Edit tour

Windows Analysis Report
jQ3NFDayJm

Overview

General Information

Sample name:	jQ3NFDayJm renamed because original name is a hash value
Original sample name:	a74ddcc99ea8382cf4f6cf0105546bf50fa27db19402206754c6301cd4aa510b
Analysis ID:	1592456
MD5:	6bd5d3470d8877f487bab64ed5f7515d
SHA1:	3469af4a981fb037796bc5a04c7ff3fd82d0eda3
SHA256:	a74ddcc99ea8382cf4f6cf0105546bf50fa27db19402206754c6301cd4aa510b
Infos:

Detection

Berbew

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Berbew

AI detected suspicious sample

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Contains functionality to call native functions

Creates files inside the system directory

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

PE file contains sections with non-standard names

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

jQ3NFDayJm.exe (PID: 2972 cmdline: "C:\Users\user\Desktop\jQ3NFDayJm.exe" MD5: 6BD5D3470D8877F487BAB64ED5F7515D)

Enmknk32.exe (PID: 6332 cmdline: C:\Windows\system32\Enmknk32.exe MD5: F0A21C73368495DD36E83187F58234F1)

Fnohck32.exe (PID: 6340 cmdline: C:\Windows\system32\Fnohck32.exe MD5: 6029C6D9BC85370B5769BEB901AA72FB)

Fkchmojh.exe (PID: 6328 cmdline: C:\Windows\system32\Fkchmojh.exe MD5: 835993137FCF00D53813C4D198D061DD)

Fekmfd32.exe (PID: 5708 cmdline: C:\Windows\system32\Fekmfd32.exe MD5: 3CF47B9781ABC27FCBE7E505F2EA64B5)

Foaacm32.exe (PID: 2308 cmdline: C:\Windows\system32\Foaacm32.exe MD5: 9BFF2EDF15F1CCBA777935D9A9F5A0A3)

Fmeamaph.exe (PID: 6760 cmdline: C:\Windows\system32\Fmeamaph.exe MD5: 5502725AED5ABF217082D5254663194C)

Ffmfeg32.exe (PID: 6788 cmdline: C:\Windows\system32\Ffmfeg32.exe MD5: 66902DBEAE6CDBB1AD03BCF77880B5A4)

Febcfckp.exe (PID: 6820 cmdline: C:\Windows\system32\Febcfckp.exe MD5: B970B38E1E54CA877145F5401774C9F7)

Gbfcph32.exe (PID: 6856 cmdline: C:\Windows\system32\Gbfcph32.exe MD5: 40AD7BC2C34BA179EFBABEDC7CBB2117)

Gbipeg32.exe (PID: 6900 cmdline: C:\Windows\system32\Gbipeg32.exe MD5: 68372E985BC8E3425D892F64AB7D52CA)

Gpmqolfa.exe (PID: 6792 cmdline: C:\Windows\system32\Gpmqolfa.exe MD5: BC7292D138488826785DE8C04896FB8B)

Geiigbeh.exe (PID: 6772 cmdline: C:\Windows\system32\Geiigbeh.exe MD5: 5377AFF25FBCFB4C4BA3274E48681A77)

Gnbnph32.exe (PID: 6840 cmdline: C:\Windows\system32\Gnbnph32.exe MD5: 7DC8A5044959A79120673FDF01A411F3)

Gpajjk32.exe (PID: 6692 cmdline: C:\Windows\system32\Gpajjk32.exe MD5: B7B8C2F680E0DB3888B8028A2C5C46E5)

Genbbb32.exe (PID: 5232 cmdline: C:\Windows\system32\Genbbb32.exe MD5: E129CE3A8FE598AF7CA55C21824EE0EF)

Hbbclf32.exe (PID: 2932 cmdline: C:\Windows\system32\Hbbclf32.exe MD5: 1F0AC1FA79039913C1287A81C5E74ED3)

