Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 18:40
Behavioral task
behavioral1
Sample
2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 400KB
- Sample260805-xa9rgatele
- SHA256 18f42dfc8412d49640ceeead3296dcf4039b351fc679ea03f1154dffaf8cf589
- MD5 485a1b5276072d8c9b9bf98c8d22dc2a
- SHA1 c126029bcfc6a469e15354162f7c36e269f770d4
- SHA512 774ce54a92fcb1b928c892c4586a08aee527e12ce1cb6e132e5654dc35aa7b4ed31439caeebc0a0ec09b44bc61a9f7dd091f131fa1e69d8f91bb79534ce05292
- SSDEEP 12288:8OmfWGhxL582o8wE39uW8wESByvNv54B9f01Zm:qjxy2o8wDW8wQvr4B9f01Zm
- TLSH T170948C8233D5BC35CE982CB046EA5754521CEA24BF36DBEF2141EE9DBDB19E1DA2C041
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfqmjajc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ibadoc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Adanbffk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gganjh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ggfgegho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oqcedino.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ljfhjn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Adanbffk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gpaiadel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ilfehcnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Flinddpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ielmki32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mpocblpf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bdlfdnhb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ckpagg32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ejjelnfl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lqikfi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ojpdgjid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Klceeejl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Knbaoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ppclej32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kafcmglb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nhmejf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cmabpmjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gkfnnjnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oeclockl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Baadbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ekhncp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ogeklh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpiobc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mmkkgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qmccecfp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llmhkd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lchfch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mcmongoj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fnffam32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Combgh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ikpjkf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fechhcal.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Klceeejl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Milinkgf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lmkbpk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgkfhngo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mcdlil32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Iejqeiif.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ielmki32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kllhjplh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfdgcmqd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hpiemj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bngnmjql.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Enhpje32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pdalfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aoeleelp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cbpacmbc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lfeldj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gaibcn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ledeicdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aqhcid32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggnenagl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dpknhfoq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kpjgjefj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eoccii32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ffjignde.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gdglfqjd.exe - Detects Padodor trojan 45 IoCs
