Analysis
- max time kernel
59s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 19:35
Behavioral task
behavioral1
Sample
2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 400KB
- Sample260819-yayvmsgq8w
- SHA256 08cea8ff8b35916517d29591a5dd2baa4d12a51a6f3887660f0a36b9c988f5a2
- MD5 58ff17de038bde48e7d5b33222ac760e
- SHA1 be57a30ba8ffcdd1075519775a506b8dad56e6c3
- SHA512 7feb987e7b3f185e5fe6294a544a89f6241b1b6f974cacc1b77381eddad7ce96093f0afd7d3fbdf27034dedc6d7697c635a62999d4340b70b0a7c2fc654a9cfd
- SSDEEP 12288:mXkDNL2o8wE39uW8wESByvNv54B9f01Zm:9DNL2o8wDW8wQvr4B9f01Zm
- TLSH T1D6948D0273D1BE31CE5C18B05CE9B254522CD8E0BFABDBEF6545E789BDB2281D62D241
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hiefmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mchhamcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cpbbln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jcphkhad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Meiabh32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Foghhg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aifdcgcp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nenbdd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fljcfa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Qlggcp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fnpmej32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Oqbagd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fpagdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kgdpgo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kmbdkj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Feocoaai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jdkadb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lebalokn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfqmjajc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jjlmmbfo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Imdgjlgb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Emnbmoef.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdkhkflh.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eagahnob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gpnfak32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ngbeok32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Balfko32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Nockfgao.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Anobaa32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Boqlqd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cnahmo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bcjlld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcffoben.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hfodnd32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gempqo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Opqdbhlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ecpmod32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jgmjfpco.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mfaqafjl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ehifpm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ejmild32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Piphaf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cffcilob.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gohhik32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gonnhf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jnqbmadp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jcbdph32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lkchoaif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dfbcek32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jfllca32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mchpibng.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fkjfloeo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hhihnihm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Phqbaj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fbcfan32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eolpfo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dcaefo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cfdhdn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Coigllel.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Gicgjk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aegidp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kjeiij32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nflkkf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bmeagjbo.exe - Detects Padodor trojan 43 IoCs
