Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 17:09
Behavioral task
behavioral1
Sample
2026-08-05_edc44cd106ada08d81d1ab30bc749608_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-05_edc44cd106ada08d81d1ab30bc749608_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 400KB
- Sample260805-vpdapsxtet
- SHA256 bdfc872be55c2fda5b02e0aca7fc706b3dea27ec63a91fae320b8d1a8382c5ac
- MD5 edc44cd106ada08d81d1ab30bc749608
- SHA1 d84d692021ac25850875b573a27b64ceb8100b44
- SHA512 3a9731b051ef80663e172855e30674f4bb0fc926165a372135cb4a339e01435d1c0749e6fe4ef0365cc9395167bbe9f3c13176bf9871df7e127f158833deda03
- SSDEEP 12288:cwwXX2o8wE39uW8wESByvNv54B9f01Zm:xwn2o8wDW8wQvr4B9f01Zm
- TLSH T124947B1673F59D35CE6A0CF044EA9254276C9820BF2AFFAF6185E38DBDA5182F72C441
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhojlfpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibpgjg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kbpkdd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eagahnob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ikndpm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jhlgpp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bgpceogl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eoagdi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikaebnoj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pbnngi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bkgleegf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qpnegbpo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qfhmcl32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pdhbgn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dggbmlba.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chglkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qobhepjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qldccjno.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Acdiii32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogfccchd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jdddjq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cninnnfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Johnkbaj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ihhmaehj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iqklhd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkfnnjnl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipeehhhb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gknpfp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dbgnobpg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgkmap32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Edlagc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Meepne32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mcmongoj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnohgk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Apbghkhn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mbpdkabl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Napjnfik.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlppgddh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jlikdq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hadkdf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oakbonkb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Heegjj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ieojqi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hadkdf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fagenneg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gqfochal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mplapkoj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfhani32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hlpfak32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mfaqafjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gjohnkdd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Injmlbkh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnnakg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baanhi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adoamfhn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjbkal32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Plcdbghi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Epndddnk.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnjnjn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fppjpmim.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgpggm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ihmobn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hlldaape.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ppeikjle.exe - Detects Padodor trojan 43 IoCs