resource yara_rule behavioral2/files/0x000c000000019cc9-5.dat family_padodor behavioral2/memory/4904-6-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c624-12.dat family_padodor behavioral2/memory/5756-13-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c626-21.dat family_padodor behavioral2/memory/5836-20-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c629-26.dat family_padodor behavioral2/memory/3228-27-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c62b-33.dat family_padodor behavioral2/files/0x000d00000001c620-40.dat family_padodor behavioral2/files/0x000c00000001c62e-47.dat family_padodor behavioral2/memory/5920-41-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c630-54.dat family_padodor behavioral2/files/0x000c00000001c632-61.dat family_padodor behavioral2/files/0x000c00000001c634-67.dat family_padodor behavioral2/files/0x000c00000001c637-75.dat family_padodor behavioral2/memory/2212-83-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c639-82.dat family_padodor behavioral2/files/0x000c00000001c63b-88.dat family_padodor behavioral2/memory/4512-90-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c63d-98.dat family_padodor behavioral2/files/0x000c00000001c63f-103.dat family_padodor behavioral2/memory/1692-104-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c641-112.dat family_padodor behavioral2/memory/5812-118-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c643-117.dat family_padodor behavioral2/files/0x000c00000001c645-124.dat family_padodor behavioral2/files/0x000c00000001c647-131.dat family_padodor behavioral2/files/0x000c00000001c64a-138.dat family_padodor behavioral2/files/0x000c00000001c64c-145.dat family_padodor behavioral2/files/0x000c00000001c64e-152.dat family_padodor behavioral2/files/0x000c00000001c650-159.dat family_padodor behavioral2/files/0x000c00000001c652-168.dat family_padodor behavioral2/files/0x000c00000001c654-173.dat family_padodor behavioral2/files/0x000c00000001c658-187.dat family_padodor behavioral2/files/0x000c00000001c656-182.dat family_padodor behavioral2/files/0x000c00000001c65a-194.dat family_padodor behavioral2/files/0x000c00000001c65e-208.dat family_padodor behavioral2/files/0x000c00000001c65c-203.dat family_padodor behavioral2/files/0x000c00000001c660-214.dat family_padodor behavioral2/files/0x000c00000001c662-222.dat family_padodor behavioral2/memory/1388-309-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/3056-462-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/1312-507-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/1472-506-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor - Executes dropped EXE 64 IoCs
pid Process 4904 Aqffdejj.exe 5756 Aqhcid32.exe 5836 Afelal32.exe 3228 Aqoijcbo.exe 1532 Bqafpc32.exe 5920 Bjodch32.exe 1472 Bcghlnih.exe 4532 Bidqddgp.exe 3280 Capbaacl.exe 1620 Cjjcof32.exe 4312 Cgndikgd.exe 2212 Dgcmdj32.exe 4512 Diffabgj.exe 4888 Dfjgjf32.exe 1692 Dmdogpmq.exe 620 Emkeho32.exe 5812 Emnbmoef.exe 1568 Edjgpi32.exe 2192 Fmehnn32.exe 3304 Fhjlkg32.exe 2244 Faemjl32.exe 4192 Fgbfbc32.exe 4868 Ghdoae32.exe 4424 Gmqgjl32.exe 1936 Ggilbb32.exe 5244 Gaqmej32.exe 5008 Ggnenagl.exe 4948 Hknkiokp.exe 616 Hdfobe32.exe 1372 Hjchjl32.exe 4536 Hjhaeklb.exe 4256 Hglaookl.exe 2660 Ignndo32.exe 1484 Iacbbh32.exe 3468 Iddlccfp.exe 3184 Inmplh32.exe 5220 Igedenca.exe 2216 Ibjibg32.exe 2812 Jnaighhk.exe 4712 Jkejalge.exe 1044 Jqbbicel.exe 1536 Jglkfmmi.exe 3376 Jgngkmkf.exe 1500 Jbdliejl.exe 4568 Jnklnfpq.exe 4112 Jgcafl32.exe 5308 Kdgapp32.exe 2632 Kbkaiddd.exe 1388 Kkcfbj32.exe 1636 Kelkkpae.exe 2496 Kndodehf.exe 1104 Kijcanhl.exe 3080 Kilpgnfi.exe 5344 Lbddpclj.exe 3356 Lbgaecjg.exe 4540 Lgcjmjho.exe 3012 Llabchoe.exe 4592 Liecmlno.exe 3512 Lihpbl32.exe 5824 Macdgn32.exe 5996 Mngepb32.exe 4400 Milinkgf.exe 3144 Mjneec32.exe 1172 Mecjbl32.