resource yara_rule behavioral2/files/0x000600000001b85f-5.dat family_padodor behavioral2/files/0x000c00000001c5bc-14.dat family_padodor behavioral2/files/0x000c00000001c5be-19.dat family_padodor behavioral2/files/0x000c00000001c5c0-28.dat family_padodor behavioral2/files/0x000c00000001c5c2-35.dat family_padodor behavioral2/files/0x000c00000001c5c4-42.dat family_padodor behavioral2/files/0x000c00000001c5c6-47.dat family_padodor behavioral2/files/0x000c00000001c5c8-54.dat family_padodor behavioral2/files/0x000c00000001c5cb-62.dat family_padodor behavioral2/files/0x000c00000001c5cd-70.dat family_padodor behavioral2/files/0x000c00000001c5cf-77.dat family_padodor behavioral2/files/0x000c00000001c5d1-84.dat family_padodor behavioral2/files/0x000d00000001c5b9-91.dat family_padodor behavioral2/files/0x000c00000001c5d7-105.dat family_padodor behavioral2/files/0x000c00000001c5d9-110.dat family_padodor behavioral2/memory/5056-112-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5db-119.dat family_padodor behavioral2/files/0x000c00000001c5df-133.dat family_padodor behavioral2/memory/3748-139-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5e1-138.dat family_padodor behavioral2/files/0x000c00000001c5e3-147.dat family_padodor behavioral2/files/0x000c00000001c5e5-154.dat family_padodor behavioral2/files/0x000c00000001c5e7-161.dat family_padodor behavioral2/memory/5400-160-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5ea-167.dat family_padodor behavioral2/files/0x000c00000001c5ec-175.dat family_padodor behavioral2/files/0x000c00000001c5f0-189.dat family_padodor behavioral2/files/0x000c00000001c5f2-196.dat family_padodor behavioral2/files/0x000c00000001c5f5-203.dat family_padodor behavioral2/files/0x000c00000001c5f7-208.dat family_padodor behavioral2/files/0x000c00000001c5f9-215.dat family_padodor behavioral2/files/0x000c00000001c5fb-224.dat family_padodor behavioral2/memory/4772-294-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/944-404-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/2804-454-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5068-507-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5916-506-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5776-289-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5844-188-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c5ee-181.dat family_padodor behavioral2/files/0x000c00000001c5dd-126.dat family_padodor behavioral2/files/0x000c00000001c5d4-98.dat family_padodor behavioral2/memory/3424-90-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor - Executes dropped EXE 64 IoCs
pid Process 2256 Mdhkefnj.exe 2400 Mjednmla.exe 4708 Mdkhkflh.exe 2228 Nqaipgal.exe 2656 Njjmil32.exe 5924 Ncbaabom.exe 5916 Nacboi32.exe 2776 Ndbnkefp.exe 5460 Njogdldg.exe 2384 Nbfoeiei.exe 4076 Njacikbd.exe 5276 Nqklfe32.exe 3424 Obmeeh32.exe 260 Ojhijjll.exe 1452 Oqbagd32.exe 5056 Okgfdm32.exe 4264 Obanqgkl.exe 2980 Obdkfg32.exe 4288 Ocegnoog.exe 3748 Ojopki32.exe 1476 Pcgdcome.exe 1592 Pnmhqh32.exe 5400 Pegqmbch.exe 2756 Pkaijl32.exe 852 Panabc32.exe 4812 Pnaalghe.exe 5844 Pcojdnfm.exe 832 Pndoagfc.exe 6028 Pcagjndj.exe 1604 Qnfkgfdp.exe 4540 Qepccqlm.exe 3812 Qnihlf32.exe 4252 Qebpipij.exe 2560 Qlmhfj32.exe 1428 Aaianaoo.exe 3216 Agcikk32.exe 2872 Abimhd32.exe 2992 Aegidp32.exe 1900 Alaaajmb.exe 4828 Aanjiqki.exe 1172 Ahhbfkbf.exe 5648 Abngccbl.exe 2904 Ahjoljqc.exe 5700 Andghd32.exe 5776 Aenpeoom.exe 4772 Blhhaigj.exe 1596 Baepjpea.exe 1544 Bhohfj32.exe 5380 Bjnece32.exe 1044 Bdfilkbb.exe 4816 Bajjeo32.exe 4840 Bdhfaj32.exe 1480 Bonjnc32.exe 5372 Balfko32.exe 2448 Blakhgoo.exe 2912 Baocpnmf.exe 6108 Cldgmgml.exe 5504 Cbnpja32.exe 4636 Chkhbh32.exe 2340 Coepob32.exe 5732 Ceoillaj.exe 3784 Cliahf32.exe 4128 Cbcieqpd.exe 1412 Ceaealoh.