Hpfcejof.exe (PID: 6992 cmdline: C:\Windows\system32\Hpfcejof.exe MD5: F5560EC6E1EEAD6CC1086C14EF083F58)

Hphpkjlc.exe (PID: 7044 cmdline: C:\Windows\system32\Hphpkjlc.exe MD5: 9438D2B09A5FD82C5905C674BB026F5D)

Hloapk32.exe (PID: 6996 cmdline: C:\Windows\system32\Hloapk32.exe MD5: EFD0B5BD9968BF6F8327EDE25AEB1694)

Iejbnp32.exe (PID: 7012 cmdline: C:\Windows\system32\Iejbnp32.exe MD5: DA1CCA0B7EBB731F7D7FDACA765F99AC)

Iflknc32.exe (PID: 7140 cmdline: C:\Windows\system32\Iflknc32.exe MD5: DA4F5F2C3CA2E9C9EDDE0F78D7DAF8A8)

Ipdpfhbf.exe (PID: 7124 cmdline: C:\Windows\system32\Ipdpfhbf.exe MD5: 8A4228FA88805A49D74773E09E31248D)

Ilkpkihj.exe (PID: 7108 cmdline: C:\Windows\system32\Ilkpkihj.exe MD5: 6FA1592FB344C7F9553C9CCAD07BE65B)

Imjmel32.exe (PID: 7096 cmdline: C:\Windows\system32\Imjmel32.exe MD5: 42C2EBD60D0A4DA6504E66A61E7A6936)

Ifcanaen.exe (PID: 6164 cmdline: C:\Windows\system32\Ifcanaen.exe MD5: 478DDA191999390960405ADDAE55127C)

Jfenda32.exe (PID: 3436 cmdline: C:\Windows\system32\Jfenda32.exe MD5: BBB9E683C7E76430EDEA6F6DE04F2582)

Jopbhd32.exe (PID: 5736 cmdline: C:\Windows\system32\Jopbhd32.exe MD5: B0D1468C66F7C8C5271E59AC4BCDBCBC)

Jppobf32.exe (PID: 2724 cmdline: C:\Windows\system32\Jppobf32.exe MD5: 283C6E49EE350EACC2E9A33C8CEBD771)

Jlfpghnm.exe (PID: 6408 cmdline: C:\Windows\system32\Jlfpghnm.exe MD5: 2135069513C6CA542924BE0C6071EE31)

Jlimmg32.exe (PID: 6440 cmdline: C:\Windows\system32\Jlimmg32.exe MD5: 47146BD02F7F369DEBC798AB31744AA7)

Kmhigjcm.exe (PID: 6468 cmdline: C:\Windows\system32\Kmhigjcm.exe MD5: 73B3975C5675E03D8D421D00447A6FA1)

Kiojlk32.exe (PID: 6480 cmdline: C:\Windows\system32\Kiojlk32.exe MD5: 7F088F6E3A21467017A15C907F9616C6)

Kefjql32.exe (PID: 6504 cmdline: C:\Windows\system32\Kefjql32.exe MD5: 1FD17BECB7D5BE4A404DF941049A33E3)

Kgegkoeh.exe (PID: 6516 cmdline: C:\Windows\system32\Kgegkoeh.exe MD5: 2C7BD48FEE28E5D2A07535427A59B862)

Kpnkcdli.exe (PID: 6540 cmdline: C:\Windows\system32\Kpnkcdli.exe MD5: 10D7E084360F9C655C19C5FB0430526B)

Kjfplj32.exe (PID: 6620 cmdline: C:\Windows\system32\Kjfplj32.exe MD5: F166F705393BF167C1348DD77EABB153)

Ljimbj32.exe (PID: 5532 cmdline: C:\Windows\system32\Ljimbj32.exe MD5: 3FC52EE3EDCAEAB966D6B9ECE8E31C19)

Leomgk32.exe (PID: 6676 cmdline: C:\Windows\system32\Leomgk32.exe MD5: 9ACD0C5A0E40958CDBCB72B6083C28C2)

