Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 20:35
Behavioral task
behavioral1
Sample
2026-08-19_271535354898c6c973a463b4ea279a9e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-08-19_271535354898c6c973a463b4ea279a9e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 400KB
- Sample260819-zdasnavzhy
- SHA256 39f2e9c60b09a37911f4f9cc5e72a774e06a95daf23cfb9711020a6cd8b7a6da
- MD5 271535354898c6c973a463b4ea279a9e
- SHA1 00a9bb8845500d7b5129d0a98fc326a6fce76f78
- SHA512 b918ee5cea1bdff477b72ae55bf9473ab69ea92bb6adb8a839f25f541c76666c5008f4627d363734e2c09882cd19caddace34a4717df287118de0c4f79b2871c
- SSDEEP 6144:EVctke6/CSQYJ8wEbbL5lULW8wEbq9ByvZ6Mxv5Rar3O6B9fZSLhZmz:4cs2o8wE39uW8wESByvNv54B9f01Zm
- TLSH T1E3949B8377D19836CA2809F004EA9274172CDC22BF26DFAF6156F398BDF1985DA2C553
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
berbew
C2
-
http://viruslist.com/wcmd.txt
-
http://viruslist.com/ppslog.php
-
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Eqbclagp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lhfmmp32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Aqjpod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lnbkeclf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cfigib32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Gkdaij32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dooaip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Iebnqofj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehappnjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kelaef32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Opnglhnd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cgndikgd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lnmbjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pcepdl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Acclejeb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ciefpn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lbnnphhk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Aqjpod32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ckkilhjm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Chbcphph.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ekkkip32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ebgpkj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fmjqjqao.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kjnbhkqp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Pqmjhm32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djaipe32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bokeai32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jngbcj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Bnjkbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Edhado32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ppopcf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ohiefdhd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ehcfkhel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Cobkbhgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Ecbjdcml.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ilglbjbl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oqakln32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Bmngjj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fnmeic32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mikcbb32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hhiacb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Epdaneff.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Epkpdn32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Njekfenc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Cfjnch32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dmbbaq32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ggnenagl.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kgefae32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Ommjipel.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dbmfje32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Djelqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Nmighf32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Podcnh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Qopbjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Fbellhbi.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hifcqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Jekqgnno.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lifqbi32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Jecoog32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kkomgkoj.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dopiqj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Eoneah32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Maealn32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Doanno32.exe - Detects Padodor trojan 42 IoCs