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Gmqgjl32.exe Ghdoae32.exe File created C:\Windows\SysWOW64\Cfdgcmqd.exe Bkobfdao.exe File opened for modification C:\Windows\SysWOW64\Mokmnm32.exe Mnjqfeld.exe File opened for modification C:\Windows\SysWOW64\Mpocblpf.exe Mjdkeaij.exe File created C:\Windows\SysWOW64\Nblcgpho.exe Mehcnlie.exe File created C:\Windows\SysWOW64\Jlmhaq32.dll Ohiefdhd.exe File opened for modification C:\Windows\SysWOW64\Aoeleelp.exe Qemhlp32.exe File opened for modification C:\Windows\SysWOW64\Nmipnp32.exe Nglhei32.exe File opened for modification C:\Windows\SysWOW64\Oqcedino.exe Njjmgo32.exe File created C:\Windows\SysWOW64\Pjjfnlho.exe Pmfedhie.exe File opened for modification C:\Windows\SysWOW64\Faemjl32.exe Fhjlkg32.exe File created C:\Windows\SysWOW64\Nmfchq32.exe Ncnook32.exe File opened for modification C:\Windows\SysWOW64\Ajdjcc32.exe Alqjiohm.exe File created C:\Windows\SysWOW64\Oloaamqf.exe Oajmdd32.exe File opened for modification C:\Windows\SysWOW64\Mfjfoidl.exe Lopmbomp.exe File created C:\Windows\SysWOW64\Belgbbnd.dll Iaekfjje.exe File created C:\Windows\SysWOW64\Dgpebf32.exe Dngqia32.exe File created C:\Windows\SysWOW64\Ldjbla32.dll Eaceqmid.exe File created C:\Windows\SysWOW64\Kcmflj32.dll Ggnenagl.exe File opened for modification C:\Windows\SysWOW64\Mnkgakpp.exe Mceccbpj.exe File created C:\Windows\SysWOW64\Clbhkfdl.exe Cnahmo32.exe File opened for modification C:\Windows\SysWOW64\Efeiahdo.exe Ekoddodi.exe File created C:\Windows\SysWOW64\Inecac32.exe Hdmohnhl.exe File created C:\Windows\SysWOW64\Jmfphjcf.dll Qdjgbg32.exe File created C:\Windows\SysWOW64\Kidbnd32.exe Kplmenpl.exe File opened for modification C:\Windows\SysWOW64\Kelkkpae.exe Kkcfbj32.exe File created C:\Windows\SysWOW64\Adelne32.dll Kijcanhl.exe File created C:\Windows\SysWOW64\Hnmake32.dll Emoanbll.exe File opened for modification C:\Windows\SysWOW64\Lpgmamfo.exe Lebiddfi.exe File created C:\Windows\SysWOW64\Oqcedino.exe Njjmgo32.exe File created C:\Windows\SysWOW64\Cdcldmbj.exe Baephacf.exe File opened for modification C:\Windows\SysWOW64\Djckiapl.exe Dgdnmfai.exe File opened for modification C:\Windows\SysWOW64\Ekmhnpfl.exe Eecpaeoo.exe File created C:\Windows\SysWOW64\Onmfcb32.exe Offnae32.exe File created C:\Windows\SysWOW64\Olhajffl.dll Jeocgfgn.exe File opened for modification C:\Windows\SysWOW64\Nmfmnjgh.exe Nfldap32.exe File opened for modification C:\Windows\SysWOW64\Gmndjf32.exe Fdepaa32.exe File created C:\Windows\SysWOW64\Kdlmmmim.dll Pmgmonma.exe File opened for modification C:\Windows\SysWOW64\Bhhiocdg.exe Banabi32.exe File created C:\Windows\SysWOW64\Afocdkac.exe Abajnm32.exe File created C:\Windows\SysWOW64\Ilfibleg.dll Baephacf.exe File created C:\Windows\SysWOW64\Aqffdejj.exe 2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Ciebfc32.dll Ahpdnaci.exe File created C:\Windows\SysWOW64\Combgh32.exe Bicjjncd.exe File created C:\Windows\SysWOW64\Bjnafn32.dll Ffjignde.exe File created C:\Windows\SysWOW64\Ghfkjl32.dll Bkobfdao.exe File created C:\Windows\SysWOW64\Ocoonp32.dll Hbenio32.exe File opened for modification C:\Windows\SysWOW64\Lchfch32.exe Llnnfnlc.exe File created C:\Windows\SysWOW64\Capbaacl.exe Bidqddgp.exe File opened for modification C:\Windows\SysWOW64\Bjgghc32.exe Bcmolimg.exe File opened for modification C:\Windows\SysWOW64\Epgndedc.exe Ejjelnfl.exe File created C:\Windows\SysWOW64\Mbdckd32.dll Flfjdn32.exe File opened for modification C:\Windows\SysWOW64\Cdhmjc32.exe Coldbl32.exe File created C:\Windows\SysWOW64\Eabjjafe.dll Qhlkbaho.exe File opened for modification C:\Windows\SysWOW64\Hbjonepq.exe Hiajeoip.exe File opened for modification C:\Windows\SysWOW64\Ibegpmah.exe Ilkocb32.exe File created C:\Windows\SysWOW64\Pmdioh32.exe Ofjqbndk.exe File opened for modification C:\Windows\SysWOW64\Pmpoemef.exe Phcgmffo.exe File created C:\Windows\SysWOW64\Abdbef32.dll Fbdeba32.exe File created C:\Windows\SysWOW64\Dpmcfk32.exe Djckiapl.exe File created C:\Windows\SysWOW64\Ppemkhaa.dll Bicjjncd.exe File created C:\Windows\SysWOW64\Ejlban32.exe Epgndedc.exe File opened for modification C:\Windows\SysWOW64\Gpimflqb.exe Fechhcal.exe File created C:\Windows\SysWOW64\Ppagmd32.dll Liecmlno.exe - Program crash 1 IoCs
