Analysis
- max time kernel
52s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 19:21
Behavioral task
behavioral1
Sample
2026-08-05_069547c231f919dfd385f4e33850870e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-05_069547c231f919dfd385f4e33850870e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 400KB
- Sample260805-x25ltseq2t
- SHA256 9de9c7d498ac7e4ed7803c9787b3d82d7253485aef2995c167de2e34a0d0011c
- MD5 069547c231f919dfd385f4e33850870e
- SHA1 b6d15bb628b4e3423ec1f648e2eaaeab983569a8
- SHA512 4fa38bf9d758f5ce81905c8332d1765781ba78e6e96f11cedfb8de8b72774162078a88d64b47c9e30c7621d75446c3bb03ee1affcc1193c7df9e269953d17e9b
- SSDEEP 6144:HpvqoDwFh6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:JvqO2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T18A948C2273E15D31CF280CBA04EA9254672CD825BF26DBBF6141E689FDB52CBDB2C451
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Egbdekcg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bgbdml32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mngepb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pohilc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdffiinp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lmppmh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ngbpbjoe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gnkajapa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lbkkpb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pikqcl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fppchile.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nocphd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngekmf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qajhigcj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Didjkbim.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmdcamko.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhnhplpg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pgdodq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjlgnh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fmnkdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mhmmchpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nicalpak.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beefenie.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fomhnmgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kbceoped.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aedfdjdl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ceckleii.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kfiajinf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jdbheajp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aancojgn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kejepfgd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lkjlciem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cfglahbj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fppchile.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ophbja32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpkbohhd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jgmapcqe.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dfjgjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nqnofkkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jdjfmjhm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fdegkdim.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gmhogppb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lbmheomi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hheoci32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olehai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bfnnhj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Khifno32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Beqljn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gdbmalja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ifpemmdd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ofnhfbjl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cphgca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gmfpgmil.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ipckqnja.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Pjalpida.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Edfdop32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ocopncke.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bjgncihp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jpfnqc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onfbpi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fklcbocl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mljficpd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jbgoik32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dapkho32.exe - Detects Padodor trojan 39 IoCs