resource yara_rule behavioral2/files/0x000f000000016cdf-5.dat family_padodor behavioral2/files/0x000d00000001c525-12.dat family_padodor behavioral2/files/0x000d00000001c527-19.dat family_padodor behavioral2/files/0x000d00000001c529-26.dat family_padodor behavioral2/files/0x000d00000001c52c-33.dat family_padodor behavioral2/files/0x000d00000001c52e-40.dat family_padodor behavioral2/files/0x000c00000001c530-49.dat family_padodor behavioral2/files/0x000e00000001c522-54.dat family_padodor behavioral2/files/0x000c00000001c533-61.dat family_padodor behavioral2/files/0x000c00000001c535-68.dat family_padodor behavioral2/files/0x000c00000001c537-77.dat family_padodor behavioral2/files/0x000c00000001c539-82.dat family_padodor behavioral2/files/0x000c00000001c53b-88.dat family_padodor behavioral2/files/0x000c00000001c53d-96.dat family_padodor behavioral2/files/0x000c00000001c53f-103.dat family_padodor behavioral2/files/0x000c00000001c541-110.dat family_padodor behavioral2/files/0x000c00000001c543-117.dat family_padodor behavioral2/files/0x000c00000001c545-124.dat family_padodor behavioral2/files/0x000c00000001c547-130.dat family_padodor behavioral2/files/0x000c00000001c549-138.dat family_padodor behavioral2/files/0x000c00000001c54c-147.dat family_padodor behavioral2/files/0x000c00000001c54e-152.dat family_padodor behavioral2/files/0x000c00000001c550-159.dat family_padodor behavioral2/files/0x000c00000001c552-166.dat family_padodor behavioral2/files/0x000c00000001c554-173.dat family_padodor behavioral2/files/0x000c00000001c556-180.dat family_padodor behavioral2/files/0x000c00000001c558-187.dat family_padodor behavioral2/files/0x000c00000001c55a-194.dat family_padodor behavioral2/files/0x000c00000001c55c-201.dat family_padodor behavioral2/memory/4064-202-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c55f-208.dat family_padodor behavioral2/memory/2036-209-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/3292-216-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/files/0x000c00000001c561-217.dat family_padodor behavioral2/files/0x000c00000001c563-222.dat family_padodor behavioral2/memory/5620-229-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5824-234-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/5336-239-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/904-314-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/4820-488-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/2496-495-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor behavioral2/memory/2732-501-0x0000000000400000-0x0000000000467000-memory.dmp family_padodor - Executes dropped EXE 64 IoCs
pid Process 4748 Ldeonbkd.exe 4560 Lbjlpo32.exe 5488 Lifqbi32.exe 4820 Lemagjjj.exe 988 Mikjmhaq.exe 2568 Mgagll32.exe 2600 Megdmhbp.exe 5792 Mlqljb32.exe 2740 Npabeq32.exe 2348 Niifnf32.exe 4564 Npcokpln.exe 1588 Njnpie32.exe 1744 Nnlhod32.exe 2640 Olcbfp32.exe 4644 Oflfoepg.exe 2780 Oqakln32.exe 1888 Ognpoheh.exe 3384 Pqhammje.exe 5104 Pmoabn32.exe 3408 Pqmjhm32.exe 4712 Pgiojf32.exe 704 Pmfhbm32.exe 568 Qgnief32.exe 5756 Qnhabp32.exe 1800 Ammnclcj.exe 4368 Acgfpf32.exe 2824 Aeiooi32.exe 3508 Acnlqe32.exe 4064 Badipiae.exe 2036 Bfabhppm.exe 3292 Bmngjj32.exe 4844 Bmpcpjcd.exe 5620 Chhdbb32.exe 5824 Chjaha32.exe 5336 Cabfagee.exe 1428 Caebfg32.exe 2324 Cfakon32.exe 4948 Cdfkhb32.exe 4984 Cokpekpj.exe 624 Djbpjl32.exe 5860 Dopiqj32.exe 2664 Dkgjekai.exe 1920 Dfmjjl32.exe 5324 Dmgbgf32.exe 4224 Ddakdqff.exe 2068 Eeagnc32.exe 480 Eknpfj32.exe 3236 Ehappnjj.exe 2204 Edhado32.exe 904 Eoneah32.exe 4240 Eopbghnb.exe 4060 Ehifpm32.exe 5868 Fneohd32.exe 4492 Fkiobhac.exe 2396 Feocoaai.exe 3824 Foghhg32.exe 864 Feapdaof.exe 52 Fnmeic32.exe 2828 Fgeibicb.exe 5036 Fajnoabh.exe 3044 Gonnhf32.exe 4432 Gkeonggf.exe 4924 Gekckpgl.exe 5316 Gaadpqmp.