pid pid_target Process procid_target 12532 12416 WerFault.exe 702 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dnjmoqmk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ojmhaklf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iimjan32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ljloii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckbegmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cjjcof32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lbddpclj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epgndedc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhegblcd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfqmjajc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Djnfppqi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dfbcek32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Llmhkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghdoae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmabpmjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ekmhnpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jcdjka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nmfmnjgh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kelkkpae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Afelal32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dgcmdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cfdgcmqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mcdlil32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Akmbepke.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Alqjiohm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ogeklh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bakmbcka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dcigneeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kcgnkgkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edplapnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ebiffc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbkblb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fcneod32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jdhndlno.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcejmeol.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ipeehhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfqlph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qpahghbg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhkfdcbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eoccii32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggfgegho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgngkmkf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikpjkf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mekmgg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Njinfk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hoaocf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dngqia32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Faholm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgbfbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Qmccecfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eilomd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cdkipb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nhckmmeg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egbkodei.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jglkfmmi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Egcaij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfjkce32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mflbdibj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bngnmjql.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ookokeqd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adepco32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnalfmhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fnffam32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bicjjncd.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Liecmlno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fejbhf32.dll" Mecjbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fncilm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbjgocg.dll" Hpdlajfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jcoapami.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdlmmmim.dll" Pmgmonma.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Filailgl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kekbce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnogdqme.dll" Cienhc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mflbdibj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnmkiblf.dll" Knoonphp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Njinfk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kpnjknni.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lohqgj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogicdj32.dll" Jblmpl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gdjilphb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pjjfnlho.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnmihgic.dll" Amdbffme.