resource yara_rule behavioral2/files/0x000c00000001af5c-5.dat family_padodor behavioral2/files/0x000c00000001c5bd-12.dat family_padodor behavioral2/files/0x000c00000001c5bf-19.dat family_padodor behavioral2/files/0x000c00000001c5c1-26.dat family_padodor behavioral2/files/0x000c00000001c5c4-33.dat family_padodor behavioral2/memory/6112-34-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5c7-40.dat family_padodor behavioral2/files/0x000c00000001c5c8-47.dat family_padodor behavioral2/files/0x000c00000001c5ca-54.dat family_padodor behavioral2/files/0x000c00000001c5cc-61.dat family_padodor behavioral2/files/0x000c00000001c5ce-68.dat family_padodor behavioral2/files/0x000c00000001c5d1-75.dat family_padodor behavioral2/files/0x000c00000001c5d3-84.dat family_padodor behavioral2/files/0x000c00000001c5d5-91.dat family_padodor behavioral2/files/0x000c00000001c5d7-98.dat family_padodor behavioral2/files/0x000c00000001c5d9-105.dat family_padodor behavioral2/files/0x000c00000001c5dc-112.dat family_padodor behavioral2/files/0x000c00000001c5de-119.dat family_padodor behavioral2/files/0x000c00000001c5e0-126.dat family_padodor behavioral2/files/0x000c00000001c5e2-133.dat family_padodor behavioral2/files/0x000c00000001c5e9-154.dat family_padodor behavioral2/files/0x000c00000001c5ed-166.dat family_padodor behavioral2/files/0x000c00000001c5fa-210.dat family_padodor behavioral2/memory/4476-495-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/4392-471-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/1552-470-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/1204-429-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/2852-414-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5132-404-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/2428-394-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/4636-364-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/2988-259-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5fe-224.dat family_padodor behavioral2/files/0x000c00000001c5fc-217.dat family_padodor behavioral2/memory/4576-209-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5f8-203.dat family_padodor behavioral2/files/0x000c00000001c5f5-196.dat family_padodor behavioral2/files/0x000c00000001c5f3-189.dat family_padodor behavioral2/files/0x000c00000001c5f1-182.dat family_padodor behavioral2/files/0x000c00000001c5ef-175.dat family_padodor behavioral2/files/0x000c00000001c5eb-161.dat family_padodor behavioral2/files/0x000c00000001c5e7-147.dat family_padodor behavioral2/files/0x000c00000001c5e5-140.dat family_padodor - Executes dropped EXE 64 IoCs
pid Process 1552 Idgocigi.exe 5152 Iejlih32.exe 1232 Inbpbnlg.exe 4324 Jgjekc32.exe 6112 Jgakkb32.exe 2204 Kblidkhp.exe 3764 Kbneij32.exe 5664 Kflnpild.exe 3928 Kpfonnab.exe 988 Llmpco32.exe 2520 Llpmhodc.exe 3792 Lfeaegdi.exe 2112 Licmbccm.exe 5156 Lpneom32.exe 4092 Lejngd32.exe 4388 Lldfcn32.exe 1672 Lbnnphhk.exe 2104 Lhkghofb.exe 3240 Loeoei32.exe 2164 Meogbcel.exe 5772 Mpdkol32.exe 4516 Meadgc32.exe 716 Mlkldmjf.exe 2596 Mfaqafjl.exe 784 Mhbmin32.exe 4764 Mfcmge32.exe 3352 Miaica32.exe 5420 Mplapkoj.exe 3856 Mehjhbma.exe 4576 Mlbbel32.exe 4200 Nbljaf32.exe 2364 Nhicjm32.exe 4720 Nockfgao.exe 5180 Nemcca32.exe 5208 Nlglpkpi.exe 2188 Nbadmege.exe 1224 Nhnlelfm.exe 896 Nohdaf32.exe 2988 Nebmnqdf.exe 3316 Npgalidl.exe 4188 Ngaihcli.exe 5104 Nlnbqjjq.exe 4792 Ochjmd32.exe 1488 Oibbjoij.exe 4340 Oplkgi32.exe 4620 Ogfccchd.exe 5612 Olcklj32.exe 2576 Ocmchdmh.exe 4160 Oiglen32.exe 4876 Oocdme32.exe 2752 Oenljoji.exe 5368 Olgdgibf.exe 3784 Ogmidbal.exe 1996 Ohnelj32.exe 4980 Pohnhdog.exe 4316 Pebfen32.exe 5060 Pphjbgfj.exe 4264 Pgaboa32.exe 5884 Plokgh32.exe 4636 Pchcdbck.exe 1316 Pjbkal32.exe 2460 Pplcnf32.exe 4828 Pfilfm32.exe 3596 Plcdbghi.