resource yara_rule behavioral2/files/0x000600000001b714-5.dat family_padodor behavioral2/memory/2468-6-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000d00000001c405-12.dat family_padodor behavioral2/files/0x000d00000001c407-19.dat family_padodor behavioral2/files/0x000d00000001c40a-26.dat family_padodor behavioral2/files/0x000d00000001c40c-35.dat family_padodor behavioral2/files/0x000d00000001c422-40.dat family_padodor behavioral2/memory/4520-41-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000d00000001c424-47.dat family_padodor behavioral2/files/0x000d00000001c426-54.dat family_padodor behavioral2/files/0x000f00000001c402-61.dat family_padodor behavioral2/memory/4444-62-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000d00000001c429-68.dat family_padodor behavioral2/files/0x000d00000001c42b-75.dat family_padodor behavioral2/files/0x000d00000001c42e-82.dat family_padodor behavioral2/files/0x000d00000001c430-89.dat family_padodor behavioral2/memory/5040-91-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000d00000001c432-98.dat family_padodor behavioral2/files/0x000d00000001c434-103.dat family_padodor behavioral2/files/0x000d00000001c437-112.dat family_padodor behavioral2/files/0x000d00000001c439-119.dat family_padodor behavioral2/files/0x000d00000001c43b-126.dat family_padodor behavioral2/memory/2272-132-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000d00000001c43d-131.dat family_padodor behavioral2/files/0x000d00000001c43f-138.dat family_padodor behavioral2/files/0x000d00000001c442-145.dat family_padodor behavioral2/files/0x000d00000001c444-154.dat family_padodor behavioral2/files/0x000d00000001c44c-161.dat family_padodor behavioral2/files/0x000d00000001c44e-168.dat family_padodor behavioral2/files/0x000d00000001c450-175.dat family_padodor behavioral2/files/0x000d00000001c452-180.dat family_padodor behavioral2/files/0x000d00000001c454-188.dat family_padodor behavioral2/files/0x000d00000001c456-195.dat family_padodor behavioral2/files/0x000d00000001c458-203.dat family_padodor behavioral2/files/0x000d00000001c45a-208.dat family_padodor behavioral2/files/0x000d00000001c45c-217.dat family_padodor behavioral2/files/0x000d00000001c45f-224.dat family_padodor behavioral2/memory/5084-447-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/1464-454-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor - Executes dropped EXE 64 IoCs
pid Process 2468 Lhgiic32.exe 2584 Lnfngj32.exe 4440 Lkjoqnei.exe 4536 Linojbdc.exe 4788 Lbgcch32.exe 4520 Mbiphhhq.exe 5728 Momqblgj.exe 1524 Mejijcea.exe 4444 Moomgl32.exe 1048 Meobeb32.exe 1912 Mbbcofpf.exe 2044 Nfpled32.exe 5040 Nmjdaoni.exe 3096 Nnlqig32.exe 2440 Nlpabkba.exe 852 Nicalpak.exe 244 Nfgbec32.exe 4564 Nppfnige.exe 2272 Oihkgo32.exe 4172 Oijgmokc.exe 2268 Opdpih32.exe 3508 Ofnhfbjl.exe 1864 Opgloh32.exe 2836 Opiidhoj.exe 1396 Ponfed32.exe 4616 Pidjcm32.exe 3576 Pekkhn32.exe 3036 Pppoeg32.exe 1200 Pfjgbapo.exe 3184 Pikqcl32.exe 5620 Pohilc32.exe 3000 Pmiijjcf.exe 4728 Qfanbpjg.exe 5440 Qfcjhphd.exe 684 Abjkmqni.exe 4936 Apnkfelb.exe 5644 Aekdolkj.exe 3276 Apqhldjp.exe 2204 Aemqdk32.exe 2912 Aofemaog.exe 4592 Aikijjon.exe 2448 Accnco32.exe 4164 Bojohp32.exe 3628 Blnoad32.exe 2820 Bchgnoai.exe 4904 Bibpkiie.exe 1156 Bnphag32.exe 1744 Bekmei32.exe 5732 Bleebc32.exe 3764 Cpcnhbjj.exe 3352 Cljomc32.exe 3648 Cfbcfh32.exe 2700 Cphgca32.exe 3952 Cfeplh32.exe 1552 Cfglahbj.exe 5408 Cckmklac.exe 1504 Dnqaheai.exe 5576 Dflflg32.exe 2856 Dcpffk32.exe 1288 Djjobedk.exe 2948 Dcbckk32.exe 1924 Dqfceoje.exe 1548 Dgplai32.exe 4872 Dmmdjp32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Mcgpbknd.dll Panhmi32.exe File created C:\Windows\SysWOW64\Lgikpc32.exe Lpocciba.exe File opened for modification C:\Windows\SysWOW64\Kpbfbo32.exe Kihnfdmj.exe File created C:\Windows\SysWOW64\Gepbbmjj.dll Cifmjd32.exe File opened for modification C:\Windows\SysWOW64\Dmglmpkn.exe Dfmcpf32.exe File created C:\Windows\SysWOW64\Kiejfo32.exe Kbkaiddd.exe File created C:\Windows\SysWOW64\Hjpnmb32.dll Hoibmmpi.exe File created C:\Windows\SysWOW64\Apdkmn32.exe Abqjci32.exe File created