Lgojanmn.exe (PID: 5948 cmdline: C:\Windows\system32\Lgojanmn.exe MD5: 707F2CE5ADE0F7856D277EF735D5CCB9)

Lgaffm32.exe (PID: 3896 cmdline: C:\Windows\system32\Lgaffm32.exe MD5: EDFA4D891B61972CD411464653E91A2C)

Llnood32.exe (PID: 6364 cmdline: C:\Windows\system32\Llnood32.exe MD5: 50A25AA85959E351E1CDC216BCC990E8)

Ljbphh32.exe (PID: 6960 cmdline: C:\Windows\system32\Ljbphh32.exe MD5: AA4ED9CB81379234A75D2F0D97AE0B8D)

Mjdlnhfi.exe (PID: 2084 cmdline: C:\Windows\system32\Mjdlnhfi.exe MD5: 2B087995379FA6613BF685F7ECF6E95F)

Mjgichdg.exe (PID: 5724 cmdline: C:\Windows\system32\Mjgichdg.exe MD5: 3A8DC8801174A41D9CAD22CFB45F7AA2)

Mjieig32.exe (PID: 5980 cmdline: C:\Windows\system32\Mjieig32.exe MD5: 4C7BE89A6F935F6C53AF0D63114B2A98)

Mgmfbl32.exe (PID: 5860 cmdline: C:\Windows\system32\Mgmfbl32.exe MD5: 6A14F52E965463C91383D5B0C13788E0)

Mohkfn32.exe (PID: 5504 cmdline: C:\Windows\system32\Mohkfn32.exe MD5: 7C1A55FC96E70E5BE94815D55D152724)

Mnikde32.exe (PID: 6648 cmdline: C:\Windows\system32\Mnikde32.exe MD5: 131C2A692F6EC692CD74F72A95DD9677)

Njplifll.exe (PID: 7180 cmdline: C:\Windows\system32\Njplifll.exe MD5: F7141B74348BFE91223B04B2D72927C8)

Nchpbl32.exe (PID: 7200 cmdline: C:\Windows\system32\Nchpbl32.exe MD5: 1ED63B99FA4938EA7807F38F0C0A1E88)

Nooagm32.exe (PID: 7220 cmdline: C:\Windows\system32\Nooagm32.exe MD5: 2395DB122A9AA8C2D9CBB8A33626B846)

Nqomappc.exe (PID: 7240 cmdline: C:\Windows\system32\Nqomappc.exe MD5: C097666E5B0280AD82D015309701EC7D)

Nmenfa32.exe (PID: 7264 cmdline: C:\Windows\system32\Nmenfa32.exe MD5: 1E6570D63CEE8AE61BCD4AFE7EB65A24)

Oqcglo32.exe (PID: 7284 cmdline: C:\Windows\system32\Oqcglo32.exe MD5: 5A98F1B74EF64B0D295F2864DDED0BDB)

Ophcmlpf.exe (PID: 7304 cmdline: C:\Windows\system32\Ophcmlpf.exe MD5: B286EFB96EDF969D96D56057EF9DEB43)

Oqhpgogi.exe (PID: 7324 cmdline: C:\Windows\system32\Oqhpgogi.exe MD5: D87B6E9D7EE3C2174776CA12313CCD76)

Omoalp32.exe (PID: 7344 cmdline: C:\Windows\system32\Omoalp32.exe MD5: 3BA831D8B7AF27B60BAD335D02FCBE04)

Onnmfb32.exe (PID: 7364 cmdline: C:\Windows\system32\Onnmfb32.exe MD5: C009F9333A642B9D346948881F86C9B4)

Onqjlb32.exe (PID: 7384 cmdline: C:\Windows\system32\Onqjlb32.exe MD5: 241FBFFD20DE394C2C4536D0DF209D58)