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dcapgfnb.dll Nameql32.exe File opened for modification C:\Windows\SysWOW64\Cppfgnlj.exe Cfhani32.exe File opened for modification C:\Windows\SysWOW64\Idbonc32.exe Inhgaipf.exe File created C:\Windows\SysWOW64\Kiggln32.exe Kjffngap.exe File opened for modification C:\Windows\SysWOW64\Kkhpmigp.exe Kbpkdd32.exe File opened for modification C:\Windows\SysWOW64\Bemqcngl.exe Bkgleegf.exe File opened for modification C:\Windows\SysWOW64\Oanodnip.exe Ojcghc32.exe File created C:\Windows\SysWOW64\Eqbclagp.exe Eoagdi32.exe File created C:\Windows\SysWOW64\Lcfimheb.exe Lhpepoel.exe File created C:\Windows\SysWOW64\Inecac32.exe Igkkdigp.exe File created C:\Windows\SysWOW64\Pjjfnlho.exe Pmdioh32.exe File opened for modification C:\Windows\SysWOW64\Bpcgionf.exe Bjfoqhpo.exe File created C:\Windows\SysWOW64\Oljonc32.exe Ofpgaihj.exe File created C:\Windows\SysWOW64\Akdoam32.exe Qfgfifdp.exe File created C:\Windows\SysWOW64\Plpqba32.exe Pefhfgoc.exe File created C:\Windows\SysWOW64\Cmabpmjj.exe Ckaffjbg.exe File opened for modification C:\Windows\SysWOW64\Ccpdhfmb.exe Cfldob32.exe File created C:\Windows\SysWOW64\Qgjdnffl.dll Fmdach32.exe File opened for modification C:\Windows\SysWOW64\Icdhojka.exe Iljpbp32.exe File opened for modification C:\Windows\SysWOW64\Cmnncb32.exe Cbhifj32.exe File created C:\Windows\SysWOW64\Halaeeod.exe Hjaihk32.exe File created C:\Windows\SysWOW64\Hgdedj32.exe Hlnqfanb.exe File created C:\Windows\SysWOW64\Hlhife32.exe Henajkcc.exe File created C:\Windows\SysWOW64\Piokckal.dll Ngaihcli.exe File created C:\Windows\SysWOW64\Ljbfiegb.exe Liqibm32.exe File created C:\Windows\SysWOW64\Dhjaoq32.dll Nhhlog32.exe File opened for modification C:\Windows\SysWOW64\Glgjfb32.exe Gkfnnjnl.exe File created C:\Windows\SysWOW64\Jilbgkab.dll Akipdg32.exe File opened for modification C:\Windows\SysWOW64\Gpnfak32.exe Gehbcb32.exe File created C:\Windows\SysWOW64\Cmmakp32.dll Dddlfa32.exe File created C:\Windows\SysWOW64\Cjhfjg32.exe Cpbbln32.exe File created C:\Windows\SysWOW64\Gkfnnjnl.exe Gdleap32.exe File created C:\Windows\SysWOW64\Lgephccp.exe Lqkgli32.exe File created C:\Windows\SysWOW64\Hlnjlkjf.exe Hfaaddlo.exe File opened for modification C:\Windows\SysWOW64\Ahacndjo.exe Aoioeo32.exe File created C:\Windows\SysWOW64\Jcqbmmnn.dll Amdbffme.exe File created C:\Windows\SysWOW64\Ekcqji32.dll Ndcoeq32.exe File opened for modification C:\Windows\SysWOW64\Oakbonkb.exe Offnae32.exe File created C:\Windows\SysWOW64\Gelddk32.exe Gnblgani.exe File created C:\Windows\SysWOW64\Ompmie32.exe Oloaamqf.exe File opened for modification C:\Windows\SysWOW64\Knpeii32.exe Kpldpddh.exe File created C:\Windows\SysWOW64\Aeodkfcm.dll Ajjoej32.exe File created C:\Windows\SysWOW64\Dckafp32.dll Pacfdila.exe File created C:\Windows\SysWOW64\Kkgicccd.exe Kdmqfi32.exe File created C:\Windows\SysWOW64\Pabmfmkg.dll Lhpepoel.exe File created C:\Windows\SysWOW64\Dddehmba.dll Nlbindfo.exe File opened for modification C:\Windows\SysWOW64\Kiggln32.exe Kjffngap.exe File created C:\Windows\SysWOW64\Cnfahn32.exe Chiipg32.exe File created C:\Windows\SysWOW64\Fboellof.exe Fkempa32.exe File opened for modification C:\Windows\SysWOW64\Alnfiifd.exe Aahblp32.exe File created C:\Windows\SysWOW64\Bohbackj.exe Bhnidi32.exe File created C:\Windows\SysWOW64\Pbhndmfj.dll Lcgoha32.exe File opened for modification C:\Windows\SysWOW64\Cimamn32.exe Bbcipdgl.exe File created C:\Windows\SysWOW64\Pphjbgfj.exe Pebfen32.exe File created C:\Windows\SysWOW64\Ciolccoc.dll Bfqkmj32.exe File opened for modification C:\Windows\SysWOW64\Hkeajn32.exe Hpomme32.exe File created C:\Windows\SysWOW64\Miabik32.exe Mbgjlq32.exe File opened for modification C:\Windows\SysWOW64\Bkgleegf.exe Bdndik32.exe File created C:\Windows\SysWOW64\Fkkemble.exe Fmgecn32.exe File opened for modification C:\Windows\SysWOW64\Inhgaipf.exe Ihknibbo.exe File created C:\Windows\SysWOW64\Kkomgkoj.exe Jdddjq32.exe File created C:\Windows\SysWOW64\Badofb32.dll Bojogb32.exe File created C:\Windows\SysWOW64\Eenfff32.exe Dndnjllg.exe File created C:\Windows\SysWOW64\Oibbjoij.exe Ochjmd32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 10476 13520 WerFault.exe 1011 