Analysis
- max time kernel
80s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 12:18
Behavioral task
behavioral1
Sample
2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe
- Size 912KB
- Sample260729-pgkf6atele
- SHA256 fa2f81eaaa9249287e2154711958ca32bc2a48b7adea60b767217ad98fc50854
- MD5 7f01c9a5362749d88bc468ef354f7804
- SHA1 ff3dfc71606c1d88e2b0eb1bf7248d6df45f5a1a
- SHA512 9c536d15d7404a3c490d867f8b45751715b99148b16a47232586978c9010d3e910d4b9cb8846f0f1ac1b9555acfde2eaaad64971edd07f2c3df3e8732cfe4aa3
- SSDEEP 24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWTu:RPjOa1NxyYtH1u
- TLSH T1F915AE807B40CAF1E27C73BC11725B7DDB792AF66E36A5635BCCE7C92AAB140D611201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 49 IoCs
resource yara_rule behavioral2/memory/3076-0-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4c5-20.dat family_gh0strat behavioral2/memory/3076-24-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4cb-40.dat family_gh0strat behavioral2/memory/2020-47-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4ca-31.dat family_gh0strat behavioral2/files/0x000d00000001c4cf-64.dat family_gh0strat behavioral2/memory/4324-69-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d2-86.dat family_gh0strat behavioral2/memory/2720-90-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4d6-107.dat family_gh0strat behavioral2/memory/3312-111-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4da-129.dat family_gh0strat behavioral2/memory/4892-134-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4de-151.dat family_gh0strat behavioral2/memory/472-156-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c4e2-174.dat family_gh0strat behavioral2/files/0x000d00000001c4f1-196.dat family_gh0strat behavioral2/files/0x000d00000001c4f5-218.dat family_gh0strat behavioral2/files/0x000d00000001c4f9-240.dat family_gh0strat behavioral2/files/0x000d00000001c4fd-262.dat family_gh0strat behavioral2/memory/796-332-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000c00000001c50d-350.dat family_gh0strat behavioral2/memory/4716-534-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4392-624-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5404-606-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4252-588-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/6048-570-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3860-552-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5820-516-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4104-498-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2492-480-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/5372-462-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4176-444-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1588-426-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1740-408-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2508-390-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1428-372-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/4820-354-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c509-328.dat family_gh0strat behavioral2/memory/1132-310-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c505-306.dat family_gh0strat behavioral2/memory/3664-288-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/files/0x000d00000001c501-284.dat family_gh0strat behavioral2/memory/620-265-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/3468-244-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1168-222-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/2476-200-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat behavioral2/memory/1872-178-0x0000000000400000-0x000000000042F000-memory.dmp family_gh0strat - Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F217EDA9-2AE0-4001-A64A-4387D7880032} inxgusiod.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E1DD5EE-4AD2-4e85-BBEA-75111073EE85} inymcufhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD1E84C6-E698-4cac-A715-055B71E510DF}\stubpath = "C:\\Windows\\system32\\inipelkjl.exe" ingtjmoji.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFDF8A5B-D961-4d54-9518-0B1E358AF85C} inixpjqgj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5907591C-43EC-4b18-B86B-8AF16FA47027}\stubpath = "C:\\Windows\\system32\\inlmnyysj.exe" inuytzxmg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA9171E0-6F3B-429a-8937-C52203DEAA21} inipelkjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA701EBB-98BF-4733-803F-1C2E863D0C4B}\stubpath = "C:\\Windows\\system32\\inwjfatav.exe" inbjdjvkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3DBE4392-4D6C-4092-A35C-825454D74BC5} inrfvkmdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8A949FD2-ADCD-44b4-B3B6-AB558B288787}\stubpath = "C:\\Windows\\system32\\inwskdhbh.exe" inscqyokc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A799F747-F434-449a-8E7B-80827726D20E} inqgyjlgf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AC4066B0-FEED-4bf2-8F4B-4AFF02FCCF58} inmkxopbr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CEF9346-260A-4a98-BE6F-207EEE0A3E35} injfevnir.