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbpaon32.dll" Aqoijcbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qqhegnhh.dll" Kgkfhngo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mfjfoidl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Emkeho32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgbfbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fgbfbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oidhehcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hfaaddlo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iffadlme.dll" Hoaocf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cjjcof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hoaocf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjojlh32.dll" Ofgdmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gmqgjl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cakegg32.dll" Aadokg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bkmmkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jljhqhhm.dll" Ejchbmna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdakiidg.dll" Jcoapami.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ljloii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lnendhol.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mgkoolil.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bogapc32.dll" Nihdhl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fggdic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cofnba32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apompo32.dll" Cneknh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jekmmf32.dll" Kekbce32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hpdegdci.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kakmhg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hmicee32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kkbohc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ilfehcnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Eaaikn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jleeqm32.dll" Ecefjckj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ekhncp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kckqlpck.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Nmipnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Banabi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Piocoi32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jkejalge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Igcgpalj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmamhf32.dll" Knbaoh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kgkfhngo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ilfehcnp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epbbim32.dll" Bbbkmebo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Combgh32.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 4904 1124 2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe 87 PID 4904 wrote to memory of 5756 4904 Aqffdejj.exe 88 PID 5756 wrote to memory of 5836 5756 Aqhcid32.exe 90 PID 5836 wrote to memory of 3228 5836 Afelal32.exe 91 PID 3228 wrote to memory of 1532 3228 Aqoijcbo.exe 92 PID 1532 wrote to memory of 5920 1532 Bqafpc32.exe 93 PID 5920 wrote to memory of 1472 5920 Bjodch32.exe 94 PID 1472 wrote to memory of 4532 1472 Bcghlnih.exe 95 PID 4532 wrote to memory of 3280 4532 Bidqddgp.exe 96 PID 3280 wrote to memory of 1620 3280 Capbaacl.exe 97 PID 1620 wrote to memory of 4312 1620 Cjjcof32.exe 98 PID 4312 wrote to memory of 2212 4312 Cgndikgd.exe 99 PID 2212 wrote to memory of 4512 2212 Dgcmdj32.exe 100 PID 4512 wrote to memory of 4888 4512 Diffabgj.exe 101 PID 4888 wrote to memory of 1692 4888 Dfjgjf32.exe 102 PID 1692 wrote to memory of 620 1692 Dmdogpmq.exe 103 PID 620 wrote to memory of 5812 620 Emkeho32.exe 104 PID 5812 wrote to memory of 1568 5812 Emnbmoef.exe 105 PID 1568 wrote to memory of 2192 1568 Edjgpi32.exe 106 PID 2192 wrote to memory of 3304 2192 Fmehnn32.exe 107 PID 3304 wrote to memory of 2244 3304 Fhjlkg32.exe 108 PID 2244 wrote to memory of 4192 2244 Faemjl32.exe 109 PID 4192 wrote to memory of 4868 4192 Fgbfbc32.exe 110 PID 4868 wrote to memory of 4424 4868 Ghdoae32.exe 111 PID 4424 wrote to memory of 1936 4424 Gmqgjl32.exe 112 PID 1936 wrote to memory of 5244 1936 Ggilbb32.exe 113 PID 5244 wrote to memory of 5008 5244 Gaqmej32.exe 114 PID 5008 wrote to memory of 4948 5008 