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obidljll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akdoam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ealkcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Henajkcc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbkffe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibohid32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojommdfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkfcjh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jhficc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbnnphhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Naejcl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kdigkjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndcoeq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aobieq32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbcohl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iejlih32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lclpmdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Biklbe32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekladi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbeild32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mamljndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Plcdbghi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhpopb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Licmbccm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Icfediio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npnjcm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_edc44cd106ada08d81d1ab30bc749608_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Glgjfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fapdomgg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdjpff32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djhifnho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgkmap32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Khdojk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdmfebnk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pimkkfka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljbfiegb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgaoda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bbmjjk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cidgnm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgakkb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lfeaegdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aichng32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjhfjg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Higjkehf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nbqmbo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhbcbfak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qodmdb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oblmnmjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mnfnfl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Koonak32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ocihqc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gkhkdjli.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qldccjno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqmfnp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jeolmpcb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fmgecn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bkdieo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbmhglqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oceepj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kefiheqf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pcdqbk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olnkfd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Meepne32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhbelp32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Acclejeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olkkbe32.dll" Piocoi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okghgd32.dll" Nhnlelfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cmcoflhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hndgcl32.dll" Emplei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Licmbccm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ocmchdmh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qccnll32.dll" Kiggln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Inbpbnlg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jgjekc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hdhlhd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojegojfc.dll" Inlibb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbniel32.dll" Dbfomagf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ahdgnj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihccpqcl.dll" Bdndik32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eenfff32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Goccbhae