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lkpkcm32.dll Oflfoepg.exe File created C:\Windows\SysWOW64\Olgdgibf.exe Ogklob32.exe File opened for modification C:\Windows\SysWOW64\Cabofaaj.exe Cjhfjg32.exe File created C:\Windows\SysWOW64\Gbdcekfc.dll Lnmbjd32.exe File opened for modification C:\Windows\SysWOW64\Oblmnmjl.exe Olbdacbp.exe File created C:\Windows\SysWOW64\Fihfgc32.dll Oblmnmjl.exe File created C:\Windows\SysWOW64\Eehmnind.dll Ecgcpc32.exe File created C:\Windows\SysWOW64\Klbmcf32.dll Mflbdibj.exe File opened for modification C:\Windows\SysWOW64\Pgfljqia.exe Plagmh32.exe File created C:\Windows\SysWOW64\Acnefoac.exe Ajeami32.exe File created C:\Windows\SysWOW64\Mdhbpkgj.dll Lgqfmcge.exe File created C:\Windows\SysWOW64\Alpboida.exe Anobaa32.exe File opened for modification C:\Windows\SysWOW64\Ddbppa32.exe Doeghk32.exe File opened for modification C:\Windows\SysWOW64\Jngbcj32.exe Jofaeb32.exe File created C:\Windows\SysWOW64\Cabfagee.exe Chjaha32.exe File opened for modification C:\Windows\SysWOW64\Jnklnfpq.exe Jhndepbi.exe File opened for modification C:\Windows\SysWOW64\Qoecol32.exe Qcobjk32.exe File created C:\Windows\SysWOW64\Gmpqof32.exe Gplpfb32.exe File created C:\Windows\SysWOW64\Bdhcmijn.dll Eeagnc32.exe File created C:\Windows\SysWOW64\Oopnio32.dll Mikcbb32.exe File opened for modification C:\Windows\SysWOW64\Mpiejkql.exe Miomnaip.exe File created C:\Windows\SysWOW64\Idieob32.exe Ijcaaibe.exe File created C:\Windows\SysWOW64\Njdlfbgm.exe Niconj32.exe File created C:\Windows\SysWOW64\Ddfikaeq.exe Dnmaog32.exe File created C:\Windows\SysWOW64\Fajanl32.dll Kppimogj.exe File created C:\Windows\SysWOW64\Kkjlmn32.dll Jhijjp32.exe File created C:\Windows\SysWOW64\Bpeblo32.dll Qgnief32.exe File created C:\Windows\SysWOW64\Dkgjekai.exe Dopiqj32.exe File created C:\Windows\SysWOW64\Obphmnpb.dll Plpqba32.exe File created C:\Windows\SysWOW64\Hmpclnof.exe Hbjonepq.exe File opened for modification C:\Windows\SysWOW64\Lfqgjh32.exe Kimgad32.exe File opened for modification C:\Windows\SysWOW64\Edhado32.exe Ehappnjj.exe File created C:\Windows\SysWOW64\Egmpfbog.dll Oondhocf.exe File created C:\Windows\SysWOW64\Olhgka32.dll Pidaleei.exe File created C:\Windows\SysWOW64\Njnpie32.exe Npcokpln.exe File opened for modification C:\Windows\SysWOW64\Jilnjf32.exe Jfkehk32.exe File opened for modification C:\Windows\SysWOW64\Gaqmej32.exe Ggkiha32.exe File opened for modification C:\Windows\SysWOW64\Idfaolpb.exe Igbaeh32.exe File created C:\Windows\SysWOW64\Lmbhqj32.exe Lgephccp.exe File created C:\Windows\SysWOW64\Fchpnh32.dll Ehcfkhel.exe File created C:\Windows\SysWOW64\Oocmcn32.exe Ohiefdhd.exe File opened for modification C:\Windows\SysWOW64\Chblebll.exe Cnlhhi32.exe File opened for modification C:\Windows\SysWOW64\Alnfiifd.exe Aojepe32.exe File created C:\Windows\SysWOW64\Cokpekpj.exe Cdfkhb32.exe File opened for modification C:\Windows\SysWOW64\Moglkikl.exe Mikcbb32.exe File created C:\Windows\SysWOW64\Pllnbh32.exe Pgoejapi.exe File created C:\Windows\SysWOW64\Oceidi32.dll Jncfmgfi.exe File opened for modification C:\Windows\SysWOW64\Hmpjfdcb.exe Hplimpdi.exe File created C:\Windows\SysWOW64\Afmfhcff.dll Olcbfp32.exe File opened for modification C:\Windows\SysWOW64\Doanno32.exe Dooaip32.exe File created C:\Windows\SysWOW64\Hblkddmn.exe Hmpclnof.exe File opened for modification C:\Windows\SysWOW64\Mqojlbcb.exe Mggecl32.exe File created C:\Windows\SysWOW64\Qnhabp32.exe Qgnief32.exe File opened for modification C:\Windows\SysWOW64\Boipfp32.exe Bfqkmj32.exe File opened for modification C:\Windows\SysWOW64\Adoamfhn.exe Qobhepjf.exe File opened for modification C:\Windows\SysWOW64\Bfchcijo.exe Boipfp32.exe File created C:\Windows\SysWOW64\Noehlgol.exe Niipdpae.exe File created C:\Windows\SysWOW64\Dhejij32.exe Dakampio.exe File created C:\Windows\SysWOW64\Nclaem32.dll Licfgmpa.exe File created C:\Windows\SysWOW64\Ojfbfmbf.dll Eimegk32.exe File created C:\Windows\SysWOW64\Lfeaegdi.exe Llpmhodc.exe File opened for modification C:\Windows\SysWOW64\Kaehepeg.exe Kkhpmigp.exe File created C:\Windows\SysWOW64\Qhbogb32.dll Ljmmnf32.exe File opened for modification C:\Windows\SysWOW64\Mjpbkc32.exe Miofcked.exe - Program crash 1 IoCs