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Majjgmco.exe Mhafoh32.exe File opened for modification C:\Windows\SysWOW64\Ackbfioj.exe Ahenip32.exe File created C:\Windows\SysWOW64\Ncdqoekn.dll Olangmod.exe File opened for modification C:\Windows\SysWOW64\Bnmcdm32.exe Bchogd32.exe File opened for modification C:\Windows\SysWOW64\Ppgeqijb.exe Pmgmonma.exe File opened for modification C:\Windows\SysWOW64\Dkndbkop.exe Dqipeboj.exe File opened for modification C:\Windows\SysWOW64\Fffqjfom.exe Fomhnmgp.exe File opened for modification C:\Windows\SysWOW64\Glcelq32.exe Gfimpfmj.exe File created C:\Windows\SysWOW64\Albipmnm.dll Emnbmoef.exe File created C:\Windows\SysWOW64\Eeojdk32.dll Ecbjdcml.exe File opened for modification C:\Windows\SysWOW64\Neqoidmo.exe Njkklk32.exe File created C:\Windows\SysWOW64\Ijdfphnn.dll Ahjoljqc.exe File created C:\Windows\SysWOW64\Nnendjam.dll Hoonjjgk.exe File opened for modification C:\Windows\SysWOW64\Pqmjhm32.exe Pfgfkd32.exe File created C:\Windows\SysWOW64\Acpnih32.dll Ecpmod32.exe File created C:\Windows\SysWOW64\Ocbhjjqn.exe Nnfpbcbf.exe File created C:\Windows\SysWOW64\Faebdm32.dll Qqcjnell.exe File created C:\Windows\SysWOW64\Lcegbp32.dll Dkokma32.exe File created C:\Windows\SysWOW64\Mjkipdpg.exe Menpgmap.exe File opened for modification C:\Windows\SysWOW64\Jefbomoe.exe Jpijgf32.exe File opened for modification C:\Windows\SysWOW64\Bnkgomnl.exe Bcebadof.exe File opened for modification C:\Windows\SysWOW64\Kbneij32.exe Kldmmp32.exe File created C:\Windows\SysWOW64\Gabfqkan.dll Keakqeal.exe File opened for modification C:\Windows\SysWOW64\Dapkho32.exe Dclknkfp.exe File created C:\Windows\SysWOW64\Ijlkqj32.exe Idpbhc32.exe File created C:\Windows\SysWOW64\Ogeklh32.exe Onmfcb32.exe File created C:\Windows\SysWOW64\Feocoaai.exe Foekbg32.exe File opened for modification C:\Windows\SysWOW64\Ojhijjll.exe Obmeeh32.exe File opened for modification C:\Windows\SysWOW64\Gfpcpefb.exe Gofkckoe.exe File opened for modification C:\Windows\SysWOW64\Mgokflpj.exe Mljficpd.exe File created C:\Windows\SysWOW64\Jgbdfbob.dll Ofijifbj.exe File created C:\Windows\SysWOW64\Ehdmenhh.exe Emniheha.exe File created C:\Windows\SysWOW64\Kldepj32.dll Bhnqoo32.exe File opened for modification C:\Windows\SysWOW64\Bmceaj32.exe Bdjqienq.exe File opened for modification C:\Windows\SysWOW64\Fooecl32.exe Flqigq32.exe File created C:\Windows\SysWOW64\Oibocbah.dll Pdmpck32.exe File created C:\Windows\SysWOW64\Bbnjqmcp.dll Qjjhla32.exe File opened for modification C:\Windows\SysWOW64\Gpkbaekd.exe Giqjdk32.exe File created C:\Windows\SysWOW64\Qbdaqe32.dll Aojljkkf.exe File created C:\Windows\SysWOW64\Bfbjhh32.dll Icdhojka.exe File created C:\Windows\SysWOW64\Aolmnige.dll Fbnflihq.exe File created C:\Windows\SysWOW64\Mjadokme.dll Cbefkp32.exe File opened for modification C:\Windows\SysWOW64\Hiefmp32.exe Hbknqeha.exe File created C:\Windows\SysWOW64\Cahijaij.dll Kemhpl32.exe File created C:\Windows\SysWOW64\Cmanfl32.dll Klfjbpmn.exe File created C:\Windows\SysWOW64\Dhdaao32.exe Dnondf32.exe File created C:\Windows\SysWOW64\Ibnlbm32.exe Ighhed32.exe File created C:\Windows\SysWOW64\Obmeeh32.exe Nqklfe32.exe File opened for modification C:\Windows\SysWOW64\Obanqgkl.exe Okgfdm32.exe File created C:\Windows\SysWOW64\Bfikka32.dll Pnaalghe.exe File created C:\Windows\SysWOW64\Nkleem32.dll Balfko32.exe File created C:\Windows\SysWOW64\Llelkhhc.dll Hpfdkiac.exe File opened for modification C:\Windows\SysWOW64\Ehocjo32.exe Eogoaifl.exe File opened for modification C:\Windows\SysWOW64\Olfgbl32.exe Oobfhh32.exe File created C:\Windows\SysWOW64\Mhoiih32.exe Mjkipdpg.exe File created C:\Windows\SysWOW64\Ocpdpf32.dll Dkmebh32.exe File created C:\Windows\SysWOW64\Pgdqpp32.dll Dldpde32.exe File opened for modification C:\Windows\SysWOW64\Pcagjndj.exe Pndoagfc.exe File opened for modification C:\Windows\SysWOW64\Baocpnmf.exe Blakhgoo.exe File opened for modification C:\Windows\SysWOW64\Ojllkcdk.exe Odocbmfd.exe File created C:\Windows\SysWOW64\Lejngd32.exe Llbinnbq.exe File created C:\Windows\SysWOW64\Pljalipc.exe Ogmidbal.exe File created C:\Windows\SysWOW64\Capnapfh.dll Einmaaqb.exe File created C:\Windows\SysWOW64\Ibjibg32.exe Ikqqfm32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 13452 4320 Process not Found 1116 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpijgf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Agjhadmh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Noijmp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lkchoaif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nelfnd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Beomhm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cbgbpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Libggiik.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ppgeqijb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgnfpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Elbmebbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olgdgibf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdccka32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Neglceej.