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A12AEAA2-58E3-4fc3-8F75-1B80AC9CD059}\stubpath = "C:\\Windows\\system32\\inrtwgusw.exe" inhgfxhuk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E9099A1C-DCBF-41c5-8C2F-A08124EF1362} inljswfrz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F2A69E0F-3B49-4a89-855A-4946EC151387} inupkqjvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{289C6126-B312-4d72-BBD7-8F731F2D519C}\stubpath = "C:\\Windows\\system32\\insrzztuj.exe" inqjpgzht.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8700BF10-4E00-449b-9236-0F46E1337C83} invfrxfpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ED7C0CBD-5F24-4bf9-9E82-438437C6B1CB}\stubpath = "C:\\Windows\\system32\\inxavmale.exe" indhodkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{64544C4D-8099-4288-9EEF-0361A9BC8DA0}\stubpath = "C:\\Windows\\system32\\innvfndjn.exe" inhhujgdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5F91D3DA-FB52-42a1-8027-0FED8241D3A7}\stubpath = "C:\\Windows\\system32\\inrjcgagg.exe" inqklaasr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{639B12B0-6728-4f2b-BE2B-3863EC876981}\stubpath = "C:\\Windows\\system32\\innswqwhw.exe" insywlfel.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{554E45BB-47BE-4c17-A883-0166A4829B34} iniszdhvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F09F0D1D-A459-452b-93B8-3702C06A4DB0}\stubpath = "C:\\Windows\\system32\\insnyjjgx.exe" inblsqhkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C44B551C-879B-4b93-A9A1-004B6C3727EE} inatwyxqd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B1DB0D0-D5B9-41a2-8CA2-017406B401F8}\stubpath = "C:\\Windows\\system32\\inulkzdji.exe" incehxwfd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{783BF943-F63C-4835-B819-CD8FDD7E099A} inbuzcxoc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{783E4C16-B650-44de-B2A6-915FA80B27EE}\stubpath = "C:\\Windows\\system32\\inkxmjgli.exe" incbskfog.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD018FA5-2CDA-49e9-8F88-5F0B4940C62F} invowdwcs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD41D22E-67AB-498a-B1E3-C7AEC475B1AD} inbqiycju.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D38E669-E235-4dde-8ECE-AECDC484D751}\stubpath = "C:\\Windows\\system32\\ingwzqpxx.exe" inhegsgsd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{682AEC4A-BD33-4fd3-BF97-220A75F43D82} injhulmow.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9704A47A-5CAE-4d42-A543-22225FEADD0D}\stubpath = "C:\\Windows\\system32\\infvqbbup.exe" inrshhzyd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31E02D41-2F67-4ddb-80BD-CA938DF0648A} incawvwly.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{810817E0-BF97-4e12-8BD0-DCFFDAE3C122} inortslka.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51C9B392-B1BE-479a-882E-5B6207AE1609}\stubpath = "C:\\Windows\\system32\\inztkqidm.exe" inboqtdrp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{71459363-EE62-497b-87E4-29311405ED83}\stubpath = "C:\\Windows\\system32\\inxujybfr.exe" inuaizlgb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3585F16F-1B93-474c-8FE7-F898BD4ABB60} inetlfmxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{414B45D8-84F5-43d5-8232-82BDEEA9D9AE} inwixlnmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7EB58089-2620-4dcf-9413-2217EA740A43} invnbgkek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{061077F7-1A3B-4a50-BB82-44D190DB3127}\stubpath = "C:\\Windows\\system32\\invdmeyvk.exe" inhbuwzwg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{02766043-F150-45f0-B04F-869EB5ADC703} ingtgabri.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C93EE2D-7DCB-4e94-BD4E-AF72A58B054E} infsuonoj.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C0EEC75E-F5BB-4286-B4CD-0DBFF6691FE9} inimthpzj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1EE669C-B4D0-48b8-BED5-97CE94DB8489}\stubpath = "C:\\Windows\\system32\\inpkuzhdr.exe" ineguxzcg.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{730C009E-E42C-4a54-BEAE-3E653C42F3EF} inpnehxjk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E91EEF63-5CAB-483f-9954-624CC6766766} inejnhnnw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91CC2920-FF2B-4477-85E6-88A0B27A0BC2} inewhnrej.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F6337C54-1D63-44bc-9429-596F500B2850} inujlcwuk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10229EF3-C482-4281-A960-2F013FADEEE6}\stubpath = "C:\\Windows\\system32\\inwrmkgem.exe" inqxvmprs.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D9C1AEC-DA0E-4b76-AF48-A34ED98EA40A} ineqbmfxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E5F98077-F12A-4f2b-9605-1F4C550A85A5} inzuolauz.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A59B4106-C7D6-452e-82A7-3E24341FD209} inkbaivic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{18388FAA-13F0-419f-B41F-9DB9619BFEAD}\stubpath = "C:\\Windows\\system32\\inrdysgih.exe" inmtnbdcu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{91CC2920-FF2B-4477-85E6-88A0B27A0BC2}\stubpath = "C:\\Windows\\system32\\innusjmop.exe" inewhnrej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2943AEC-F147-4ce8-BBF5-0D51D9DF9B51}\stubpath = "C:\\Windows\\system32\\inligcrtk.exe" intojzuff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C709993-842C-409c-933B-D8DF397B009C}\stubpath = "C:\\Windows\\system32\\iniizepdz.exe" inhfbqsjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10229EF3-C482-4281-A960-2F013FADEEE6} inqxvmprs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{217C1F9B-DB70-4fdc-B557-381ABCA7D775}\stubpath = "C:\\Windows\\system32\\inwtdautu.exe" inzhpyfbx.