pid pid_target Process procid_target 12048 11760 WerFault.exe 690 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fkiobhac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gekckpgl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Npgalidl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Doanno32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kjeiij32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_271535354898c6c973a463b4ea279a9e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lifjgb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Opnglhnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ggilbb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hhiacb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jbmehf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aoofej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Miaica32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Boipfp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kfgpblda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lcimmn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dopiqj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkechjib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kkhpmigp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pimkkfka.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lgephccp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lokdgpqe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pnifoaba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eqbclagp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgagll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kbpboj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lblakh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ahakhg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgbfbc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fldnoo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bdpanj32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oqakln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ognpoheh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oomnmfid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mhjpnibf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nlfeeelm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Edhado32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jecoog32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fgdbgbof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Obafim32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mgoboake.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Epkpdn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hifcqo32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ommjipel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eblpqono.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jjoibadl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iibclmkn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pmoabn32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaqmej32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Iacbbh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ckkilhjm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jgkdkg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Anobaa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bgnfpp32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Chjaha32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ghdoae32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jlhlcnge.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Efpofi32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lmaafcml.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kppimogj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cpbbln32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gplpfb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gpcffalc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Jpalomaq.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ehappnjj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fkiobhac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbhpjd32.dll" Kkcfbj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Phodlm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fihnhc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Gpbplkhh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Njjdae32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ocbhjjqn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomfme32.dll" Lifqbi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfjfkhe.dll" Fgbfbc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Meefhl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lgephccp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bhfmic32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cbppah32.dll" Bkgekock.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ahonbhig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Aoifoa32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbmkleoe.dll" Dakampio.