C:\Windows\SysWOW64\Ngnill32.dll Dhjknljl.exe File created C:\Windows\SysWOW64\Bdefgg32.dll Fqjolfda.exe File created C:\Windows\SysWOW64\Mgokflpj.exe Mljficpd.exe File opened for modification C:\Windows\SysWOW64\Mefmbbod.exe Mpiejkql.exe File opened for modification C:\Windows\SysWOW64\Diffabgj.exe Dhejij32.exe File opened for modification C:\Windows\SysWOW64\Meefhl32.exe Mlmbofdh.exe File opened for modification C:\Windows\SysWOW64\Mejijcea.exe Momqblgj.exe File created C:\Windows\SysWOW64\Bafgdfim.exe Apdkmn32.exe File created C:\Windows\SysWOW64\Okjnpija.dll Ehbgjenf.exe File created C:\Windows\SysWOW64\Pknhff32.dll Hoakpi32.exe File opened for modification C:\Windows\SysWOW64\Mhoiih32.exe Mngepb32.exe File opened for modification C:\Windows\SysWOW64\Linojbdc.exe Lkjoqnei.exe File created C:\Windows\SysWOW64\Khkbcopl.exe Kaajfe32.exe File created C:\Windows\SysWOW64\Hilkfajn.dll Lgikpc32.exe File opened for modification C:\Windows\SysWOW64\Eefhcimp.exe Ehbgjenf.exe File created C:\Windows\SysWOW64\Pnldlfhp.dll Iihkjm32.exe File created C:\Windows\SysWOW64\Dfgidngk.dll Jeaidn32.exe File created C:\Windows\SysWOW64\Mfoigo32.dll Mikcbb32.exe File opened for modification C:\Windows\SysWOW64\Nfhfbedd.exe Mlpeol32.exe File opened for modification C:\Windows\SysWOW64\Obbekn32.exe Oijqbh32.exe File created C:\Windows\SysWOW64\Dnhdkgcp.dll Fbeeco32.exe File created C:\Windows\SysWOW64\Qkhlkj32.dll Abpcicpi.exe File created C:\Windows\SysWOW64\Bgibqqei.dll Lnnidjcg.exe File created C:\Windows\SysWOW64\Filicodb.exe Fhjlkg32.exe File created C:\Windows\SysWOW64\Jdjfmjhm.exe Jidbpa32.exe File created C:\Windows\SysWOW64\Cqhcab32.dll Hnfafpfd.exe File created C:\Windows\SysWOW64\Opiidhoj.exe Opgloh32.exe File created C:\Windows\SysWOW64\Dflflg32.exe Dnqaheai.exe File created C:\Windows\SysWOW64\Fifdqhal.exe Fqjolfda.exe File created C:\Windows\SysWOW64\Dhkaif32.exe Daaiml32.exe File created C:\Windows\SysWOW64\Ihnbih32.exe Ifpemmdd.exe File created C:\Windows\SysWOW64\Efjbne32.exe Eopjakkg.exe File created C:\Windows\SysWOW64\Hndibn32.exe Hhjqec32.exe File created C:\Windows\SysWOW64\Elkqqjac.dll Gfqjkljn.exe File created C:\Windows\SysWOW64\Daaiml32.exe Dejhgkgm.exe File opened for modification C:\Windows\SysWOW64\Bccfleqi.exe Bnfmcn32.exe File created C:\Windows\SysWOW64\Qhkdob32.dll Dpemjifi.exe File created C:\Windows\SysWOW64\Fkflbb32.exe Fpagdj32.exe File created C:\Windows\SysWOW64\Lbmekf32.dll Chlomnfl.exe File created C:\Windows\SysWOW64\Omnpee32.dll Gmhfbf32.exe File created C:\Windows\SysWOW64\Dmnafpac.dll Fdijkmbl.exe File opened for modification C:\Windows\SysWOW64\Jdjfmjhm.exe Jidbpa32.exe File opened for modification C:\Windows\SysWOW64\Jeolonem.exe Jpbdfgge.exe File created C:\Windows\SysWOW64\Qdpjqijp.dll Ncakglka.exe File opened for modification C:\Windows\SysWOW64\Pddmml32.exe Ocdqcikl.exe File created C:\Windows\SysWOW64\Fabqdl32.exe Filicodb.exe File created C:\Windows\SysWOW64\Pjgellfb.exe Poaqocgl.exe File created C:\Windows\SysWOW64\Cmfnfa32.dll Cebllbcc.exe File created C:\Windows\SysWOW64\Onhoehpp.exe Occkhp32.exe File created C:\Windows\SysWOW64\Hmebfllk.dll Jeolonem.exe File created C:\Windows\SysWOW64\Lgmnqmam.exe Lpcedbjp.exe File opened for modification C:\Windows\SysWOW64\Dmgbgf32.exe Dhkjooqb.exe File created C:\Windows\SysWOW64\Enfjph32.dll Lihpbl32.exe File created C:\Windows\SysWOW64\Lkjoqnei.exe Lnfngj32.exe File created C:\Windows\SysWOW64\Eopjakkg.exe Efgehe32.exe File created C:\Windows\SysWOW64\Oilmhhfd.exe Obbekn32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1824 8092 Process not Found 1990 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipnaen32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbbkjgpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kikafjoc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Acicefid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cclhbcho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jkmgladi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbiede32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Accnco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fifdqhal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbqeonfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Balfko32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkjfloeo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pfjcpc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ighhed32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cimckcoe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_069547c231f919dfd385f4e33850870e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcbckk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Deiblamk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jinloboo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkebekgo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qaegcb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Babmjj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdijkmbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bchgnoai.