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dogdnj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hillnoif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ildkpiqo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mfejme32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ngmpmd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bhnqoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ikfgeh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eeelge32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjeaph32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pkaijl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mjjkkghp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baegchgb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kehhjfif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fdnipbbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hnphio32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibncmchl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dffdjmme.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hphglf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahenip32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkopgn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eehnnb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gbcohl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iejqeiif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Emnbmoef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fbomfokl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pehnaqid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Baocpnmf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmkjdj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Liqibm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bpfkiepp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gohfkemf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kijjldkh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ajpqhdkl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cffcilob.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dhkaif32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jimeelkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ibhlmgdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Joqapmcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnmhqh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mehcnlie.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mogccnfg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbjciano.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ndagao32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ihpgda32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmaafcml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dkndbkop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lplpcc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gfgnnedj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpbbln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gdafgefe.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knjqkggm.dll" Bcebadof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fmnkdm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hkbddo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Liqibm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oobfhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ipbahb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kijjldkh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ppopcf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cpbbln32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Gikkof32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gicgjk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjmljn32.dll" Heqnokaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bcpblo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dclknkfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfhgieaf.dll" Eplnijdj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ipkneh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnmmnm32.dll" Iobeno32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ojjoedfn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lafmjb32.dll" Nhnlelfm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Fgdbgbof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibenomhb.dll" Mbenfq