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dqmjqb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Idbonc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gackgo32.dll" Acclejeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mffnilka.dll" Cbeaib32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbjgocg.dll" Gikdep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hlnjlkjf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgedmq32.dll" Qidljhia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mbenfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekdafekm.dll" Dmqdmd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ngikpjml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nblcgpho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lofklp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Heeppd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oenljoji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bqdbec32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mnnkaa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkkpagl.dll" Kjccna32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omeocm32.dll" Igajka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eieamg32.dll" Fnfmlchf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkcioogb.dll" Mpapgknd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lemhnn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bkoiqjdj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oilmckml.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ejagkodl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkgnhn32.dll" Idgocigi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Limmplda.dll" Bkeppeii.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfjpda32.dll" Hfaaddlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Adoamfhn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kpgdjo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcobje32.dll" Obidljll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gdjpff32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Difpflco.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ebggep32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkdieo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ihhmaehj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dphikllo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ejjqjp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdiqcom.dll" Pijcjcmq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bgbdml32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnemabne.dll" Dkpbgh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gkfnnjnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Icfediio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gammgo32.dll" Oloaamqf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klccng32.dll" Pdalfo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hlppgddh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nbnlkbje.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahbacq32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 1552 4972 2026-08-05_edc44cd106ada08d81d1ab30bc749608_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe 89 PID 1552 wrote to memory of 5152 1552 Idgocigi.exe 90 PID 5152 wrote to memory of 1232 5152 Iejlih32.exe 91 PID 1232 wrote to memory of 4324 1232 Inbpbnlg.exe 92 PID 4324 wrote to memory of 6112 4324 Jgjekc32.exe 93 PID 6112 wrote to memory of 2204 6112 Jgakkb32.exe 94 PID 2204 wrote to memory of 3764 2204 Kblidkhp.exe 95 PID 3764 wrote to memory of 5664 3764 Kbneij32.exe 96 PID 5664 wrote to memory of 3928 5664 Kflnpild.exe 97 PID 3928 wrote to memory of 988 3928 Kpfonnab.exe 98 PID 988 wrote to memory of 2520 988 Llmpco32.exe 99 PID 2520 wrote to memory of 3792 2520 Llpmhodc.exe 100 PID 3792 wrote to memory of 2112 3792 Lfeaegdi.exe 101 PID 2112 wrote to memory of 5156 2112 Licmbccm.exe 102 PID 5156 wrote to memory of 4092 5156 Lpneom32.exe 103 PID 4092 wrote to memory of 4388 4092 Lejngd32.exe 104 PID 4388 wrote to memory of 1672 4388 Lldfcn32.exe 105 PID 1672 wrote to memory of 2104 1672 Lbnnphhk.exe 106 PID 2104 wrote to memory of 3240 2104 Lhkghofb.exe 107 PID 3240 wrote to memory of 2164 3240 Loeoei32.exe 108 PID 2164 wrote to memory of 5772 2164 Meogbcel.exe 109 PID 5772 wrote to memory of 4516 5772 Mpdkol32.exe 110 PID 4516 wrote to