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Coojpg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elojej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blmamh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcmall32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oqdgan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Linojbdc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gjkqpa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmhfddeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emnbmoef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnodkjhq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nfpled32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eflhiolf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pbmnlf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bejoqm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhmgdo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnnidjcg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mikcbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdafgefe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alplfpbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lngmhm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eddhipdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkflbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpaqkgba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiakpheo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jolhjj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nqnofkkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpedckdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jibejb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Libggiik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gehfepio.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dqfceoje.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hjkigojc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lnfgmc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fahajbek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggpbcaei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aldeap32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnbeie32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nnlhod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgfqgkib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pllnbh32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbambkif.dll" Ahfmka32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdefgg32.dll" Fqjolfda.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcicbg32.dll" Hfacai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aocaod32.dll" Nklfho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qaegcb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmelek32.dll" Klljhe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mlqljb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfdhhgmj.dll" Bhehmbbj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Efgehe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hfacai32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kpagbk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naaeedej.dll" Ojjoedfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkffifj.dll" Acdbpq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ikjapden.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibjgim32.dll" Bfnnhj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gaogja32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bplammmf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qnihlf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ighhed32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pmiijjcf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bhibgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oqmhlego.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Emjomf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hdfobe32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hkbddo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqdfipld.dll" Epgpajdp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhdaik32.dll" Bplammmf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nocdpece.dll" Ngbpbjoe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cphgca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Allchp32.dll" Fppchile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jolhjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qeoeaq32.dll" Ngnnbq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmkfnp32.dll" Pcagjndj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cefolk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cckmklac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahfmka32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kbaiip32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Locbpi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qhlamhkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eagahnob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcjdoo32.dll" Emnbmoef.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nldhpeop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foieod32.dll" Nnlqig32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dlbcoe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Klgqmfpj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Opdpih32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cpglgmfa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgfojd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jcbibeki.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Emniheha.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cifmjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hphbpehj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Pijiif32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bejoqm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Imakdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnffai32.dll" Gonnhf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Phekliab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Afjemkbi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plnple32.dll" Dhejij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnejfn32.dll" Aikijjon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mkepgp32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nojagf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnggoe32.dll" Kbiede32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lihpbl32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 2468 4220 2026-08-05_069547c231f919dfd385f4e33850870e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe 88 PID 2468 wrote to memory of 2584 2468 Lhgiic32.exe 90 PID 2584 wrote to memory of 4440 2584 Lnfngj32.exe 91 PID 4440 wrote to memory of 4536 4440 Lkjoqnei.exe 92 PID 4536 wrote to memory of 4788 4536 Linojbdc.exe 93 PID 4788 wrote to memory of 4520 4788 Lbgcch32.exe 94 PID 4520 wrote to memory of 5728 4520 Mbiphhhq.exe 95 PID 5728 wrote to memory of 1524 5728 Momqblgj.exe 96 PID 1524 wrote to memory of 4444 1524 Mejijcea.exe 97 PID 4444 wrote to memory of 1048 4444 Moomgl32.exe 98 PID 1048 wrote to memory of 1912 1048 Meobeb32.exe 99 PID 1912 wrote to memory of 2044 1912 Mbbcofpf.exe 100 PID 2044 wrote to memory of 5040 2044 Nfpled32.exe 101 PID 5040 wrote to memory of 3096 5040 Nmjdaoni.exe 102 PID 3096 wrote to memory of 2440 3096 Nnlqig32.exe 103 PID 2440 wrote to memory of 852 2440 Nlpabkba.exe 104 PID 852 wrote to memory of 244 852 Nicalpak.exe 105 PID 244 wrote to memory of 4564 244 Nfgbec32.exe 106 PID 4564 wrote to memory of 2272 4564 Nppfnige.exe 107 PID 2272 wrote to memory of 4172 2272 Oihkgo32.exe 108 PID 4172 wrote to memory of 2268 4172 Oijgmokc.exe 109 PID 2268 wrote to memory of 3508 2268 Opdpih32.exe 110 PID 3508 wrote to memory of 1864 3508 Ofnhfbjl.exe 111 PID 1864 wrote to memory of 2836 1864 Opgloh32.exe 112 PID 2836 wrote to memory of 1396 2836 Opiidhoj.exe 113 PID 1396 wrote to memory of 4616 1396 Ponfed32.exe 114 PID 4616 wrote to memory of 3576 4616 Pidjcm32.exe 115 PID 3576 wrote to memory of 3036 3576 Pekkhn32.exe 116 PID 3036 wrote to memory of 1200 3036 Pppoeg32.exe 117 PID 1200 wrote to memory