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dainko32.dll" Lcggbd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eeelge32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lfgiii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahhbfkbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljmnibhi.dll" Ageofe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oobfhh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhkkcfnf.dll" Lfgiii32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cponodge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngcfgbg.dll" Andghd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dgcmdj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Iphihnjk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpolld32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Okgfdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dhkjooqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ogmidbal.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aepklffh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fbihdhhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mgimmkgp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dhjcdimf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kiggln32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anijoaml.dll" Fikbhiaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnleld32.dll" Lffhpnhe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Eodjdocj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpimflqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lqfgfclm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lgkakm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mgokflpj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Nacmnlkd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Boqlqd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dboiaoff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cjecjahd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkamfl32.dll" Llhnpe32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ilkocb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fngebkna.dll" Ikagpcof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ipmbcm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmbichjn.dll" Hoobnf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkdodffe.dll" Fbkblb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndbkoj32.dll" Mdkhkflh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hiefmp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lianhf32.dll" Eahhcd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lemjlcgo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qdmkbmnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbfmek32.dll" Iikmlnae.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3856 wrote to memory of 2256 3856 2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe 89 PID 2256 wrote to memory of 2400 2256 Mdhkefnj.exe 90 PID 2400 wrote to memory of 4708 2400 Mjednmla.exe 91 PID 4708 wrote to memory of 2228 4708 Mdkhkflh.exe 92 PID 2228 wrote to memory of 2656 2228 Nqaipgal.exe 93 PID 2656 wrote to memory of 5924 2656 Njjmil32.exe 94 PID 5924 wrote to memory of 5916 5924 Ncbaabom.exe 95 PID 5916 wrote to memory of 2776 5916 Nacboi32.exe 96 PID 2776 wrote to memory of 5460 2776 Ndbnkefp.exe 97 PID 5460 wrote to memory of 2384 5460 Njogdldg.exe 98 PID 2384 wrote to memory of 4076 2384 Nbfoeiei.exe 99 PID 4076 wrote to memory of 5276 4076 Njacikbd.exe 100 PID 5276 wrote to memory of 3424 5276 Nqklfe32.exe 101 PID 3424 wrote to memory of 260 3424 Obmeeh32.exe 102 PID 260 wrote to memory of 1452 260 Ojhijjll.exe 103 PID 1452 wrote to memory of 5056 1452 Oqbagd32.exe 104 PID 5056 wrote to memory of 4264 5056 Okgfdm32.exe 105 PID 4264 wrote to memory of 2980 4264 Obanqgkl.exe 106 PID 2980 wrote to memory of 4288 2980 Obdkfg32.exe 107 PID 4288 wrote to memory of 3748 4288 Ocegnoog.exe 108 PID 3748 wrote to memory of 1476 3748 Ojopki32.exe 109 PID 1476 wrote to memory of 1592 1476 Pcgdcome.exe 110 PID 1592 wrote to memory of 5400 1592 Pnmhqh32.exe 111 PID 5400 wrote to memory of 2756 5400 Pegqmbch.exe 112 PID 2756 wrote to memory of 852 2756 Pkaijl32.exe 113 PID 852 wrote to memory of 4812 852 Panabc32.exe 114 PID 4812 wrote to memory of 5844 4812 Pnaalghe.exe 115 PID 5844 wrote to memory of 832 5844 Pcojdnfm.exe 116 PID 832 wrote to memory of 6028 832 Pndoagfc.exe 117 PID 6028 wrote to memory