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lnmbjd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmnohphp.dll" Oioojh32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Oiakpheo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Bmqhlk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mehpnbkg.dll" Megdmhbp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fajnoabh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfflabao.dll" Aoifoa32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jekqgnno.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dhdaao32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Plpqba32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jjoibadl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aojabkqc.dll" Ppgeqijb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Aaenlj32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Banabi32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kegbegqm.dll" Fgenoj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djbddnmm.dll" Fdiohnek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Cabfagee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Qhlamhkj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cadllq32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hplimpdi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fopgipok.dll" Qaalkamf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ckeigc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Emjgcc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kgiibnib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Cdfkhb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnggoe32.dll" Kqkeoama.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kkechjib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Jgkdkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Qaalkamf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Ompfnoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jqofjd32.dll" Ompfnoci.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Oflfoepg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Fmnkdm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Blecdn32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Jgnqafgk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ohceqo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghphddfl.dll" Qopbjf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Pjkmhblk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpmnbbpe.dll" Ckgnbl32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Edhado32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lihfmb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mikcbb32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Bqhlpbjd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ejklfd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekhocd32.dll" Ekdolcbm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ghdoae32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Ohiefdhd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4148 wrote to memory of 4748 4148 2026-08-19_271535354898c6c973a463b4ea279a9e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe 89 PID 4748 wrote to memory of 4560 4748 Ldeonbkd.exe 90 PID 4560 wrote to memory of 5488 4560 Lbjlpo32.exe 91 PID 5488 wrote to memory of 4820 5488 Lifqbi32.exe 92 PID 4820 wrote to memory of 988 4820 Lemagjjj.exe 93 PID 988 wrote to memory of 2568 988 Mikjmhaq.exe 94 PID 2568 wrote to memory of 2600 2568 Mgagll32.exe 95 PID 2600 wrote to memory of 5792 2600 Megdmhbp.exe 96 PID 5792 wrote to memory of 2740 5792 Mlqljb32.exe 97 PID 2740 wrote to memory of 2348 2740 Npabeq32.exe 98 PID 2348 wrote to memory of 4564 2348 Niifnf32.exe 99 PID 4564 wrote to memory of 1588 4564 Npcokpln.exe 100 PID 1588 wrote to memory of 1744 1588 Njnpie32.exe 101 PID 1744 wrote to memory of 2640 1744 Nnlhod32.exe 102 PID 2640 wrote to memory of 4644 2640 Olcbfp32.exe 103 PID 4644 wrote to memory of 2780 4644 Oflfoepg.exe 104 PID 2780 wrote to memory of 1888 2780 Oqakln32.exe 105 PID 1888 wrote to memory of 3384 1888 Ognpoheh.exe 106 PID 3384 wrote to memory of 5104 3384 Pqhammje.exe 107 PID 5104 wrote to memory of 3408 5104 Pmoabn32.exe 108 PID 3408 wrote to memory of 4712 3408 Pqmjhm32.exe 109 PID 4712 wrote to memory of 704 4712 Pgiojf32.exe 110 PID 704 wrote to memory of 568 704 Pmfhbm32.exe 111 PID 568 wrote to memory of 5756 568 Qgnief32.exe 112 PID 5756 wrote to memory of 1800 5756 Qnhabp32.exe 113 PID 1800 wrote to memory of 4368 1800 Ammnclcj.exe 114 PID 