Ggnenagl.exe 115 PID 4948 wrote to memory of 616 4948 Hknkiokp.exe 116 PID 616 wrote to memory of 1372 616 Hdfobe32.exe 117 PID 1372 wrote to memory of 4536 1372 Hjchjl32.exe 118 PID 4536 wrote to memory of 4256 4536 Hjhaeklb.exe 119 PID 4256 wrote to memory of 2660 4256 Hglaookl.exe 120 PID 2660 wrote to memory of 1484 2660 Ignndo32.exe 121 PID 1484 wrote to memory of 3468 1484 Iacbbh32.exe 122 PID 3468 wrote to memory of 3184 3468 Iddlccfp.exe 123 PID 3184 wrote to memory of 5220 3184 Inmplh32.exe 124 PID 5220 wrote to memory of 2216 5220 Igedenca.exe 125 PID 2216 wrote to memory of 2812 2216 Ibjibg32.exe 126 PID 2812 wrote to memory of 4712 2812 Jnaighhk.exe 127 PID 4712 wrote to memory of 1044 4712 Jkejalge.exe 128 PID 1044 wrote to memory of 1536 1044 Jqbbicel.exe 129 PID 1536 wrote to memory of 3376 1536 Jglkfmmi.exe 130 PID 3376 wrote to memory of 1500 3376 Jgngkmkf.exe 131 PID 1500 wrote to memory of 4568 1500 Jbdliejl.exe 132 PID 4568 wrote to memory of 4112 4568 Jnklnfpq.exe 133 PID 4112 wrote to memory of 5308 4112 Jgcafl32.exe 134 PID 5308 wrote to memory of 2632 5308 Kdgapp32.exe 135 PID 2632 wrote to memory of 1388 2632 Kbkaiddd.exe 136 PID 1388 wrote to memory of 1636 1388 Kkcfbj32.exe 137 PID 1636 wrote to memory of 2496 1636 Kelkkpae.exe 138 PID 2496 wrote to memory of 1104 2496 Kndodehf.exe 139 PID 1104 wrote to memory of 3080 1104 Kijcanhl.exe 140 PID 3080 wrote to memory of 5344 3080 Kilpgnfi.exe 141 PID 5344 wrote to memory of 3356 5344 Lbddpclj.exe 142 PID 3356 wrote to memory of 4540 3356 Lbgaecjg.exe 143 PID 4540 wrote to memory of 3012 4540 Lgcjmjho.exe 144 PID 3012 wrote to memory of 4592 3012 Llabchoe.exe 145 PID 4592 wrote to memory of 3512 4592 Liecmlno.exe 146 PID 3512 wrote to memory of 5824 3512 Lihpbl32.exe 147 PID 5824 wrote to memory of 5996 5824 Macdgn32.exe 148 PID 5996 wrote to memory of 4400 5996 Mngepb32.exe 149 PID 4400 wrote to memory of 3144 4400 Milinkgf.exe 150 PID 3144 wrote to memory of 1172 3144 Mjneec32.exe 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_485a1b5276072d8c9b9bf98c8d22dc2a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\Aqffdejj.exeC:\Windows\system32\Aqffdejj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\Aqhcid32.exeC:\Windows\system32\Aqhcid32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\Afelal32.exeC:\Windows\system32\Afelal32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\Aqoijcbo.exeC:\Windows\system32\Aqoijcbo.exe5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\Bqafpc32.exeC:\Windows\system32\Bqafpc32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\Bjodch32.exeC:\Windows\system32\Bjodch32.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\Bcghlnih.exeC:\Windows\system32\Bcghlnih.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\Bidqddgp.exeC:\Windows\system32\Bidqddgp.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\Capbaacl.exeC:\Windows\system32\Capbaacl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\Cjjcof32.exeC:\Windows\system32\Cjjcof32.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\Cgndikgd.exeC:\Windows\system32\Cgndikgd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\Dgcmdj32.exeC:\Windows\system32\Dgcmdj32.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\Diffabgj.exeC:\Windows\system32\Diffabgj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\Dfjgjf32.exeC:\Windows\system32\Dfjgjf32.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\Dmdogpmq.exeC:\Windows\system32\Dmdogpmq.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Emkeho32.exeC:\Windows\system32\Emkeho32.exe17⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\Emnbmoef.exeC:\Windows\system32\Emnbmoef.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\Edjgpi32.exeC:\Windows\system32\Edjgpi32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\Fmehnn32.exeC:\Windows\system32\Fmehnn32.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Fhjlkg32.exeC:\Windows\system32\Fhjlkg32.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\Faemjl32.exeC:\Windows\system32\Faemjl32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\Fgbfbc32.exeC:\Windows\system32\Fgbfbc32.