of 1604 6028 Pcagjndj.exe 118 PID 1604 wrote to memory of 4540 1604 Qnfkgfdp.exe 119 PID 4540 wrote to memory of 3812 4540 Qepccqlm.exe 120 PID 3812 wrote to memory of 4252 3812 Qnihlf32.exe 121 PID 4252 wrote to memory of 2560 4252 Qebpipij.exe 122 PID 2560 wrote to memory of 1428 2560 Qlmhfj32.exe 123 PID 1428 wrote to memory of 3216 1428 Aaianaoo.exe 124 PID 3216 wrote to memory of 2872 3216 Agcikk32.exe 125 PID 2872 wrote to memory of 2992 2872 Abimhd32.exe 126 PID 2992 wrote to memory of 1900 2992 Aegidp32.exe 127 PID 1900 wrote to memory of 4828 1900 Alaaajmb.exe 128 PID 4828 wrote to memory of 1172 4828 Aanjiqki.exe 129 PID 1172 wrote to memory of 5648 1172 Ahhbfkbf.exe 130 PID 5648 wrote to memory of 2904 5648 Abngccbl.exe 131 PID 2904 wrote to memory of 5700 2904 Ahjoljqc.exe 132 PID 5700 wrote to memory of 5776 5700 Andghd32.exe 133 PID 5776 wrote to memory of 4772 5776 Aenpeoom.exe 134 PID 4772 wrote to memory of 1596 4772 Blhhaigj.exe 135 PID 1596 wrote to memory of 1544 1596 Baepjpea.exe 136 PID 1544 wrote to memory of 5380 1544 Bhohfj32.exe 137 PID 5380 wrote to memory of 1044 5380 Bjnece32.exe 138 PID 1044 wrote to memory of 4816 1044 Bdfilkbb.exe 139 PID 4816 wrote to memory of 4840 4816 Bajjeo32.exe 140 PID 4840 wrote to memory of 1480 4840 Bdhfaj32.exe 141 PID 1480 wrote to memory of 5372 1480 Bonjnc32.exe 142 PID 5372 wrote to memory of 2448 5372 Balfko32.exe 143 PID 2448 wrote to memory of 2912 2448 Blakhgoo.exe 144 PID 2912 wrote to memory of 6108 2912 Baocpnmf.exe 145 PID 6108 wrote to memory of 5504 6108 Cldgmgml.exe 146 PID 5504 wrote to memory of 4636 5504 Cbnpja32.exe 147 PID 4636 wrote to memory of 2340 4636 Chkhbh32.exe 148 PID 2340 wrote to memory of 5732 2340 Coepob32.exe 149 PID 5732 wrote to memory of 3784 5732 Ceoillaj.exe 150 PID 3784 wrote to memory of 4128 3784 Cliahf32.exe 151 PID 4128 wrote to memory of 1412 4128 Cbcieqpd.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_58ff17de038bde48e7d5b33222ac760e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\Mdhkefnj.exeC:\Windows\system32\Mdhkefnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\Mjednmla.exeC:\Windows\system32\Mjednmla.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\Mdkhkflh.exeC:\Windows\system32\Mdkhkflh.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\Nqaipgal.exeC:\Windows\system32\Nqaipgal.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\Njjmil32.exeC:\Windows\system32\Njjmil32.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\Ncbaabom.exeC:\Windows\system32\Ncbaabom.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\Nacboi32.exeC:\Windows\system32\Nacboi32.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\Ndbnkefp.exeC:\Windows\system32\Ndbnkefp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\Njogdldg.exeC:\Windows\system32\Njogdldg.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\Nbfoeiei.exeC:\Windows\system32\Nbfoeiei.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\Njacikbd.exeC:\Windows\system32\Njacikbd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\Nqklfe32.exeC:\Windows\system32\Nqklfe32.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\Obmeeh32.exeC:\Windows\system32\Obmeeh32.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\Ojhijjll.exeC:\Windows\system32\Ojhijjll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\Oqbagd32.exeC:\Windows\system32\Oqbagd32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\Okgfdm32.exeC:\Windows\system32\Okgfdm32.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\Obanqgkl.exeC:\Windows\system32\Obanqgkl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\Obdkfg32.exeC:\Windows\system32\Obdkfg32.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\Ocegnoog.exeC:\Windows\system32\Ocegnoog.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\Ojopki32.exeC:\Windows\system32\Ojopki32.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\Pcgdcome.exeC:\Windows\system32\Pcgdcome.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\Pnmhqh32.exeC:\Windows\system32\Pnmhqh32.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\Pegqmbch.exeC:\Windows\system32\Pegqmbch.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\Pkaijl32.exeC:\Windows\system32\Pkaijl32.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\Panabc32.exeC:\Windows\system32\Panabc32.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\Pnaalghe.exeC:\Windows\system32\Pnaalghe.