of 3184 1200 Pfjgbapo.exe 118 PID 3184 wrote to memory of 5620 3184 Pikqcl32.exe 119 PID 5620 wrote to memory of 3000 5620 Pohilc32.exe 120 PID 3000 wrote to memory of 4728 3000 Pmiijjcf.exe 121 PID 4728 wrote to memory of 5440 4728 Qfanbpjg.exe 122 PID 5440 wrote to memory of 684 5440 Qfcjhphd.exe 123 PID 684 wrote to memory of 4936 684 Abjkmqni.exe 124 PID 4936 wrote to memory of 5644 4936 Apnkfelb.exe 125 PID 5644 wrote to memory of 3276 5644 Aekdolkj.exe 126 PID 3276 wrote to memory of 2204 3276 Apqhldjp.exe 127 PID 2204 wrote to memory of 2912 2204 Aemqdk32.exe 128 PID 2912 wrote to memory of 4592 2912 Aofemaog.exe 129 PID 4592 wrote to memory of 2448 4592 Aikijjon.exe 130 PID 2448 wrote to memory of 4164 2448 Accnco32.exe 131 PID 4164 wrote to memory of 3628 4164 Bojohp32.exe 132 PID 3628 wrote to memory of 2820 3628 Blnoad32.exe 133 PID 2820 wrote to memory of 4904 2820 Bchgnoai.exe 134 PID 4904 wrote to memory of 1156 4904 Bibpkiie.exe 135 PID 1156 wrote to memory of 1744 1156 Bnphag32.exe 136 PID 1744 wrote to memory of 5732 1744 Bekmei32.exe 137 PID 5732 wrote to memory of 3764 5732 Bleebc32.exe 138 PID 3764 wrote to memory of 3352 3764 Cpcnhbjj.exe 139 PID 3352 wrote to memory of 3648 3352 Cljomc32.exe 140 PID 3648 wrote to memory of 2700 3648 Cfbcfh32.exe 141 PID 2700 wrote to memory of 3952 2700 Cphgca32.exe 142 PID 3952 wrote to memory of 1552 3952 Cfeplh32.exe 143 PID 1552 wrote to memory of 5408 1552 Cfglahbj.exe 144 PID 5408 wrote to memory of 1504 5408 Cckmklac.exe 145 PID 1504 wrote to memory of 5576 1504 Dnqaheai.exe 146 PID 5576 wrote to memory of 2856 5576 Dflflg32.exe 147 PID 2856 wrote to memory of 1288 2856 Dcpffk32.exe 148 PID 1288 wrote to memory of 2948 1288 Djjobedk.exe 149 PID 2948 wrote to memory of 1924 2948 Dcbckk32.exe 150 PID 1924 wrote to memory of 1548 1924 Dqfceoje.exe 151 PID 1548 wrote to memory of 4872 1548 Dgplai32.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_069547c231f919dfd385f4e33850870e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_069547c231f919dfd385f4e33850870e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\Lhgiic32.exeC:\Windows\system32\Lhgiic32.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\Lnfngj32.exeC:\Windows\system32\Lnfngj32.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\Lkjoqnei.exeC:\Windows\system32\Lkjoqnei.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\Linojbdc.exeC:\Windows\system32\Linojbdc.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Lbgcch32.exeC:\Windows\system32\Lbgcch32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\Mbiphhhq.exeC:\Windows\system32\Mbiphhhq.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\Momqblgj.exeC:\Windows\system32\Momqblgj.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\Mejijcea.exeC:\Windows\system32\Mejijcea.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\Moomgl32.exeC:\Windows\system32\Moomgl32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\Meobeb32.exeC:\Windows\system32\Meobeb32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\Mbbcofpf.exeC:\Windows\system32\Mbbcofpf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\Nfpled32.exeC:\Windows\system32\Nfpled32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\Nmjdaoni.exeC:\Windows\system32\Nmjdaoni.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\Nnlqig32.exeC:\Windows\system32\Nnlqig32.exe15⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\Nlpabkba.exeC:\Windows\system32\Nlpabkba.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\Nicalpak.exeC:\Windows\system32\Nicalpak.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\Nfgbec32.exeC:\Windows\system32\Nfgbec32.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\Nppfnige.exeC:\Windows\system32\Nppfnige.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\Oihkgo32.exeC:\Windows\system32\Oihkgo32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\Oijgmokc.exeC:\Windows\system32\Oijgmokc.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\Opdpih32.exeC:\Windows\system32\Opdpih32.exe22⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\Ofnhfbjl.exeC:\Windows\system32\Ofnhfbjl.exe23⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Opgloh32.exeC:\Windows\system32\Opgloh32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\Opiidhoj.exeC:\Windows\system32\Opiidhoj.