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34E24A95-025F-402f-898E-E73EF381B7C2} inhxjlpig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD41D22E-67AB-498a-B1E3-C7AEC475B1AD}\stubpath = "C:\\Windows\\system32\\ingvnhoze.exe" inbqiycju.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECBC1A25-D86F-4efa-B87E-DBB4A4153324}\stubpath = "C:\\Windows\\system32\\inqmfrmyb.exe" ingvnhoze.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CAF0E4B-D45A-47a8-BAC5-54C74A6EA7DA} inisucehe.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4F782D4-B3A9-44b7-9187-43FB03D08772} inmgmynpz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36347FCF-56C3-49bf-9D1A-B8EF23E9F0E9}\stubpath = "C:\\Windows\\system32\\infniwngs.exe" iniaooxbd.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000001b83c-4.dat acprotect - Executes dropped EXE 64 IoCs
pid Process 2020 inbfyviuk.exe 4324 inetlfmxc.exe 2720 inlsmacbt.exe 3312 invrckwrg.exe 4892 inxiaqxbm.exe 472 inomzqrdt.exe 1872 inwhpwale.exe 2476 innuocedv.exe 1168 inbuxzyre.exe 3468 inkzrlbas.exe 620 inruwvobn.exe 3664 inzvgovkd.exe 1132 innqsrkjz.exe 796 infdqdofu.exe 4820 inykznpoh.exe 1428 inbqiycju.exe 2508 ingvnhoze.exe 1740 inqmfrmyb.exe 1588 incrjzdkv.exe 4176 inhwoipfi.exe 5372 insohtodl.exe 2492 inesqmezb.exe 4104 injyqkarh.exe 5820 inoavpdfe.exe 4716 incvyzsfr.exe 3860 inldtepix.exe 6048 inqgdzfrf.exe 4252 inmprqjiy.exe 5404 inbjwysrs.exe 4392 inxjymong.exe 2628 injwnoaqy.exe 4212 inbbkvfva.exe 1600 inkbaivic.exe 3012 inqtvunam.exe 3676 inhegsgsd.exe 3028 ingwzqpxx.exe 1572 incanalcr.exe 2672 intcrvwiy.exe 4992 inlofemzm.exe 3248 inrcangym.exe 5044 inyjbrycn.exe 4836 ingtvpopk.exe 4752 inxtemyti.exe 2004 indtkzjxv.exe 6032 inogwahsa.exe 1252 inwsdlxsh.exe 1312 inaexuhtj.exe 4336 injhulmow.exe 6000 inqcxrfhg.exe 2732 ingiuiufd.exe 4088 inertnmni.exe 1980 indxawycz.exe 3452 indwztgsi.exe 3392 inmtnbdcu.exe 4144 inrdysgih.exe 204 inhjvjvge.exe 1288 inljyapnv.exe 5968 insbquvhx.exe 236 ingvzmksi.exe 2884 inpsutmlb.exe 2796 inqjpgzht.exe 4952 insrzztuj.exe 3968 inocokdvj.exe 2328 invhwkmle.exe - Loads dropped DLL 64 IoCs
pid Process 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe 2020 inbfyviuk.exe 2020 inbfyviuk.exe 4324 inetlfmxc.exe 4324 inetlfmxc.exe 2720 inlsmacbt.exe 2720 inlsmacbt.exe 3312 invrckwrg.exe 3312 invrckwrg.exe 4892 inxiaqxbm.exe 4892 inxiaqxbm.exe 472 inomzqrdt.exe 472 inomzqrdt.exe 1872 inwhpwale.exe 1872 inwhpwale.exe 2476 innuocedv.exe 2476 innuocedv.exe 1168 inbuxzyre.exe 1168 inbuxzyre.exe 3468 inkzrlbas.exe 3468 inkzrlbas.exe 620 inruwvobn.exe 620 inruwvobn.exe 3664 inzvgovkd.exe 3664 inzvgovkd.exe 1132 innqsrkjz.exe 1132 innqsrkjz.exe 796 infdqdofu.exe 796 infdqdofu.exe 4820 inykznpoh.exe 4820 inykznpoh.exe 1428 inbqiycju.exe 1428 inbqiycju.exe 2508 ingvnhoze.exe 2508 ingvnhoze.exe 1740 inqmfrmyb.exe 1740 inqmfrmyb.exe 1588 incrjzdkv.exe 1588 incrjzdkv.exe 4176 inhwoipfi.exe 4176 inhwoipfi.exe 5372 insohtodl.exe 5372 insohtodl.exe 2492 inesqmezb.exe 2492 inesqmezb.exe 4104 injyqkarh.exe 4104 injyqkarh.exe 5820 inoavpdfe.exe 5820 inoavpdfe.exe 4716 incvyzsfr.exe 4716 incvyzsfr.exe 3860 inldtepix.exe 3860 inldtepix.exe 6048 inqgdzfrf.exe 6048 inqgdzfrf.exe 4252 inmprqjiy.exe 4252 inmprqjiy.exe 5404 inbjwysrs.exe 5404 inbjwysrs.exe 4392 inxjymong.exe 4392 inxjymong.exe 2628 injwnoaqy.exe 2628 injwnoaqy.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\syslog.dat inbuxzyre.exe File opened for modification C:\Windows\SysWOW64\iniaooxbd.exe_lang.ini inepndjtb.exe File opened for modification C:\Windows\SysWOW64\indxawycz.exe_lang.ini inertnmni.exe File opened for modification C:\Windows\SysWOW64\iniwaqpwa.exe_lang.ini injfdlthy.exe File created C:\Windows\SysWOW64\infudswxj.exe inapnrseu.exe File opened for modification C:\Windows\SysWOW64\indscwrxb.exe_lang.ini inikbvtjp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inoxlbteg.exe File opened for modification C:\Windows\SysWOW64\ineqbmfxl.exe_lang.ini injfevnir.exe File created C:\Windows\SysWOW64\intlkfhrk.exe indzleble.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indzleble.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inbbkvfva.exe File created C:\Windows\SysWOW64\inoxlbteg.exe inimthpzj.exe File created C:\Windows\SysWOW64\inktojpiu.exe indtfhlye.exe File opened for modification C:\Windows\SysWOW64\iniszaxor.exe_lang.ini inisglpjp.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indnibrwr.exe File opened for modification C:\Windows\SysWOW64\ingwzqpxx.exe_lang.ini inhegsgsd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat invqmdynu.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwldhtuf.exe File opened for modification C:\Windows\SysWOW64\incjmswjo.exe_lang.ini inxsdoolp.exe File opened for modification C:\Windows\SysWOW64\incqysiyz.exe_lang.ini infacmfam.exe File created C:\Windows\SysWOW64\inbfyviuk.exe 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe File opened for modification C:\Windows\SysWOW64\inazpsjiq.exe_lang.ini injyixbhg.exe File opened for modification C:\Windows\SysWOW64\inoropope.exe_lang.ini inpprolqn.exe File created C:\Windows\SysWOW64\inyjbrycn.exe inrcangym.exe File created C:\Windows\SysWOW64\inuqbjvqf.exe inzloqpih.