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\Ghdoae32.exeC:\Windows\system32\Ghdoae32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\Gmqgjl32.exeC:\Windows\system32\Gmqgjl32.exe25⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\Ggilbb32.exeC:\Windows\system32\Ggilbb32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\Gaqmej32.exeC:\Windows\system32\Gaqmej32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\Ggnenagl.exeC:\Windows\system32\Ggnenagl.exe28⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\Hknkiokp.exeC:\Windows\system32\Hknkiokp.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\Hdfobe32.exeC:\Windows\system32\Hdfobe32.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\Hjchjl32.exeC:\Windows\system32\Hjchjl32.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\Hjhaeklb.exeC:\Windows\system32\Hjhaeklb.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\Hglaookl.exeC:\Windows\system32\Hglaookl.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\Ignndo32.exeC:\Windows\system32\Ignndo32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\Iacbbh32.exeC:\Windows\system32\Iacbbh32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\Iddlccfp.exeC:\Windows\system32\Iddlccfp.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\Inmplh32.exeC:\Windows\system32\Inmplh32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\Igedenca.exeC:\Windows\system32\Igedenca.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\Ibjibg32.exeC:\Windows\system32\Ibjibg32.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\Jnaighhk.exeC:\Windows\system32\Jnaighhk.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\Jkejalge.exeC:\Windows\system32\Jkejalge.exe41⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\Jqbbicel.exeC:\Windows\system32\Jqbbicel.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\Jglkfmmi.exeC:\Windows\system32\Jglkfmmi.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\Jgngkmkf.exeC:\Windows\system32\Jgngkmkf.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\Jbdliejl.exeC:\Windows\system32\Jbdliejl.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\Jnklnfpq.exeC:\Windows\system32\Jnklnfpq.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\Jgcafl32.exeC:\Windows\system32\Jgcafl32.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\Kdgapp32.exeC:\Windows\system32\Kdgapp32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\Kbkaiddd.exeC:\Windows\system32\Kbkaiddd.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Kkcfbj32.exeC:\Windows\system32\Kkcfbj32.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\Kelkkpae.exeC:\Windows\system32\Kelkkpae.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\Kndodehf.exeC:\Windows\system32\Kndodehf.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\Kijcanhl.exeC:\Windows\system32\Kijcanhl.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\Kilpgnfi.exeC:\Windows\system32\Kilpgnfi.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\Lbddpclj.exeC:\Windows\system32\Lbddpclj.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\Lbgaecjg.exeC:\Windows\system32\Lbgaecjg.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\Lgcjmjho.exeC:\Windows\system32\Lgcjmjho.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\Llabchoe.exeC:\Windows\system32\Llabchoe.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\Liecmlno.exeC:\Windows\system32\Liecmlno.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\Lihpbl32.exeC:\Windows\system32\Lihpbl32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\Macdgn32.exeC:\Windows\system32\Macdgn32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\Mngepb32.exeC:\Windows\system32\Mngepb32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\Milinkgf.exeC:\Windows\system32\Milinkgf.exe63⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\Mjneec32.exeC:\Windows\system32\Mjneec32.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\Mecjbl32.exeC:\Windows\system32\Mecjbl32.exe65⤵
- Executes dropped EXE
- Modifies registry class
PID:1172 -
C:\Windows\SysWOW64\Mbgjlq32.exeC:\Windows\system32\Mbgjlq32.exe66⤵PID:1088
-
C:\Windows\SysWOW64\Mhdbdgjl.exeC:\Windows\system32\Mhdbdgjl.exe67⤵PID:1928
-
C:\Windows\SysWOW64\Mehcnlie.exeC:\Windows\system32\Mehcnlie.exe68⤵
- Drops file in System32 directory
PID:2508 -
C:\Windows\SysWOW64\Nblcgpho.exeC:\Windows\system32\Nblcgpho.exe69⤵PID:2976
-
C:\Windows\SysWOW64\Nhhlog32.exeC:\Windows\system32\Nhhlog32.exe70⤵PID:5556
-
C:\Windows\SysWOW64\Nobdlqnc.exeC:\Windows\system32\Nobdlqnc.exe71⤵PID:4204
-
C:\Windows\SysWOW64\Nbqmbo32.exeC:\Windows\system32\Nbqmbo32.exe72⤵PID:792
-
