64\incajnuiq.exeC:\Windows\system32\incajnuiq.exe83⤵PID:4488
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\system32\inirmhzng.exe84⤵PID:3824
-
C:\Windows\SysWOW64\inrmslxzd.exeC:\Windows\system32\inrmslxzd.exe85⤵PID:3196
-
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe86⤵
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\SysWOW64\inzkcszdo.exeC:\Windows\system32\inzkcszdo.exe87⤵
- Drops file in System32 directory
PID:4880 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe88⤵PID:3596
-
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\system32\inbaqtkjr.exe89⤵PID:3308
-
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe90⤵PID:872
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\system32\inxsdoolp.exe91⤵PID:2164
-
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe92⤵PID:3788
-
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\system32\incsvmltt.exe93⤵PID:2744
-
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe94⤵PID:1880
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe95⤵PID:4156
-
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe96⤵PID:616
-
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe97⤵PID:2432
-
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe98⤵PID:4288
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe99⤵PID:5064
-
C:\Windows\SysWOW64\injyhwnlt.exeC:\Windows\system32\injyhwnlt.exe100⤵
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Windows\SysWOW64\inrlmbbts.exeC:\Windows\system32\inrlmbbts.exe101⤵PID:1980
-
C:\Windows\SysWOW64\infslrijv.exeC:\Windows\system32\infslrijv.exe102⤵PID:2420
-
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe103⤵PID:2692
-
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe104⤵PID:4856
-
C:\Windows\SysWOW64\incwvxbyn.exeC:\Windows\system32\incwvxbyn.exe105⤵PID:1812
-
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe106⤵
- Boot or Logon Autostart Execution: Active Setup
PID:4632 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\system32\indhxkwmb.exe107⤵PID:5932
-
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\system32\intpaiupe.exe108⤵PID:1276
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe109⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Windows\SysWOW64\inbjudnts.exeC:\Windows\system32\inbjudnts.exe110⤵PID:1156
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\system32\inmibthrw.exe111⤵PID:3136
-
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe112⤵PID:5812
-
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe113⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\system32\inpbwqegf.exe114⤵PID:5744
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\system32\innoddvuk.exe115⤵PID:3384
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe116⤵PID:6140
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe117⤵PID:956
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe118⤵
- System Location Discovery: System Language Discovery
PID:5224 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe119⤵
- System Location Discovery: System Language Discovery
PID:5396 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\system32\inmkxopbr.exe120⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe121⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-