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwmcsiky.exe File created C:\Windows\SysWOW64\inujlcwuk.exe inhwnltjf.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indtyatrn.exe File opened for modification C:\Windows\SysWOW64\infhthtec.exe_lang.ini inatybwnb.exe File created C:\Windows\SysWOW64\inmflkmos.exe inilcbjwj.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inrbvqwap.exe File opened for modification C:\Windows\SysWOW64\syslog.dat indzyzoqh.exe File created C:\Windows\SysWOW64\instvzuyn.exe incybtpgq.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inwtyvsvp.exe File created C:\Windows\SysWOW64\infmbpvbz.exe inecpcnet.exe File created C:\Windows\SysWOW64\infacmfam.exe iniszdhvx.exe File opened for modification C:\Windows\SysWOW64\invmdukgq.exe_lang.ini inbsbjtei.exe File created C:\Windows\SysWOW64\inesqmezb.exe insohtodl.exe File created C:\Windows\SysWOW64\innnpmjol.exe intndtuwg.exe File opened for modification C:\Windows\SysWOW64\inpwglkgm.exe_lang.ini injyiwuqi.exe File opened for modification C:\Windows\SysWOW64\inspmpjxs.exe_lang.ini inntygqax.exe File opened for modification C:\Windows\SysWOW64\insgoyikn.exe_lang.ini inrcscxou.exe File created C:\Windows\SysWOW64\inogwahsa.exe indtkzjxv.exe File opened for modification C:\Windows\SysWOW64\inzloqpih.exe_lang.ini inugvjlkd.exe File opened for modification C:\Windows\SysWOW64\syslog.dat injyiwuqi.exe File opened for modification C:\Windows\SysWOW64\inpljrdzf.exe_lang.ini inyazesml.exe File opened for modification C:\Windows\SysWOW64\incraptug.exe_lang.ini intpaiupe.exe File opened for modification C:\Windows\SysWOW64\inuiybnpg.exe_lang.ini invpovkyk.exe File created C:\Windows\SysWOW64\inwanaevl.exe inclpwksm.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inyazesml.exe File created C:\Windows\SysWOW64\insrzztuj.exe inqjpgzht.exe File opened for modification C:\Windows\SysWOW64\inzkcszdo.exe_lang.ini inaqceivb.exe File opened for modification C:\Windows\SysWOW64\inhbuwzwg.exe_lang.ini inbkyszdb.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inqswbpnw.exe File created C:\Windows\SysWOW64\inzuolauz.exe incbrdfjw.exe File created C:\Windows\SysWOW64\inrbrocsh.exe inbmmjnwc.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inogxmhdp.exe File created C:\Windows\SysWOW64\inxshctsn.exe inzzjgeaz.exe File created C:\Windows\SysWOW64\ingatvyvf.exe ingfvhjng.exe File created C:\Windows\SysWOW64\intfuikjc.exe inqnbrgit.exe File opened for modification C:\Windows\SysWOW64\inaqceivb.exe_lang.ini inejnhnnw.exe File created C:\Windows\SysWOW64\iniwaqpwa.exe injfdlthy.exe File opened for modification C:\Windows\SysWOW64\syslog.dat inknedlyl.exe File opened for modification C:\Windows\SysWOW64\inmwepkwe.exe_lang.ini inncqdlgu.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innlypqcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvzmksi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhzpfbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inewhnrej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrvqwujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innvcvbrm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmjhdsul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkzrlbas.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbpxnjbw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inpeyhpif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inarenvge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmtiwity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbmyhvlc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indnibrwr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inkmpmynm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrshhzyd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inrbvqwap.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoqadam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvfeugi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inykxcqol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injausioy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inlhpjpqs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtgabri.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingvetxyk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyoeaukm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infhfyusg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inilcbjwj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inadbobmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invnbgkek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language innoddvuk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingtjmoji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inufueytz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injwylczx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language incsdfhkz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inapnrseu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inngmlnpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupalliz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqzfhsqg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inyccnaan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ingxqnxqy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inirveqyf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inhfsfaqh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbohznex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqzaupvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inasgqvzt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inmkimmxk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inbymawrk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inniyteex.