memory of 716 4516 Meadgc32.exe 111 PID 716 wrote to memory of 2596 716 Mlkldmjf.exe 112 PID 2596 wrote to memory of 784 2596 Mfaqafjl.exe 113 PID 784 wrote to memory of 4764 784 Mhbmin32.exe 114 PID 4764 wrote to memory of 3352 4764 Mfcmge32.exe 115 PID 3352 wrote to memory of 5420 3352 Miaica32.exe 116 PID 5420 wrote to memory of 3856 5420 Mplapkoj.exe 117 PID 3856 wrote to memory of 4576 3856 Mehjhbma.exe 118 PID 4576 wrote to memory of 4200 4576 Mlbbel32.exe 119 PID 4200 wrote to memory of 2364 4200 Nbljaf32.exe 120 PID 2364 wrote to memory of 4720 2364 Nhicjm32.exe 121 PID 4720 wrote to memory of 5180 4720 Nockfgao.exe 122 PID 5180 wrote to memory of 5208 5180 Nemcca32.exe 123 PID 5208 wrote to memory of 2188 5208 Nlglpkpi.exe 124 PID 2188 wrote to memory of 1224 2188 Nbadmege.exe 125 PID 1224 wrote to memory of 896 1224 Nhnlelfm.exe 126 PID 896 wrote to memory of 2988 896 Nohdaf32.exe 127 PID 2988 wrote to memory of 3316 2988 Nebmnqdf.exe 128 PID 3316 wrote to memory of 4188 3316 Npgalidl.exe 129 PID 4188 wrote to memory of 5104 4188 Ngaihcli.exe 130 PID 5104 wrote to memory of 4792 5104 Nlnbqjjq.exe 131 PID 4792 wrote to memory of 1488 4792 Ochjmd32.exe 132 PID 1488 wrote to memory of 4340 1488 Oibbjoij.exe 133 PID 4340 wrote to memory of 4620 4340 Oplkgi32.exe 134 PID 4620 wrote to memory of 5612 4620 Ogfccchd.exe 135 PID 5612 wrote to memory of 2576 5612 Olcklj32.exe 136 PID 2576 wrote to memory of 4160 2576 Ocmchdmh.exe 137 PID 4160 wrote to memory of 4876 4160 Oiglen32.exe 138 PID 4876 wrote to memory of 2752 4876 Oocdme32.exe 139 PID 2752 wrote to memory of 5368 2752 Oenljoji.exe 140 PID 5368 wrote to memory of 3784 5368 Olgdgibf.exe 141 PID 3784 wrote to memory of 1996 3784 Ogmidbal.exe 142 PID 1996 wrote to memory of 4980 1996 Ohnelj32.exe 143 PID 4980 wrote to memory of 4316 4980 Pohnhdog.exe 144 PID 4316 wrote to memory of 5060 4316 Pebfen32.exe 145 PID 5060 wrote to memory of 4264 5060 Pphjbgfj.exe 146 PID 4264 wrote to memory of 5884 4264 Pgaboa32.exe 147 PID 5884 wrote to memory of 4636 5884 Plokgh32.exe 148 PID 4636 wrote to memory of 1316 4636 Pchcdbck.exe 149 PID 1316 wrote to memory of 2460 1316 Pjbkal32.exe 150 PID 2460 wrote to memory of 4828 2460 Pplcnf32.exe 151 PID 4828 wrote to memory of 3596 4828 Pfilfm32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_edc44cd106ada08d81d1ab30bc749608_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_edc44cd106ada08d81d1ab30bc749608_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\Idgocigi.exeC:\Windows\system32\Idgocigi.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\Iejlih32.exeC:\Windows\system32\Iejlih32.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\Inbpbnlg.exeC:\Windows\system32\Inbpbnlg.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\Jgjekc32.exeC:\Windows\system32\Jgjekc32.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\Jgakkb32.exeC:\Windows\system32\Jgakkb32.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\Kblidkhp.exeC:\Windows\system32\Kblidkhp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Kbneij32.exeC:\Windows\system32\Kbneij32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\Kflnpild.exeC:\Windows\system32\Kflnpild.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Windows\SysWOW64\Kpfonnab.exeC:\Windows\system32\Kpfonnab.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\Llmpco32.exeC:\Windows\system32\Llmpco32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Llpmhodc.exeC:\Windows\system32\Llpmhodc.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\Licmbccm.exeC:\Windows\system32\Licmbccm.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\Lpneom32.exeC:\Windows\system32\Lpneom32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\Lejngd32.exeC:\Windows\system32\Lejngd32.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\Lldfcn32.exeC:\Windows\system32\Lldfcn32.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\Lhkghofb.exeC:\Windows\system32\Lhkghofb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\Loeoei32.exeC:\Windows\system32\Loeoei32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\Meogbcel.exeC:\Windows\system32\Meogbcel.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\Mpdkol32.exeC:\Windows\system32\Mpdkol32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\Meadgc32.exeC:\Windows\system32\Meadgc32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\Mlkldmjf.exeC:\Windows\system32\Mlkldmjf.