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\Pcojdnfm.exeC:\Windows\system32\Pcojdnfm.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\Pndoagfc.exeC:\Windows\system32\Pndoagfc.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\Pcagjndj.exeC:\Windows\system32\Pcagjndj.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\Qnfkgfdp.exeC:\Windows\system32\Qnfkgfdp.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\Qepccqlm.exeC:\Windows\system32\Qepccqlm.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\Qnihlf32.exeC:\Windows\system32\Qnihlf32.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\Qebpipij.exeC:\Windows\system32\Qebpipij.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\Qlmhfj32.exeC:\Windows\system32\Qlmhfj32.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\Aaianaoo.exeC:\Windows\system32\Aaianaoo.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\Agcikk32.exeC:\Windows\system32\Agcikk32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\Abimhd32.exeC:\Windows\system32\Abimhd32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\Aegidp32.exeC:\Windows\system32\Aegidp32.exe39⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\Alaaajmb.exeC:\Windows\system32\Alaaajmb.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\Aanjiqki.exeC:\Windows\system32\Aanjiqki.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\Ahhbfkbf.exeC:\Windows\system32\Ahhbfkbf.exe42⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\Abngccbl.exeC:\Windows\system32\Abngccbl.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\SysWOW64\Ahjoljqc.exeC:\Windows\system32\Ahjoljqc.exe44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\Andghd32.exeC:\Windows\system32\Andghd32.exe45⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\Aenpeoom.exeC:\Windows\system32\Aenpeoom.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\Blhhaigj.exeC:\Windows\system32\Blhhaigj.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\Baepjpea.exeC:\Windows\system32\Baepjpea.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\Bhohfj32.exeC:\Windows\system32\Bhohfj32.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\Bjnece32.exeC:\Windows\system32\Bjnece32.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\Bdfilkbb.exeC:\Windows\system32\Bdfilkbb.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\Bajjeo32.exeC:\Windows\system32\Bajjeo32.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\Bdhfaj32.exeC:\Windows\system32\Bdhfaj32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\Bonjnc32.exeC:\Windows\system32\Bonjnc32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\Balfko32.exeC:\Windows\system32\Balfko32.exe55⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\Blakhgoo.exeC:\Windows\system32\Blakhgoo.exe56⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\Baocpnmf.exeC:\Windows\system32\Baocpnmf.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\Cldgmgml.exeC:\Windows\system32\Cldgmgml.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\Cbnpja32.exeC:\Windows\system32\Cbnpja32.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\Chkhbh32.exeC:\Windows\system32\Chkhbh32.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\Coepob32.exeC:\Windows\system32\Coepob32.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\Ceoillaj.exeC:\Windows\system32\Ceoillaj.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\Cliahf32.exeC:\Windows\system32\Cliahf32.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\Cbcieqpd.exeC:\Windows\system32\Cbcieqpd.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\Ceaealoh.exeC:\Windows\system32\Ceaealoh.exe65⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\Clknnf32.exeC:\Windows\system32\Clknnf32.exe66⤵PID:6076
-
C:\Windows\SysWOW64\Cbefkp32.exeC:\Windows\system32\Cbefkp32.exe67⤵
- Drops file in System32 directory
PID:3540 -
C:\Windows\SysWOW64\Cdfbbhdp.exeC:\Windows\system32\Cdfbbhdp.exe68⤵PID:4360
-
C:\Windows\SysWOW64\Cbgbpp32.exeC:\Windows\system32\Cbgbpp32.exe69⤵
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\Dlpgiebo.exeC:\Windows\system32\Dlpgiebo.exe70⤵PID:1004
-
C:\Windows\SysWOW64\Dbjofp32.exeC:\Windows\system32\Dbjofp32.exe71⤵PID:1932
-
C:\Windows\SysWOW64\Dkedjbgg.exeC:\Windows\system32\Dkedjbgg.exe72⤵PID:3460
-
C:\Windows\SysWOW64\Daolgl32.exeC:\Windows\system32\Daolgl32.exe73⤵PID:500
-
C:\Windows\SysWOW64\Dldpde32.exeC:\Windows\system32\Dldpde32.exe74⤵