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inupkqjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inclwgwbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxbftvlo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxhvtpha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inejnhnnw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inaphxbit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inionprva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infrfqjpo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inxsdoolp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inqrggyxc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indtfhlye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language indryibnm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inutvwllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language infnxzhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inuytzxmg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language invlhtipl.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe 2020 inbfyviuk.exe 2020 inbfyviuk.exe 4324 inetlfmxc.exe 4324 inetlfmxc.exe 2720 inlsmacbt.exe 2720 inlsmacbt.exe 3312 invrckwrg.exe 3312 invrckwrg.exe 4892 inxiaqxbm.exe 4892 inxiaqxbm.exe 472 inomzqrdt.exe 472 inomzqrdt.exe 1872 inwhpwale.exe 1872 inwhpwale.exe 2476 innuocedv.exe 2476 innuocedv.exe 1168 inbuxzyre.exe 1168 inbuxzyre.exe 3468 inkzrlbas.exe 3468 inkzrlbas.exe 620 inruwvobn.exe 620 inruwvobn.exe 3664 inzvgovkd.exe 3664 inzvgovkd.exe 1132 innqsrkjz.exe 1132 innqsrkjz.exe 796 infdqdofu.exe 796 infdqdofu.exe 4820 inykznpoh.exe 4820 inykznpoh.exe 1428 inbqiycju.exe 1428 inbqiycju.exe 2508 ingvnhoze.exe 2508 ingvnhoze.exe 1740 inqmfrmyb.exe 1740 inqmfrmyb.exe 1588 incrjzdkv.exe 1588 incrjzdkv.exe 4176 inhwoipfi.exe 4176 inhwoipfi.exe 5372 insohtodl.exe 5372 insohtodl.exe 2492 inesqmezb.exe 2492 inesqmezb.exe 4104 injyqkarh.exe 4104 injyqkarh.exe 5820 inoavpdfe.exe 5820 inoavpdfe.exe 4716 incvyzsfr.exe 4716 incvyzsfr.exe 3860 inldtepix.exe 3860 inldtepix.exe 6048 inqgdzfrf.exe 6048 inqgdzfrf.exe 4252 inmprqjiy.exe 4252 inmprqjiy.exe 5404 inbjwysrs.exe 5404 inbjwysrs.exe 4392 inxjymong.exe 4392 inxjymong.exe 2628 injwnoaqy.exe 2628 injwnoaqy.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe Token: SeDebugPrivilege 2020 inbfyviuk.exe Token: SeDebugPrivilege 4324 inetlfmxc.exe Token: SeDebugPrivilege 2720 inlsmacbt.exe Token: SeDebugPrivilege 3312 invrckwrg.exe Token: SeDebugPrivilege 4892 inxiaqxbm.exe Token: SeDebugPrivilege 472 inomzqrdt.exe Token: SeDebugPrivilege 1872 inwhpwale.exe Token: SeDebugPrivilege 2476 innuocedv.exe Token: SeDebugPrivilege 1168 inbuxzyre.exe Token: SeDebugPrivilege 3468 inkzrlbas.exe Token: SeDebugPrivilege 620 inruwvobn.exe Token: SeDebugPrivilege 3664 inzvgovkd.exe Token: SeDebugPrivilege 1132 innqsrkjz.exe Token: SeDebugPrivilege 796 infdqdofu.exe Token: SeDebugPrivilege 4820 inykznpoh.exe Token: SeDebugPrivilege 1428 inbqiycju.exe Token: SeDebugPrivilege 2508 ingvnhoze.exe Token: SeDebugPrivilege 1740 inqmfrmyb.exe Token: SeDebugPrivilege 1588 incrjzdkv.exe Token: SeDebugPrivilege 4176 inhwoipfi.exe Token: SeDebugPrivilege 5372 insohtodl.exe Token: SeDebugPrivilege 2492 inesqmezb.exe Token: SeDebugPrivilege 4104 injyqkarh.exe Token: SeDebugPrivilege 5820 inoavpdfe.exe Token: SeDebugPrivilege 4716 incvyzsfr.exe Token: SeDebugPrivilege 3860 inldtepix.exe Token: SeDebugPrivilege 6048 inqgdzfrf.exe Token: SeDebugPrivilege 4252 inmprqjiy.exe Token: SeDebugPrivilege 5404 inbjwysrs.exe Token: SeDebugPrivilege 4392 inxjymong.exe Token: SeDebugPrivilege 2628 injwnoaqy.exe Token: SeDebugPrivilege 4212 inbbkvfva.exe Token: SeDebugPrivilege 1600 inkbaivic.exe Token: SeDebugPrivilege 3012 inqtvunam.exe Token: SeDebugPrivilege 3676 inhegsgsd.exe Token: SeDebugPrivilege 3028 ingwzqpxx.exe Token: SeDebugPrivilege 1572 incanalcr.exe Token: SeDebugPrivilege 2672 intcrvwiy.exe Token: SeDebugPrivilege 4992 inlofemzm.exe Token: SeDebugPrivilege 3248 inrcangym.exe Token: SeDebugPrivilege 5044 inyjbrycn.exe Token: SeDebugPrivilege 4836 ingtvpopk.exe Token: SeDebugPrivilege 4752 inxtemyti.exe Token: SeDebugPrivilege 2004 indtkzjxv.exe Token: SeDebugPrivilege 6032 inogwahsa.exe Token: SeDebugPrivilege 1252 inwsdlxsh.exe Token: SeDebugPrivilege 1312 inaexuhtj.exe Token: SeDebugPrivilege 4336 injhulmow.exe Token: SeDebugPrivilege 6000 inqcxrfhg.exe Token: SeDebugPrivilege 2732 ingiuiufd.exe Token: SeDebugPrivilege 4088 inertnmni.exe Token: SeDebugPrivilege 1980 indxawycz.exe Token: SeDebugPrivilege 3452 indwztgsi.exe Token: SeDebugPrivilege 3392 inmtnbdcu.exe Token: SeDebugPrivilege 4144 inrdysgih.exe Token: SeDebugPrivilege 204 inhjvjvge.exe Token: SeDebugPrivilege 1288 inljyapnv.exe Token: SeDebugPrivilege 5968 insbquvhx.exe Token: SeDebugPrivilege 236 ingvzmksi.exe Token: SeDebugPrivilege 2884 inpsutmlb.exe Token: SeDebugPrivilege 2796 inqjpgzht.exe Token: SeDebugPrivilege 4952 insrzztuj.exe Token: SeDebugPrivilege 3968 inocokdvj.exe - Suspicious use of SetWindowsHookEx 28 IoCs