4368 wrote to memory of 2824 4368 Acgfpf32.exe 115 PID 2824 wrote to memory of 3508 2824 Aeiooi32.exe 116 PID 3508 wrote to memory of 4064 3508 Acnlqe32.exe 117 PID 4064 wrote to memory of 2036 4064 Badipiae.exe 118 PID 2036 wrote to memory of 3292 2036 Bfabhppm.exe 119 PID 3292 wrote to memory of 4844 3292 Bmngjj32.exe 120 PID 4844 wrote to memory of 5620 4844 Bmpcpjcd.exe 121 PID 5620 wrote to memory of 5824 5620 Chhdbb32.exe 122 PID 5824 wrote to memory of 5336 5824 Chjaha32.exe 123 PID 5336 wrote to memory of 1428 5336 Cabfagee.exe 124 PID 1428 wrote to memory of 2324 1428 Caebfg32.exe 125 PID 2324 wrote to memory of 4948 2324 Cfakon32.exe 126 PID 4948 wrote to memory of 4984 4948 Cdfkhb32.exe 127 PID 4984 wrote to memory of 624 4984 Cokpekpj.exe 128 PID 624 wrote to memory of 5860 624 Djbpjl32.exe 129 PID 5860 wrote to memory of 2664 5860 Dopiqj32.exe 130 PID 2664 wrote to memory of 1920 2664 Dkgjekai.exe 131 PID 1920 wrote to memory of 5324 1920 Dfmjjl32.exe 132 PID 5324 wrote to memory of 4224 5324 Dmgbgf32.exe 133 PID 4224 wrote to memory of 2068 4224 Ddakdqff.exe 134 PID 2068 wrote to memory of 480 2068 Eeagnc32.exe 135 PID 480 wrote to memory of 3236 480 Eknpfj32.exe 136 PID 3236 wrote to memory of 2204 3236 Ehappnjj.exe 137 PID 2204 wrote to memory of 904 2204 Edhado32.exe 138 PID 904 wrote to memory of 4240 904 Eoneah32.exe 139 PID 4240 wrote to memory of 4060 4240 Eopbghnb.exe 140 PID 4060 wrote to memory of 5868 4060 Ehifpm32.exe 141 PID 5868 wrote to memory of 4492 5868 Fneohd32.exe 142 PID 4492 wrote to memory of 2396 4492 Fkiobhac.exe 143 PID 2396 wrote to memory of 3824 2396 Feocoaai.exe 144 PID 3824 wrote to memory of 864 3824 Foghhg32.exe 145 PID 864 wrote to memory of 52 864 Feapdaof.exe 146 PID 52 wrote to memory of 2828 52 Fnmeic32.exe 147 PID 2828 wrote to memory of 5036 2828 Fgeibicb.exe 148 PID 5036 wrote to memory of 3044 5036 Fajnoabh.exe 149 PID 3044 wrote to memory of 4432 3044 Gonnhf32.exe 150 PID 4432 wrote to memory of 4924 4432 Gkeonggf.exe 151 PID 4924 wrote to memory of 5316 4924 Gekckpgl.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_271535354898c6c973a463b4ea279a9e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_271535354898c6c973a463b4ea279a9e_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\Ldeonbkd.exeC:\Windows\system32\Ldeonbkd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\Lbjlpo32.exeC:\Windows\system32\Lbjlpo32.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\Lifqbi32.exeC:\Windows\system32\Lifqbi32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\Lemagjjj.exeC:\Windows\system32\Lemagjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\Mikjmhaq.exeC:\Windows\system32\Mikjmhaq.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\Mgagll32.exeC:\Windows\system32\Mgagll32.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\Megdmhbp.exeC:\Windows\system32\Megdmhbp.exe8⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\Mlqljb32.exeC:\Windows\system32\Mlqljb32.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\Niifnf32.exeC:\Windows\system32\Niifnf32.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\Npcokpln.exeC:\Windows\system32\Npcokpln.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\Njnpie32.exeC:\Windows\system32\Njnpie32.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\Nnlhod32.exeC:\Windows\system32\Nnlhod32.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\Olcbfp32.exeC:\Windows\system32\Olcbfp32.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\Oflfoepg.exeC:\Windows\system32\Oflfoepg.exe16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\Oqakln32.exeC:\Windows\system32\Oqakln32.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\Ognpoheh.exeC:\Windows\system32\Ognpoheh.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\Pqhammje.exeC:\Windows\system32\Pqhammje.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\Pmoabn32.exeC:\Windows\system32\Pmoabn32.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\Pqmjhm32.exeC:\Windows\system32\Pqmjhm32.exe21⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\Pgiojf32.exeC:\Windows\system32\Pgiojf32.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\Pmfhbm32.exeC:\Windows\system32\Pmfhbm32.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\Qgnief32.exeC:\Windows\system32\Qgnief32.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\Qnhabp32.exeC:\Windows\system32\Qnhabp32.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\Ammnclcj.exeC:\Windows\system32\Ammnclcj.