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\Mfaqafjl.exeC:\Windows\system32\Mfaqafjl.exe25⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\Mhbmin32.exeC:\Windows\system32\Mhbmin32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\Mfcmge32.exeC:\Windows\system32\Mfcmge32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\Miaica32.exeC:\Windows\system32\Miaica32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\Mplapkoj.exeC:\Windows\system32\Mplapkoj.exe29⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\Mehjhbma.exeC:\Windows\system32\Mehjhbma.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\Mlbbel32.exeC:\Windows\system32\Mlbbel32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\Nbljaf32.exeC:\Windows\system32\Nbljaf32.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\Nhicjm32.exeC:\Windows\system32\Nhicjm32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\Nemcca32.exeC:\Windows\system32\Nemcca32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\Nlglpkpi.exeC:\Windows\system32\Nlglpkpi.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\Nbadmege.exeC:\Windows\system32\Nbadmege.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\Nhnlelfm.exeC:\Windows\system32\Nhnlelfm.exe38⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\Nebmnqdf.exeC:\Windows\system32\Nebmnqdf.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\Npgalidl.exeC:\Windows\system32\Npgalidl.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\Ngaihcli.exeC:\Windows\system32\Ngaihcli.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\Nlnbqjjq.exeC:\Windows\system32\Nlnbqjjq.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\Ochjmd32.exeC:\Windows\system32\Ochjmd32.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\Oibbjoij.exeC:\Windows\system32\Oibbjoij.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\Oplkgi32.exeC:\Windows\system32\Oplkgi32.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\Ogfccchd.exeC:\Windows\system32\Ogfccchd.exe47⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\Olcklj32.exeC:\Windows\system32\Olcklj32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\Ocmchdmh.exeC:\Windows\system32\Ocmchdmh.exe49⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\Oiglen32.exeC:\Windows\system32\Oiglen32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\Oocdme32.exeC:\Windows\system32\Oocdme32.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\Oenljoji.exeC:\Windows\system32\Oenljoji.exe52⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\Olgdgibf.exeC:\Windows\system32\Olgdgibf.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\Ogmidbal.exeC:\Windows\system32\Ogmidbal.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\Ohnelj32.exeC:\Windows\system32\Ohnelj32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\Pohnhdog.exeC:\Windows\system32\Pohnhdog.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\Pebfen32.exeC:\Windows\system32\Pebfen32.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\Pphjbgfj.exeC:\Windows\system32\Pphjbgfj.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\Pgaboa32.exeC:\Windows\system32\Pgaboa32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\Plokgh32.exeC:\Windows\system32\Plokgh32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\Pchcdbck.exeC:\Windows\system32\Pchcdbck.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\Pjbkal32.exeC:\Windows\system32\Pjbkal32.exe62⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\Pplcnf32.exeC:\Windows\system32\Pplcnf32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\Pfilfm32.exeC:\Windows\system32\Pfilfm32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Plcdbghi.exeC:\Windows\system32\Plcdbghi.exe65⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Windows\SysWOW64\Pcmloa32.exeC:\Windows\system32\Pcmloa32.exe66⤵PID:4292
-
C:\Windows\SysWOW64\Qhjegh32.exeC:\Windows\system32\Qhjegh32.exe67⤵PID:2428
-
C:\Windows\SysWOW64\Qodmdb32.exeC:\Windows\system32\Qodmdb32.exe68⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Windows\SysWOW64\Qfneamlf.exeC:\Windows\system32\Qfneamlf.exe69⤵PID:5132
-
C:\Windows\SysWOW64\Qlhnng32.exeC:\Windows\system32\Qlhnng32.exe70⤵PID:4736
-
C:\Windows\SysWOW64\Qfpbfljd.exeC:\Windows\system32\Qfpbfljd.exe71⤵PID:2852
-
C:\Windows\SysWOW64\Aqffdejj.exeC:\Windows\system32\Aqffdejj.exe72⤵PID:928