pid Process 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe 2020 inbfyviuk.exe 4324 inetlfmxc.exe 2720 inlsmacbt.exe 3312 invrckwrg.exe 4892 inxiaqxbm.exe 472 inomzqrdt.exe 1872 inwhpwale.exe 2476 innuocedv.exe 1168 inbuxzyre.exe 3468 inkzrlbas.exe 620 inruwvobn.exe 3664 inzvgovkd.exe 1132 innqsrkjz.exe 796 infdqdofu.exe 4820 inykznpoh.exe 1428 inbqiycju.exe 2508 ingvnhoze.exe 1740 inqmfrmyb.exe 1588 incrjzdkv.exe 4176 inhwoipfi.exe 5372 insohtodl.exe 2492 inesqmezb.exe 4104 injyqkarh.exe 5820 inoavpdfe.exe 4716 incvyzsfr.exe 3860 inldtepix.exe 6048 inqgdzfrf.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 2020 3076 2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe 89 PID 2020 wrote to memory of 4324 2020 inbfyviuk.exe 90 PID 4324 wrote to memory of 2720 4324 inetlfmxc.exe 91 PID 2720 wrote to memory of 3312 2720 inlsmacbt.exe 92 PID 3312 wrote to memory of 4892 3312 invrckwrg.exe 93 PID 4892 wrote to memory of 472 4892 inxiaqxbm.exe 94 PID 472 wrote to memory of 1872 472 inomzqrdt.exe 95 PID 1872 wrote to memory of 2476 1872 inwhpwale.exe 96 PID 2476 wrote to memory of 1168 2476 innuocedv.exe 97 PID 1168 wrote to memory of 3468 1168 inbuxzyre.exe 98 PID 3468 wrote to memory of 620 3468 inkzrlbas.exe 99 PID 620 wrote to memory of 3664 620 inruwvobn.exe 100 PID 3664 wrote to memory of 1132 3664 inzvgovkd.exe 101 PID 1132 wrote to memory of 796 1132 innqsrkjz.exe 102 PID 796 wrote to memory of 4820 796 infdqdofu.exe 103 PID 4820 wrote to memory of 1428 4820 inykznpoh.exe 104 PID 1428 wrote to memory of 2508 1428 inbqiycju.exe 105 PID 2508 wrote to memory of 1740 2508 ingvnhoze.exe 106 PID 1740 wrote to memory of 1588 1740 inqmfrmyb.exe 107 PID 1588 wrote to memory of 4176 1588 incrjzdkv.exe 108 PID 4176 wrote to memory of 5372 4176 inhwoipfi.exe 109 PID 5372 wrote to memory of 2492 5372 insohtodl.exe 110 PID 2492 wrote to memory of 4104 2492 inesqmezb.exe 111 PID 4104 wrote to memory of 5820 4104 injyqkarh.exe 112 PID 5820 wrote to memory of 4716 5820 inoavpdfe.exe 113 PID 4716 wrote to memory of 3860 4716 incvyzsfr.exe 114 PID 3860 wrote to memory of 6048 3860 inldtepix.exe 115 PID 6048 wrote to memory of 4252 6048 inqgdzfrf.exe 116 PID 4252 wrote to memory of 5404 4252 inmprqjiy.exe 117 PID 5404 wrote to memory of 4392 5404 inbjwysrs.exe 118 PID 4392 wrote to memory of 2628 4392 inxjymong.exe 119 PID 2628 wrote to memory of 4212 2628 injwnoaqy.exe 120 PID 4212 wrote to memory of 1600 4212 inbbkvfva.exe 121 PID 1600 wrote to memory of 3012 1600 inkbaivic.exe 122 PID 3012 wrote to memory of 3676 3012 inqtvunam.exe 123 PID 3676 wrote to memory of 3028 3676 inhegsgsd.exe 124 PID 3028 wrote to memory of 1572 3028 ingwzqpxx.exe 125 PID 1572 wrote to memory of 2672 1572 incanalcr.exe 126 PID 2672 wrote to memory of 4992 2672 intcrvwiy.exe 127 PID 4992 wrote to memory of 3248 4992 inlofemzm.exe 128 PID 3248 wrote to memory of 5044 3248 inrcangym.exe 129 PID 5044 wrote to memory of 4836 5044 inyjbrycn.exe 130 PID 4836 wrote to memory of 4752 4836 ingtvpopk.exe 131 PID 4752 wrote to memory of 2004 4752 inxtemyti.exe 132 PID 2004 wrote to memory of 6032 2004 indtkzjxv.exe 133 PID 6032 wrote to memory of 1252 6032 inogwahsa.exe 134 PID 1252 wrote to memory of 1312 1252 inwsdlxsh.exe 135 PID 1312 wrote to memory of 4336 1312 inaexuhtj.exe 136 PID 4336 wrote to memory of 6000 4336 injhulmow.exe 137 PID 6000 wrote to memory of 2732 6000 inqcxrfhg.exe 138 PID 2732 wrote to memory of 4088 2732 ingiuiufd.exe 139 PID 4088 wrote to memory of 1980 4088 inertnmni.exe 140 PID 1980 wrote to memory of 3452 1980 indxawycz.exe 141 PID 3452 wrote to memory of 3392 3452 indwztgsi.exe 142 PID 3392 wrote to memory of 4144 3392 inmtnbdcu.exe 143 PID 4144 wrote to memory of 204 4144 inrdysgih.exe 144 PID 204 wrote to memory of 1288 204 inhjvjvge.exe 145 PID 1288 wrote to memory of 5968 1288 inljyapnv.exe 146 PID 5968 wrote to memory of 236 5968 insbquvhx.exe 147 PID 236 wrote to memory of 2884 236 ingvzmksi.exe 148 PID 2884 wrote to memory of 2796 2884 inpsutmlb.exe 149 PID 2796 wrote to memory of 4952 2796 inqjpgzht.exe 150 PID 4952 wrote to memory of 3968 4952 insrzztuj.exe 151 PID 3968 wrote to memory of 2328 3968 inocokdvj.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_7f01c9a5362749d88bc468ef354f7804_elex_glassworm_parite_ramnit_wannacry.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\system32\inbfyviuk.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\system32\inetlfmxc.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\system32\inlsmacbt.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\system32\invrckwrg.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\system32\inxiaqxbm.