DeepLoad APC Target Abnormal Child Process

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•3

Identifies when DeepLoad target processes (LockAppHost.exe, makecab.exe, Magnify.exe) spawn child processes like shells (cmd.exe, powershell.exe, whoami.exe, net.exe), indicating successful injection and post-exploitation execution. This behavior is associated with the DeepLoad malware.