- Drops file in System32 directory
PID:3396 -
C:\Windows\SysWOW64\Dboiaoff.exeC:\Windows\system32\Dboiaoff.exe75⤵
- Modifies registry class
PID:3016 -
C:\Windows\SysWOW64\Dhkaif32.exeC:\Windows\system32\Dhkaif32.exe76⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Windows\SysWOW64\Dcaefo32.exeC:\Windows\system32\Dcaefo32.exe77⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5316 -
C:\Windows\SysWOW64\Ddbbngjb.exeC:\Windows\system32\Ddbbngjb.exe78⤵PID:2128
-
C:\Windows\SysWOW64\Deanhj32.exeC:\Windows\system32\Deanhj32.exe79⤵PID:2804
-
C:\Windows\SysWOW64\Elkfed32.exeC:\Windows\system32\Elkfed32.exe80⤵PID:2012
-
C:\Windows\SysWOW64\Eahomk32.exeC:\Windows\system32\Eahomk32.exe81⤵PID:4492
-
C:\Windows\SysWOW64\Ehbgjenf.exeC:\Windows\system32\Ehbgjenf.exe82⤵PID:4200
-
C:\Windows\SysWOW64\Eolpfo32.exeC:\Windows\system32\Eolpfo32.exe83⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3272 -
C:\Windows\SysWOW64\Ehddpdlc.exeC:\Windows\system32\Ehddpdlc.exe84⤵PID:5680
-
C:\Windows\SysWOW64\Eamhhjbd.exeC:\Windows\system32\Eamhhjbd.exe85⤵PID:5272
-
C:\Windows\SysWOW64\Elbmebbj.exeC:\Windows\system32\Elbmebbj.exe86⤵
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Windows\SysWOW64\Ecmebm32.exeC:\Windows\system32\Ecmebm32.exe87⤵PID:5484
-
C:\Windows\SysWOW64\Ekhjgoga.exeC:\Windows\system32\Ekhjgoga.exe88⤵PID:5068
-
C:\Windows\SysWOW64\Eaabci32.exeC:\Windows\system32\Eaabci32.exe89⤵PID:2488
-
C:\Windows\SysWOW64\Fkjfloeo.exeC:\Windows\system32\Fkjfloeo.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3964 -
C:\Windows\SysWOW64\Ffpjihee.exeC:\Windows\system32\Ffpjihee.exe91⤵PID:3344
-
C:\Windows\SysWOW64\Fljcfa32.exeC:\Windows\system32\Fljcfa32.exe92⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5180 -
C:\Windows\SysWOW64\Fcckcl32.exeC:\Windows\system32\Fcckcl32.exe93⤵PID:4104
-
C:\Windows\SysWOW64\Fdegkdim.exeC:\Windows\system32\Fdegkdim.exe94⤵PID:3572
-
C:\Windows\SysWOW64\Fkopgn32.exeC:\Windows\system32\Fkopgn32.exe95⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Windows\SysWOW64\Fbihdhhf.exeC:\Windows\system32\Fbihdhhf.exe96⤵
- Modifies registry class
PID:696 -
C:\Windows\SysWOW64\Fhbpqb32.exeC:\Windows\system32\Fhbpqb32.exe97⤵PID:1496
-
C:\Windows\SysWOW64\Fomhnmgp.exeC:\Windows\system32\Fomhnmgp.exe98⤵
- Drops file in System32 directory
PID:3636 -
C:\Windows\SysWOW64\Fffqjfom.exeC:\Windows\system32\Fffqjfom.exe99⤵PID:4604
-
C:\Windows\SysWOW64\Flqigq32.exeC:\Windows\system32\Flqigq32.exe100⤵
- Drops file in System32 directory
PID:4332 -
C:\Windows\SysWOW64\Fooecl32.exeC:\Windows\system32\Fooecl32.exe101⤵PID:5900
-
C:\Windows\SysWOW64\Gfimpfmj.exeC:\Windows\system32\Gfimpfmj.exe102⤵
- Drops file in System32 directory
PID:3416 -
C:\Windows\SysWOW64\Glcelq32.exeC:\Windows\system32\Glcelq32.exe103⤵PID:3772
-
C:\Windows\SysWOW64\Gbpnegbo.exeC:\Windows\system32\Gbpnegbo.exe104⤵PID:4476
-
C:\Windows\SysWOW64\Gdnjabab.exeC:\Windows\system32\Gdnjabab.exe105⤵PID:844
-
C:\Windows\SysWOW64\Goconkah.exeC:\Windows\system32\Goconkah.exe106⤵PID:3492
-
C:\Windows\SysWOW64\Gdqgfbop.exeC:\Windows\system32\Gdqgfbop.exe107⤵PID:2532
-
C:\Windows\SysWOW64\Gofkckoe.exeC:\Windows\system32\Gofkckoe.exe108⤵
- Drops file in System32 directory
PID:3532 -
C:\Windows\SysWOW64\Gfpcpefb.exeC:\Windows\system32\Gfpcpefb.exe109⤵PID:2664
-
C:\Windows\SysWOW64\Ghnpmqef.exeC:\Windows\system32\Ghnpmqef.exe110⤵PID:4560
-
C:\Windows\SysWOW64\Gohhik32.exeC:\Windows\system32\Gohhik32.exe111⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4820 -
C:\Windows\SysWOW64\Gfbpfedp.exeC:\Windows\system32\Gfbpfedp.exe112⤵PID:3700
-
C:\Windows\SysWOW64\Gmlhbo32.exeC:\Windows\system32\Gmlhbo32.exe113⤵PID:4684
-
C:\Windows\SysWOW64\Hcfqoici.exeC:\Windows\system32\Hcfqoici.exe114⤵PID:5892
-
C:\Windows\SysWOW64\Hicihp32.exeC:\Windows\system32\Hicihp32.exe115⤵PID:4228
-
C:\Windows\SysWOW64\Hkaedk32.exeC:\Windows\system32\Hkaedk32.exe116⤵PID:3048
-
C:\Windows\SysWOW64\Hbknqeha.exeC:\Windows\system32\Hbknqeha.exe117⤵
- Drops file in System32 directory
PID:5044 -
C:\Windows\SysWOW64\Hiefmp32.exeC:\Windows\system32\Hiefmp32.exe118⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:5112 -
C:\Windows\SysWOW64\Hoonjjgk.exeC:\Windows\system32\Hoonjjgk.exe119⤵
- Drops file in System32 directory
PID:1516 -
C:\Windows\SysWOW64\Hfiffd32.exeC:\Windows\system32\Hfiffd32.exe120⤵PID:4308
-
C:\Windows\SysWOW64\Hmcocn32.exeC:\Windows\system32\Hmcocn32.exe121⤵PID:1540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-