C:\Windows\SysWOW64\Nhmejf32.exeC:\Windows\system32\Nhmejf32.exe73⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4992 -
C:\Windows\SysWOW64\Nbcjhobg.exeC:\Windows\system32\Nbcjhobg.exe74⤵PID:2108
-
C:\Windows\SysWOW64\Nlknqd32.exeC:\Windows\system32\Nlknqd32.exe75⤵PID:4672
-
C:\Windows\SysWOW64\Nbefmopd.exeC:\Windows\system32\Nbefmopd.exe76⤵PID:4156
-
C:\Windows\SysWOW64\Okpkaqmp.exeC:\Windows\system32\Okpkaqmp.exe77⤵PID:1096
-
C:\Windows\SysWOW64\Olphlcdb.exeC:\Windows\system32\Olphlcdb.exe78⤵PID:2092
-
C:\Windows\SysWOW64\Oidhehcl.exeC:\Windows\system32\Oidhehcl.exe79⤵
- Modifies registry class
PID:5992 -
C:\Windows\SysWOW64\Ohiefdhd.exeC:\Windows\system32\Ohiefdhd.exe80⤵
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\Oemephgn.exeC:\Windows\system32\Oemephgn.exe81⤵PID:1376
-
C:\Windows\SysWOW64\Piknfgmd.exeC:\Windows\system32\Piknfgmd.exe82⤵PID:5688
-
C:\Windows\SysWOW64\Peaokh32.exeC:\Windows\system32\Peaokh32.exe83⤵PID:1112
-
C:\Windows\SysWOW64\Pojccmii.exeC:\Windows\system32\Pojccmii.exe84⤵PID:2028
-
C:\Windows\SysWOW64\Plndma32.exeC:\Windows\system32\Plndma32.exe85⤵PID:5732
-
C:\Windows\SysWOW64\Poomom32.exeC:\Windows\system32\Poomom32.exe86⤵PID:6036
-
C:\Windows\SysWOW64\Pkencn32.exeC:\Windows\system32\Pkencn32.exe87⤵PID:5800
-
C:\Windows\SysWOW64\Qekbaf32.exeC:\Windows\system32\Qekbaf32.exe88⤵PID:1312
-
C:\Windows\SysWOW64\Qkhjim32.exeC:\Windows\system32\Qkhjim32.exe89⤵PID:3104
-
C:\Windows\SysWOW64\Qhlkbaho.exeC:\Windows\system32\Qhlkbaho.exe90⤵
- Drops file in System32 directory
PID:5140 -
C:\Windows\SysWOW64\Aadokg32.exeC:\Windows\system32\Aadokg32.exe91⤵
- Modifies registry class
PID:4064 -
C:\Windows\SysWOW64\Aohpek32.exeC:\Windows\system32\Aohpek32.exe92⤵PID:2696
-
C:\Windows\SysWOW64\Ahpdnaci.exeC:\Windows\system32\Ahpdnaci.exe93⤵
- Drops file in System32 directory
PID:4484 -
C:\Windows\SysWOW64\Acfhkj32.exeC:\Windows\system32\Acfhkj32.exe94⤵PID:3616
-
C:\Windows\SysWOW64\Ahbacq32.exeC:\Windows\system32\Ahbacq32.exe95⤵PID:4280
-
C:\Windows\SysWOW64\Aomipkic.exeC:\Windows\system32\Aomipkic.exe96⤵PID:3848
-
C:\Windows\SysWOW64\Alqjiohm.exeC:\Windows\system32\Alqjiohm.exe97⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Windows\SysWOW64\Ajdjcc32.exeC:\Windows\system32\Ajdjcc32.exe98⤵PID:6032
-
C:\Windows\SysWOW64\Bcmolimg.exeC:\Windows\system32\Bcmolimg.exe99⤵
- Drops file in System32 directory
PID:4072 -
C:\Windows\SysWOW64\Bjgghc32.exeC:\Windows\system32\Bjgghc32.exe100⤵PID:5520
-
C:\Windows\SysWOW64\Bbbkmebo.exeC:\Windows\system32\Bbbkmebo.exe101⤵
- Modifies registry class
PID:980 -
C:\Windows\SysWOW64\Bkjpek32.exeC:\Windows\system32\Bkjpek32.exe102⤵PID:4040
-
C:\Windows\SysWOW64\Bfpdcc32.exeC:\Windows\system32\Bfpdcc32.exe103⤵PID:4220
-
C:\Windows\SysWOW64\Bkmmkj32.exeC:\Windows\system32\Bkmmkj32.exe104⤵
- Modifies registry class
PID:3716 -
C:\Windows\SysWOW64\Bhqmdoef.exeC:\Windows\system32\Bhqmdoef.exe105⤵PID:5656
-
C:\Windows\SysWOW64\Bcfabgel.exeC:\Windows\system32\Bcfabgel.exe106⤵PID:5972
-
C:\Windows\SysWOW64\Bicjjncd.exeC:\Windows\system32\Bicjjncd.exe107⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\Combgh32.exeC:\Windows\system32\Combgh32.exe108⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:4476 -
C:\Windows\SysWOW64\Cmabpmjj.exeC:\Windows\system32\Cmabpmjj.exe109⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\Cfigib32.exeC:\Windows\system32\Cfigib32.exe110⤵PID:3192
-
C:\Windows\SysWOW64\Ckfpai32.exeC:\Windows\system32\Ckfpai32.exe111⤵PID:5964
-
C:\Windows\SysWOW64\Cjgpoq32.exeC:\Windows\system32\Cjgpoq32.exe112⤵PID:3032
-
C:\Windows\SysWOW64\Ckhlgilp.exeC:\Windows\system32\Ckhlgilp.exe113⤵PID:5584
-
C:\Windows\SysWOW64\Cfnqdale.exeC:\Windows\system32\Cfnqdale.exe114⤵PID:2544
-
C:\Windows\SysWOW64\Cofemg32.exeC:\Windows\system32\Cofemg32.exe115⤵PID:3840
-
C:\Windows\SysWOW64\Cfqmjajc.exeC:\Windows\system32\Cfqmjajc.exe116⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Windows\SysWOW64\Dkmebh32.exeC:\Windows\system32\Dkmebh32.exe117⤵PID:1244
-
C:\Windows\SysWOW64\Djnfppqi.exeC:\Windows\system32\Djnfppqi.exe118⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\Dpknhfoq.exeC:\Windows\system32\Dpknhfoq.exe119⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:1164 -
C:\Windows\SysWOW64\Diccal32.exeC:\Windows\system32\Diccal32.exe120⤵PID:3000
-
C:\Windows\SysWOW64\Dcigneeg.exeC:\Windows\system32\Dcigneeg.exe121⤵
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-