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\system32\inomzqrdt.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\system32\inwhpwale.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\innuocedv.exeC:\Windows\system32\innuocedv.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\system32\inbuxzyre.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\system32\inkzrlbas.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\inruwvobn.exeC:\Windows\system32\inruwvobn.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\inzvgovkd.exeC:\Windows\system32\inzvgovkd.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\system32\innqsrkjz.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\infdqdofu.exeC:\Windows\system32\infdqdofu.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\inykznpoh.exeC:\Windows\system32\inykznpoh.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\inbqiycju.exeC:\Windows\system32\inbqiycju.exe17⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\system32\ingvnhoze.exe18⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\inqmfrmyb.exeC:\Windows\system32\inqmfrmyb.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\system32\incrjzdkv.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\inhwoipfi.exeC:\Windows\system32\inhwoipfi.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\system32\insohtodl.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\inesqmezb.exeC:\Windows\system32\inesqmezb.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\system32\injyqkarh.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\system32\inoavpdfe.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\system32\incvyzsfr.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\system32\inldtepix.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\system32\inqgdzfrf.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\inmprqjiy.exeC:\Windows\system32\inmprqjiy.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\system32\inbjwysrs.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\system32\inxjymong.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\system32\injwnoaqy.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\inbbkvfva.exeC:\Windows\system32\inbbkvfva.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\system32\inkbaivic.exe34⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\inqtvunam.exeC:\Windows\system32\inqtvunam.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\system32\inhegsgsd.exe36⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\ingwzqpxx.exeC:\Windows\system32\ingwzqpxx.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\incanalcr.exeC:\Windows\system32\incanalcr.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\system32\intcrvwiy.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\inlofemzm.exeC:\Windows\system32\inlofemzm.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\system32\inrcangym.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\system32\inyjbrycn.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\system32\ingtvpopk.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\inxtemyti.exeC:\Windows\system32\inxtemyti.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\system32\indtkzjxv.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\system32\inogwahsa.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\system32\inwsdlxsh.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\inaexuhtj.exeC:\Windows\system32\inaexuhtj.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\injhulmow.exeC:\Windows\system32\injhulmow.exe49⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\system32\inqcxrfhg.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\ingiuiufd.exeC:\Windows\system32\ingiuiufd.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\inertnmni.exeC:\Windows\system32\inertnmni.exe52⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\indxawycz.exeC:\Windows\system32\indxawycz.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\system32\indwztgsi.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\inmtnbdcu.exeC:\Windows\system32\inmtnbdcu.exe55⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\system32\inrdysgih.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\inhjvjvge.exeC:\Windows\system32\inhjvjvge.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\system32\inljyapnv.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\insbquvhx.exeC:\Windows\system32\insbquvhx.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\system32\ingvzmksi.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\system32\inpsutmlb.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\inqjpgzht.exeC:\Windows\system32\inqjpgzht.exe62⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\insrzztuj.exeC:\Windows\system32\insrzztuj.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\inocokdvj.exeC:\Windows\system32\inocokdvj.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\system32\invhwkmle.exe65⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\injfqeotx.exeC:\Windows\system32\injfqeotx.exe66⤵PID:1924
-
C:\Windows\SysWOW64\inatybwnb.exeC:\Windows\system32\inatybwnb.exe67⤵
- Drops file in System32 directory