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\Ponfed32.exeC:\Windows\system32\Ponfed32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\Pidjcm32.exeC:\Windows\system32\Pidjcm32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\Pekkhn32.exeC:\Windows\system32\Pekkhn32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\Pppoeg32.exeC:\Windows\system32\Pppoeg32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Pfjgbapo.exeC:\Windows\system32\Pfjgbapo.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\Pikqcl32.exeC:\Windows\system32\Pikqcl32.exe31⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\Pohilc32.exeC:\Windows\system32\Pohilc32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\Pmiijjcf.exeC:\Windows\system32\Pmiijjcf.exe33⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\Qfanbpjg.exeC:\Windows\system32\Qfanbpjg.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\Qfcjhphd.exeC:\Windows\system32\Qfcjhphd.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\Abjkmqni.exeC:\Windows\system32\Abjkmqni.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\Apnkfelb.exeC:\Windows\system32\Apnkfelb.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\Aekdolkj.exeC:\Windows\system32\Aekdolkj.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\Apqhldjp.exeC:\Windows\system32\Apqhldjp.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\Aemqdk32.exeC:\Windows\system32\Aemqdk32.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Aofemaog.exeC:\Windows\system32\Aofemaog.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Aikijjon.exeC:\Windows\system32\Aikijjon.exe42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\Accnco32.exeC:\Windows\system32\Accnco32.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Bojohp32.exeC:\Windows\system32\Bojohp32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\Blnoad32.exeC:\Windows\system32\Blnoad32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\Bchgnoai.exeC:\Windows\system32\Bchgnoai.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Bibpkiie.exeC:\Windows\system32\Bibpkiie.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Bnphag32.exeC:\Windows\system32\Bnphag32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\Bekmei32.exeC:\Windows\system32\Bekmei32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\Bleebc32.exeC:\Windows\system32\Bleebc32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Cpcnhbjj.exeC:\Windows\system32\Cpcnhbjj.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\Cljomc32.exeC:\Windows\system32\Cljomc32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\Cfbcfh32.exeC:\Windows\system32\Cfbcfh32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\Cphgca32.exeC:\Windows\system32\Cphgca32.exe54⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Cfeplh32.exeC:\Windows\system32\Cfeplh32.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\Cfglahbj.exeC:\Windows\system32\Cfglahbj.exe56⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\Cckmklac.exeC:\Windows\system32\Cckmklac.exe57⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\Dnqaheai.exeC:\Windows\system32\Dnqaheai.exe58⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\Dflflg32.exeC:\Windows\system32\Dflflg32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Windows\SysWOW64\Dcpffk32.exeC:\Windows\system32\Dcpffk32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\Djjobedk.exeC:\Windows\system32\Djjobedk.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\Dcbckk32.exeC:\Windows\system32\Dcbckk32.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\Dqfceoje.exeC:\Windows\system32\Dqfceoje.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\Dgplai32.exeC:\Windows\system32\Dgplai32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\Dmmdjp32.exeC:\Windows\system32\Dmmdjp32.exe65⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\Ejaecdnc.exeC:\Windows\system32\Ejaecdnc.exe66⤵PID:5976
-
C:\Windows\SysWOW64\Efgehe32.exeC:\Windows\system32\Efgehe32.exe67⤵
- Drops file in System32 directory
- Modifies registry class
PID:2616 -
C:\Windows\SysWOW64\Eopjakkg.exeC:\Windows\system32\Eopjakkg.exe68⤵
- Drops file in System32 directory
PID:368 -
C:\Windows\SysWOW64\Efjbne32.exeC:\Windows\system32\Efjbne32.exe69⤵PID:2724
-
C:\Windows\SysWOW64\Eobffk32.exeC:\Windows\system32\Eobffk32.exe70⤵PID:5364
-
C:\Windows\SysWOW64\Ejhkdc32.exeC:\Windows\system32\Ejhkdc32.exe71⤵PID:360
-
C:\Windows\SysWOW64\Ecpomiok.exeC:\Windows\system32\Ecpomiok.exe72⤵PID:4996