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\Acgfpf32.exeC:\Windows\system32\Acgfpf32.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\Aeiooi32.exeC:\Windows\system32\Aeiooi32.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\Acnlqe32.exeC:\Windows\system32\Acnlqe32.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\Badipiae.exeC:\Windows\system32\Badipiae.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\Bfabhppm.exeC:\Windows\system32\Bfabhppm.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\Bmngjj32.exeC:\Windows\system32\Bmngjj32.exe32⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\Bmpcpjcd.exeC:\Windows\system32\Bmpcpjcd.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\Chhdbb32.exeC:\Windows\system32\Chhdbb32.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\Chjaha32.exeC:\Windows\system32\Chjaha32.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\Cabfagee.exeC:\Windows\system32\Cabfagee.exe36⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\Caebfg32.exeC:\Windows\system32\Caebfg32.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\Cfakon32.exeC:\Windows\system32\Cfakon32.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\Cdfkhb32.exeC:\Windows\system32\Cdfkhb32.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\Cokpekpj.exeC:\Windows\system32\Cokpekpj.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\Djbpjl32.exeC:\Windows\system32\Djbpjl32.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\Dopiqj32.exeC:\Windows\system32\Dopiqj32.exe42⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\Dkgjekai.exeC:\Windows\system32\Dkgjekai.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\Dfmjjl32.exeC:\Windows\system32\Dfmjjl32.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\Dmgbgf32.exeC:\Windows\system32\Dmgbgf32.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\Ddakdqff.exeC:\Windows\system32\Ddakdqff.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\Eeagnc32.exeC:\Windows\system32\Eeagnc32.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\Eknpfj32.exeC:\Windows\system32\Eknpfj32.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\Ehappnjj.exeC:\Windows\system32\Ehappnjj.exe49⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\Edhado32.exeC:\Windows\system32\Edhado32.exe50⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\Eoneah32.exeC:\Windows\system32\Eoneah32.exe51⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\Eopbghnb.exeC:\Windows\system32\Eopbghnb.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\Ehifpm32.exeC:\Windows\system32\Ehifpm32.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\Fneohd32.exeC:\Windows\system32\Fneohd32.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\Fkiobhac.exeC:\Windows\system32\Fkiobhac.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\Feocoaai.exeC:\Windows\system32\Feocoaai.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\Foghhg32.exeC:\Windows\system32\Foghhg32.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\Feapdaof.exeC:\Windows\system32\Feapdaof.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\Fnmeic32.exeC:\Windows\system32\Fnmeic32.exe59⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\Fgeibicb.exeC:\Windows\system32\Fgeibicb.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\Fajnoabh.exeC:\Windows\system32\Fajnoabh.exe61⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\Gonnhf32.exeC:\Windows\system32\Gonnhf32.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\Gkeonggf.exeC:\Windows\system32\Gkeonggf.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Gekckpgl.exeC:\Windows\system32\Gekckpgl.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\Gaadpqmp.exeC:\Windows\system32\Gaadpqmp.exe65⤵
- Executes dropped EXE
PID:5316 -
C:\Windows\SysWOW64\Ghklmk32.exeC:\Windows\system32\Ghklmk32.exe66⤵PID:5968
-
C:\Windows\SysWOW64\Ggqingie.exeC:\Windows\system32\Ggqingie.exe67⤵PID:4556
-
C:\Windows\SysWOW64\Gafmkp32.exeC:\Windows\system32\Gafmkp32.exe68⤵PID:5032
-
C:\Windows\SysWOW64\Hojndd32.exeC:\Windows\system32\Hojndd32.exe69⤵PID:756
-
C:\Windows\SysWOW64\Hfdfanoa.exeC:\Windows\system32\Hfdfanoa.exe70⤵PID:5864
-
C:\Windows\SysWOW64\Hffbfn32.exeC:\Windows\system32\Hffbfn32.exe71⤵PID:3144
-
C:\Windows\SysWOW64\Hbmclobc.exeC:\Windows\system32\Hbmclobc.exe72⤵PID:2052
-
C:\Windows\SysWOW64\Hnddqp32.exeC:\Windows\system32\Hnddqp32.exe73⤵PID:2552
-