-
C:\Windows\SysWOW64\Agpoqoaf.exeC:\Windows\system32\Agpoqoaf.exe73⤵PID:5072
-
C:\Windows\SysWOW64\Ammgifpn.exeC:\Windows\system32\Ammgifpn.exe74⤵PID:1204
-
C:\Windows\SysWOW64\Acfoep32.exeC:\Windows\system32\Acfoep32.exe75⤵PID:4668
-
C:\Windows\SysWOW64\Aichng32.exeC:\Windows\system32\Aichng32.exe76⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\Aompjamo.exeC:\Windows\system32\Aompjamo.exe77⤵PID:4820
-
C:\Windows\SysWOW64\Ajcdhj32.exeC:\Windows\system32\Ajcdhj32.exe78⤵PID:3912
-
C:\Windows\SysWOW64\Aopmpq32.exeC:\Windows\system32\Aopmpq32.exe79⤵PID:4372
-
C:\Windows\SysWOW64\Ajeami32.exeC:\Windows\system32\Ajeami32.exe80⤵PID:2008
-
C:\Windows\SysWOW64\Aobieq32.exeC:\Windows\system32\Aobieq32.exe81⤵
- System Location Discovery: System Language Discovery
PID:3516 -
C:\Windows\SysWOW64\Aflabj32.exeC:\Windows\system32\Aflabj32.exe82⤵PID:4392
-
C:\Windows\SysWOW64\Bqafpc32.exeC:\Windows\system32\Bqafpc32.exe83⤵PID:5592
-
C:\Windows\SysWOW64\Bfnnhj32.exeC:\Windows\system32\Bfnnhj32.exe84⤵PID:4804
-
C:\Windows\SysWOW64\Bqdbec32.exeC:\Windows\system32\Bqdbec32.exe85⤵
- Modifies registry class
PID:4780 -
C:\Windows\SysWOW64\Bfqkmj32.exeC:\Windows\system32\Bfqkmj32.exe86⤵
- Drops file in System32 directory
PID:4476 -
C:\Windows\SysWOW64\Bmkcjd32.exeC:\Windows\system32\Bmkcjd32.exe87⤵PID:3548
-
C:\Windows\SysWOW64\Bgpggm32.exeC:\Windows\system32\Bgpggm32.exe88⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2564 -
C:\Windows\SysWOW64\Bmmppc32.exeC:\Windows\system32\Bmmppc32.exe89⤵PID:5856
-
C:\Windows\SysWOW64\Bgbdml32.exeC:\Windows\system32\Bgbdml32.exe90⤵
- Modifies registry class
PID:5116 -
C:\Windows\SysWOW64\Bqkifb32.exeC:\Windows\system32\Bqkifb32.exe91⤵PID:6092
-
C:\Windows\SysWOW64\Cfhani32.exeC:\Windows\system32\Cfhani32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:1448 -
C:\Windows\SysWOW64\Cppfgnlj.exeC:\Windows\system32\Cppfgnlj.exe93⤵PID:4408
-
C:\Windows\SysWOW64\Cjejdglp.exeC:\Windows\system32\Cjejdglp.exe94⤵PID:5960
-
C:\Windows\SysWOW64\Cpbbln32.exeC:\Windows\system32\Cpbbln32.exe95⤵
- Drops file in System32 directory
PID:1892 -
C:\Windows\SysWOW64\Cjhfjg32.exeC:\Windows\system32\Cjhfjg32.exe96⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Windows\SysWOW64\Ccpkblqn.exeC:\Windows\system32\Ccpkblqn.exe97⤵PID:2380
-
C:\Windows\SysWOW64\Cmipkb32.exeC:\Windows\system32\Cmipkb32.exe98⤵PID:4584
-
C:\Windows\SysWOW64\Cfaddg32.exeC:\Windows\system32\Cfaddg32.exe99⤵PID:4076
-
C:\Windows\SysWOW64\Cmklaaek.exeC:\Windows\system32\Cmklaaek.exe100⤵PID:5024
-
C:\Windows\SysWOW64\Dfcqjg32.exeC:\Windows\system32\Dfcqjg32.exe101⤵PID:4256
-
C:\Windows\SysWOW64\Dmmifaci.exeC:\Windows\system32\Dmmifaci.exe102⤵PID:4784
-
C:\Windows\SysWOW64\Dgcmdj32.exeC:\Windows\system32\Dgcmdj32.exe103⤵PID:3008
-
C:\Windows\SysWOW64\Dmpfla32.exeC:\Windows\system32\Dmpfla32.exe104⤵PID:912
-
C:\Windows\SysWOW64\Dhejij32.exeC:\Windows\system32\Dhejij32.exe105⤵PID:4260
-
C:\Windows\SysWOW64\Dannbogl.exeC:\Windows\system32\Dannbogl.exe106⤵PID:1572
-
C:\Windows\SysWOW64\Dfjgjf32.exeC:\Windows\system32\Dfjgjf32.exe107⤵PID:2908
-
C:\Windows\SysWOW64\Dapkho32.exeC:\Windows\system32\Dapkho32.exe108⤵PID:4708
-
C:\Windows\SysWOW64\Djhpqdlj.exeC:\Windows\system32\Djhpqdlj.exe109⤵PID:2992
-
C:\Windows\SysWOW64\Dpehikja.exeC:\Windows\system32\Dpehikja.exe110⤵PID:3392
-
C:\Windows\SysWOW64\Ejklfd32.exeC:\Windows\system32\Ejklfd32.exe111⤵PID:1736
-
C:\Windows\SysWOW64\Eaddcnad.exeC:\Windows\system32\Eaddcnad.exe112⤵PID:5868
-
C:\Windows\SysWOW64\Eagahnob.exeC:\Windows\system32\Eagahnob.exe113⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5376 -
C:\Windows\SysWOW64\Eplnijdj.exeC:\Windows\system32\Eplnijdj.exe114⤵PID:256
-
C:\Windows\SysWOW64\Effffd32.exeC:\Windows\system32\Effffd32.exe115⤵PID:4148
-
C:\Windows\SysWOW64\Ealkcm32.exeC:\Windows\system32\Ealkcm32.exe116⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\Ehecpgbi.exeC:\Windows\system32\Ehecpgbi.exe117⤵PID:3004
-
C:\Windows\SysWOW64\Embkhn32.exeC:\Windows\system32\Embkhn32.exe118⤵PID:3100
-
C:\Windows\SysWOW64\Fhhpfg32.exeC:\Windows\system32\Fhhpfg32.exe119⤵PID:1340
-
C:\Windows\SysWOW64\Fapdomgg.exeC:\Windows\system32\Fapdomgg.exe120⤵
- System Location Discovery: System Language Discovery
PID:1464 -
C:\Windows\SysWOW64\Ffmmgceo.exeC:\Windows\system32\Ffmmgceo.exe121⤵PID:3788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-