-
C:\Windows\SysWOW64\Epgpajdp.exeC:\Windows\system32\Epgpajdp.exe73⤵
- Modifies registry class
PID:2180 -
C:\Windows\SysWOW64\Fmkqknci.exeC:\Windows\system32\Fmkqknci.exe74⤵PID:3224
-
C:\Windows\SysWOW64\Fceihh32.exeC:\Windows\system32\Fceihh32.exe75⤵PID:4104
-
C:\Windows\SysWOW64\Fplimi32.exeC:\Windows\system32\Fplimi32.exe76⤵PID:2164
-
C:\Windows\SysWOW64\Fmpjfn32.exeC:\Windows\system32\Fmpjfn32.exe77⤵PID:5084
-
C:\Windows\SysWOW64\Fgencf32.exeC:\Windows\system32\Fgencf32.exe78⤵PID:5784
-
C:\Windows\SysWOW64\Fppchile.exeC:\Windows\system32\Fppchile.exe79⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:1464 -
C:\Windows\SysWOW64\Fmdcamko.exeC:\Windows\system32\Fmdcamko.exe80⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5660 -
C:\Windows\SysWOW64\Ggjgofkd.exeC:\Windows\system32\Ggjgofkd.exe81⤵PID:4212
-
C:\Windows\SysWOW64\Gmfpgmil.exeC:\Windows\system32\Gmfpgmil.exe82⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1000 -
C:\Windows\SysWOW64\Gjkqpa32.exeC:\Windows\system32\Gjkqpa32.exe83⤵
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Windows\SysWOW64\Gcceifof.exeC:\Windows\system32\Gcceifof.exe84⤵PID:3064
-
C:\Windows\SysWOW64\Gnhifonl.exeC:\Windows\system32\Gnhifonl.exe85⤵PID:2888
-
C:\Windows\SysWOW64\Gfcnka32.exeC:\Windows\system32\Gfcnka32.exe86⤵PID:2456
-
C:\Windows\SysWOW64\Gaibhj32.exeC:\Windows\system32\Gaibhj32.exe87⤵PID:3412
-
C:\Windows\SysWOW64\Gffkpa32.exeC:\Windows\system32\Gffkpa32.exe88⤵PID:3344
-
C:\Windows\SysWOW64\Hcjkje32.exeC:\Windows\system32\Hcjkje32.exe89⤵PID:3620
-
C:\Windows\SysWOW64\Hnpognhd.exeC:\Windows\system32\Hnpognhd.exe90⤵PID:3452
-
C:\Windows\SysWOW64\Hdlhoefk.exeC:\Windows\system32\Hdlhoefk.exe91⤵PID:4288
-
C:\Windows\SysWOW64\Hnblmnfa.exeC:\Windows\system32\Hnblmnfa.exe92⤵PID:2064
-
C:\Windows\SysWOW64\Hhjqec32.exeC:\Windows\system32\Hhjqec32.exe93⤵
- Drops file in System32 directory
PID:5304 -
C:\Windows\SysWOW64\Hndibn32.exeC:\Windows\system32\Hndibn32.exe94⤵PID:4168
-
C:\Windows\SysWOW64\Hpeejfjm.exeC:\Windows\system32\Hpeejfjm.exe95⤵PID:5376
-
C:\Windows\SysWOW64\Hjkigojc.exeC:\Windows\system32\Hjkigojc.exe96⤵
- System Location Discovery: System Language Discovery
PID:1472 -
C:\Windows\SysWOW64\Hphbpehj.exeC:\Windows\system32\Hphbpehj.exe97⤵
- Modifies registry class
PID:2872 -
C:\Windows\SysWOW64\Hoibmmpi.exeC:\Windows\system32\Hoibmmpi.exe98⤵
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\Ijpcbn32.exeC:\Windows\system32\Ijpcbn32.exe99⤵PID:412
-
C:\Windows\SysWOW64\Idhgkcln.exeC:\Windows\system32\Idhgkcln.exe100⤵PID:4068
-
C:\Windows\SysWOW64\Ialhdh32.exeC:\Windows\system32\Ialhdh32.exe101⤵PID:5936
-
C:\Windows\SysWOW64\Ikdlmmbh.exeC:\Windows\system32\Ikdlmmbh.exe102⤵PID:1780
-
C:\Windows\SysWOW64\Ikgicmpe.exeC:\Windows\system32\Ikgicmpe.exe103⤵PID:1216
-
C:\Windows\SysWOW64\Ihkila32.exeC:\Windows\system32\Ihkila32.exe104⤵PID:4284
-
C:\Windows\SysWOW64\Jpfnqc32.exeC:\Windows\system32\Jpfnqc32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3136 -
C:\Windows\SysWOW64\Jkkbnl32.exeC:\Windows\system32\Jkkbnl32.exe106⤵PID:1068
-
C:\Windows\SysWOW64\Joikdk32.exeC:\Windows\system32\Joikdk32.exe107⤵PID:3704
-
C:\Windows\SysWOW64\Jolhjj32.exeC:\Windows\system32\Jolhjj32.exe108⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2932 -
C:\Windows\SysWOW64\Jggmnmmo.exeC:\Windows\system32\Jggmnmmo.exe109⤵PID:4736
-
C:\Windows\SysWOW64\Jdkmgali.exeC:\Windows\system32\Jdkmgali.exe110⤵PID:1036
-
C:\Windows\SysWOW64\Jncapf32.exeC:\Windows\system32\Jncapf32.exe111⤵PID:5536
-
C:\Windows\SysWOW64\Khifno32.exeC:\Windows\system32\Khifno32.exe112⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3784 -
C:\Windows\SysWOW64\Kaajfe32.exeC:\Windows\system32\Kaajfe32.exe113⤵
- Drops file in System32 directory
PID:5872 -
C:\Windows\SysWOW64\Khkbcopl.exeC:\Windows\system32\Khkbcopl.exe114⤵PID:4624
-
C:\Windows\SysWOW64\Knhkkfod.exeC:\Windows\system32\Knhkkfod.exe115⤵PID:3340
-
C:\Windows\SysWOW64\Khmoionj.exeC:\Windows\system32\Khmoionj.exe116⤵PID:5112
-
C:\Windows\SysWOW64\Kphdma32.exeC:\Windows\system32\Kphdma32.exe117⤵PID:2248
-
C:\Windows\SysWOW64\Kojdkhdd.exeC:\Windows\system32\Kojdkhdd.exe118⤵PID:5812
-
C:\Windows\SysWOW64\Khbhdn32.exeC:\Windows\system32\Khbhdn32.exe119⤵PID:4696
-
C:\Windows\SysWOW64\Lajmmc32.exeC:\Windows\system32\Lajmmc32.exe120⤵PID:3024
-
C:\Windows\SysWOW64\Lggeej32.exeC:\Windows\system32\Lggeej32.exe121⤵PID:1408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-