C:\Windows\SysWOW64\Hhihnihm.exeC:\Windows\system32\Hhihnihm.exe74⤵PID:468
-
C:\Windows\SysWOW64\Ikjapden.exeC:\Windows\system32\Ikjapden.exe75⤵PID:6004
-
C:\Windows\SysWOW64\Ihnbih32.exeC:\Windows\system32\Ihnbih32.exe76⤵PID:4104
-
C:\Windows\SysWOW64\Ibffbnjh.exeC:\Windows\system32\Ibffbnjh.exe77⤵PID:1740
-
C:\Windows\SysWOW64\Ikokkc32.exeC:\Windows\system32\Ikokkc32.exe78⤵PID:2128
-
C:\Windows\SysWOW64\Iickdgpb.exeC:\Windows\system32\Iickdgpb.exe79⤵PID:5376
-
C:\Windows\SysWOW64\Inpclnnj.exeC:\Windows\system32\Inpclnnj.exe80⤵PID:936
-
C:\Windows\SysWOW64\Iiehjgnp.exeC:\Windows\system32\Iiehjgnp.exe81⤵PID:5380
-
C:\Windows\SysWOW64\Ibnlbm32.exeC:\Windows\system32\Ibnlbm32.exe82⤵PID:4568
-
C:\Windows\SysWOW64\Jfkehk32.exeC:\Windows\system32\Jfkehk32.exe83⤵
- Drops file in System32 directory
PID:3564 -
C:\Windows\SysWOW64\Jilnjf32.exeC:\Windows\system32\Jilnjf32.exe84⤵PID:2708
-
C:\Windows\SysWOW64\Jecoog32.exeC:\Windows\system32\Jecoog32.exe85⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Windows\SysWOW64\Jeekeg32.exeC:\Windows\system32\Jeekeg32.exe86⤵PID:2496
-
C:\Windows\SysWOW64\Kehhjfif.exeC:\Windows\system32\Kehhjfif.exe87⤵PID:2732
-
C:\Windows\SysWOW64\Kpmlhoil.exeC:\Windows\system32\Kpmlhoil.exe88⤵PID:5464
-
C:\Windows\SysWOW64\Kppimogj.exeC:\Windows\system32\Kppimogj.exe89⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\Kelaef32.exeC:\Windows\system32\Kelaef32.exe90⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5452 -
C:\Windows\SysWOW64\Kbpboj32.exeC:\Windows\system32\Kbpboj32.exe91⤵
- System Location Discovery: System Language Discovery
PID:4080 -
C:\Windows\SysWOW64\Khmjga32.exeC:\Windows\system32\Khmjga32.exe92⤵PID:4640
-
C:\Windows\SysWOW64\Kimgad32.exeC:\Windows\system32\Kimgad32.exe93⤵
- Drops file in System32 directory
PID:6068 -
C:\Windows\SysWOW64\Lfqgjh32.exeC:\Windows\system32\Lfqgjh32.exe94⤵PID:3172
-
C:\Windows\SysWOW64\Llmpco32.exeC:\Windows\system32\Llmpco32.exe95⤵PID:2660
-
C:\Windows\SysWOW64\Lfcdph32.exeC:\Windows\system32\Lfcdph32.exe96⤵PID:5688
-
C:\Windows\SysWOW64\Llpmhodc.exeC:\Windows\system32\Llpmhodc.exe97⤵
- Drops file in System32 directory
PID:4212 -
C:\Windows\SysWOW64\Lfeaegdi.exeC:\Windows\system32\Lfeaegdi.exe98⤵PID:5820
-
C:\Windows\SysWOW64\Lhfmmp32.exeC:\Windows\system32\Lhfmmp32.exe99⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5532 -
C:\Windows\SysWOW64\Lblakh32.exeC:\Windows\system32\Lblakh32.exe100⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Windows\SysWOW64\Lifjgb32.exeC:\Windows\system32\Lifjgb32.exe101⤵
- System Location Discovery: System Language Discovery
PID:5892 -
C:\Windows\SysWOW64\Lbnnphhk.exeC:\Windows\system32\Lbnnphhk.exe102⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3004 -
C:\Windows\SysWOW64\Lihfmb32.exeC:\Windows\system32\Lihfmb32.exe103⤵
- Modifies registry class
PID:3280 -
C:\Windows\SysWOW64\Lpbojlfd.exeC:\Windows\system32\Lpbojlfd.exe104⤵PID:1244
-
C:\Windows\SysWOW64\Mikcbb32.exeC:\Windows\system32\Mikcbb32.exe105⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
PID:3328 -
C:\Windows\SysWOW64\Moglkikl.exeC:\Windows\system32\Moglkikl.exe106⤵PID:3736
-
C:\Windows\SysWOW64\Mimphakb.exeC:\Windows\system32\Mimphakb.exe107⤵PID:1736
-
C:\Windows\SysWOW64\Mojhphij.exeC:\Windows\system32\Mojhphij.exe108⤵PID:2420
-
C:\Windows\SysWOW64\Miomnaip.exeC:\Windows\system32\Miomnaip.exe109⤵
- Drops file in System32 directory
PID:2896 -
C:\Windows\SysWOW64\Mpiejkql.exeC:\Windows\system32\Mpiejkql.exe110⤵PID:3492
-
C:\Windows\SysWOW64\Miaica32.exeC:\Windows\system32\Miaica32.exe111⤵
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\Mplapkoj.exeC:\Windows\system32\Mplapkoj.exe112⤵PID:5988
-
C:\Windows\SysWOW64\Mehjhbma.exeC:\Windows\system32\Mehjhbma.exe113⤵PID:5060
-
C:\Windows\SysWOW64\Noaoagca.exeC:\Windows\system32\Noaoagca.exe114⤵PID:2312
-
C:\Windows\SysWOW64\Nifcnpch.exeC:\Windows\system32\Nifcnpch.exe115⤵PID:2684
-
C:\Windows\SysWOW64\Nockfgao.exeC:\Windows\system32\Nockfgao.exe116⤵PID:4936
-
C:\Windows\SysWOW64\Niipdpae.exeC:\Windows\system32\Niipdpae.exe117⤵
- Drops file in System32 directory
PID:2080 -
C:\Windows\SysWOW64\Noehlgol.exeC:\Windows\system32\Noehlgol.exe118⤵PID:4780
-
C:\Windows\SysWOW64\Niklip32.exeC:\Windows\system32\Niklip32.exe119⤵PID:4100
-
C:\Windows\SysWOW64\Nohdaf32.exeC:\Windows\system32\Nohdaf32.exe120⤵PID:2900
-
C:\Windows\SysWOW64\Npgalidl.exeC:\Windows\system32\Npgalidl.exe121⤵
- System Location Discovery: System Language Discovery
PID:2464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-