PID:4308 -
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\system32\infhthtec.exe68⤵PID:2060
-
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\system32\inpleqlxa.exe69⤵PID:4100
-
C:\Windows\SysWOW64\inbpxnjbw.exeC:\Windows\system32\inbpxnjbw.exe70⤵
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\system32\inwixlnmf.exe71⤵
- Boot or Logon Autostart Execution: Active Setup
PID:2784 -
C:\Windows\SysWOW64\indtosnaj.exeC:\Windows\system32\indtosnaj.exe72⤵PID:5000
-
C:\Windows\SysWOW64\inniyteex.exeC:\Windows\system32\inniyteex.exe73⤵
- System Location Discovery: System Language Discovery
PID:4712 -
C:\Windows\SysWOW64\ingoxeawx.exeC:\Windows\system32\ingoxeawx.exe74⤵PID:5776
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\system32\invuwaxma.exe75⤵PID:5824
-
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\system32\indtwnmuu.exe76⤵PID:3948
-
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\system32\inilcbjwj.exe77⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4920 -
C:\Windows\SysWOW64\inmflkmos.exeC:\Windows\system32\inmflkmos.exe78⤵PID:2880
-
C:\Windows\SysWOW64\ingtgabri.exeC:\Windows\system32\ingtgabri.exe79⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\system32\inigtklnv.exe80⤵PID:5684
-
C:\Windows\SysWOW64\inhscspdt.exeC:\Windows\system32\inhscspdt.exe81⤵PID:4408
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\system32\inhfsfaqh.exe82⤵
- System Location Discovery: System Language Discovery
PID:1864 -
C:\Windows\SysWOW64\inewrcnnk.exeC:\Windows\system32\inewrcnnk.exe83⤵PID:3428
-
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\system32\inyorihpp.exe84⤵PID:4568
-
C:\Windows\SysWOW64\inhsblrqs.exeC:\Windows\system32\inhsblrqs.exe85⤵PID:5364
-
C:\Windows\SysWOW64\inrxixhwa.exeC:\Windows\system32\inrxixhwa.exe86⤵PID:5532
-
C:\Windows\SysWOW64\inljswfrz.exeC:\Windows\system32\inljswfrz.exe87⤵
- Boot or Logon Autostart Execution: Active Setup
PID:1576 -
C:\Windows\SysWOW64\inpiofygs.exeC:\Windows\system32\inpiofygs.exe88⤵PID:3036
-
C:\Windows\SysWOW64\ingfvhjng.exeC:\Windows\system32\ingfvhjng.exe89⤵
- Drops file in System32 directory
PID:6108 -
C:\Windows\SysWOW64\ingatvyvf.exeC:\Windows\system32\ingatvyvf.exe90⤵PID:5396
-
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\system32\inugvjlkd.exe91⤵
- Drops file in System32 directory
PID:1100 -
C:\Windows\SysWOW64\inzloqpih.exeC:\Windows\system32\inzloqpih.exe92⤵
- Drops file in System32 directory
PID:4840 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\system32\inuqbjvqf.exe93⤵PID:1944
-
C:\Windows\SysWOW64\infnwdvwr.exeC:\Windows\system32\infnwdvwr.exe94⤵PID:3544
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\system32\intsuvkkg.exe95⤵PID:5104
-
C:\Windows\SysWOW64\inbsfowhf.exeC:\Windows\system32\inbsfowhf.exe96⤵PID:804
-
C:\Windows\SysWOW64\inrshhzyd.exeC:\Windows\system32\inrshhzyd.exe97⤵
- Boot or Logon Autostart Execution: Active Setup
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\system32\infvqbbup.exe98⤵PID:6084
-
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\system32\infumgnyd.exe99⤵PID:2544
-
C:\Windows\SysWOW64\inenraymu.exeC:\Windows\system32\inenraymu.exe100⤵PID:2872
-
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\system32\innlypqcs.exe101⤵
- System Location Discovery: System Language Discovery
PID:6012 -
C:\Windows\SysWOW64\inmxiifwj.exeC:\Windows\system32\inmxiifwj.exe102⤵PID:5012
-
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\system32\inrfpuysy.exe103⤵PID:3164
-
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\system32\inapnrseu.exe104⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\system32\infudswxj.exe105⤵PID:1180
-
C:\Windows\SysWOW64\inwmpgfnn.exeC:\Windows\system32\inwmpgfnn.exe106⤵PID:5904
-
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\system32\indskelwb.exe107⤵PID:2768
-
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\system32\incgzwjvl.exe108⤵PID:3964
-
C:\Windows\SysWOW64\inclzteci.exeC:\Windows\system32\inclzteci.exe109⤵PID:3700
-
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\system32\inopeewva.exe110⤵PID:2372
-
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\system32\indqsmlmh.exe111⤵PID:4344
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\system32\inadbobmd.exe112⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\inxhvtpha.exeC:\Windows\system32\inxhvtpha.exe113⤵
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Windows\SysWOW64\injyixbhg.exeC:\Windows\system32\injyixbhg.exe114⤵
- Drops file in System32 directory
PID:4424 -
C:\Windows\SysWOW64\inazpsjiq.exeC:\Windows\system32\inazpsjiq.exe115⤵PID:1160
-
C:\Windows\SysWOW64\inwgusogd.exeC:\Windows\system32\inwgusogd.exe116⤵PID:4680
-
C:\Windows\SysWOW64\inxrycagn.exeC:\Windows\system32\inxrycagn.exe117⤵PID:5380
-
C:\Windows\SysWOW64\indwezqep.exeC:\Windows\system32\indwezqep.exe118⤵PID:492
-
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\system32\injmdckxk.exe119⤵PID:2688
-
C:\Windows\SysWOW64\incawvwly.exeC:\Windows\system32\incawvwly.exe120⤵
- Boot or Logon Autostart Execution: Active Setup
PID:5196 -
C:\Windows\SysWOW64\ingrakqpr.exeC:\Windows\system32\ingrakqpr.exe121⤵PID:624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-