Pjgkac32.exe (PID: 7404 cmdline: C:\Windows\system32\Pjgkac32.exe MD5: D66D2B10232F8E210952B2CE0007FA75)

Pfnkfdne.exe (PID: 7424 cmdline: C:\Windows\system32\Pfnkfdne.exe MD5: 505486B973B5287FBA346EDD1BEB2453)

Pfqhkdkc.exe (PID: 7444 cmdline: C:\Windows\system32\Pfqhkdkc.exe MD5: D6D86D8E02335B80A3B5DAE1CFC443C6)

Pfceac32.exe (PID: 7464 cmdline: C:\Windows\system32\Pfceac32.exe MD5: 87CED843ACE3BB878C966C25A035F79C)

Pfeafc32.exe (PID: 7484 cmdline: C:\Windows\system32\Pfeafc32.exe MD5: 0212DC8261370726587B2AAC06B63BD7)

Qjcjma32.exe (PID: 7504 cmdline: C:\Windows\system32\Qjcjma32.exe MD5: 5EC66D7599715C98D46EFB01161C0D05)

Qhgkff32.exe (PID: 7524 cmdline: C:\Windows\system32\Qhgkff32.exe MD5: 805D7B1EC3475B1ED7EC4F855602F63F)

Apbpjhji.exe (PID: 7544 cmdline: C:\Windows\system32\Apbpjhji.exe MD5: C1B46682F213E9376A0214037817B663)

Aabldk32.exe (PID: 7564 cmdline: C:\Windows\system32\Aabldk32.exe MD5: 85BF2D125BE326DD02E3FC33432D637E)

Ajjqmqgl.exe (PID: 7584 cmdline: C:\Windows\system32\Ajjqmqgl.exe MD5: BD43F401A23D35F704236222DAF75571)

Apgieg32.exe (PID: 7604 cmdline: C:\Windows\system32\Apgieg32.exe MD5: AEB92E25A592EA34D5CA72BAEFAB2058)

Amkiol32.exe (PID: 7624 cmdline: C:\Windows\system32\Amkiol32.exe MD5: 6ECA862962B3B409FD5DF0844341F136)

Ajojhp32.exe (PID: 7644 cmdline: C:\Windows\system32\Ajojhp32.exe MD5: 370CA86E4C88C9B9FA245C73C910FF9A)

Bombon32.exe (PID: 7664 cmdline: C:\Windows\system32\Bombon32.exe MD5: 01383E51DDB6A12C878E3608E2D60EFD)

Bmbppkoe.exe (PID: 7684 cmdline: C:\Windows\system32\Bmbppkoe.exe MD5: 7FF302FD9D1D02852FF902CAF7293067)

Baphfiel.exe (PID: 7704 cmdline: C:\Windows\system32\Baphfiel.exe MD5: 36324055329979CA0B4B76F9F45C39B7)

Bmgikj32.exe (PID: 7724 cmdline: C:\Windows\system32\Bmgikj32.exe MD5: 0AD48F551D2E7822FA764E2FCDC8473B)

Badaah32.exe (PID: 7780 cmdline: C:\Windows\system32\Badaah32.exe MD5: 8576808D5252AE7BA3F0F27088873938)

Cohbjm32.exe (PID: 7808 cmdline: C:\Windows\system32\Cohbjm32.exe MD5: 82E6801F3126EB9676FD0CE1F28EE054)

Cokoplnm.exe (PID: 7828 cmdline: C:\Windows\system32\Cokoplnm.exe MD5: BA5D08C6F39943B035BF68AD455589DF)

Cgfcdokh.exe (PID: 7848 cmdline: C:\Windows\system32\Cgfcdokh.exe MD5: EE751852438F944CF208CB0E26829F0E)

Ckdljm32.exe (PID: 7868 cmdline: C:\Windows\system32\Ckdljm32.exe MD5: 1C5C59B4C2BD1A0BCDD1BEA5907A8CCD)

Chhmdaph.exe (PID: 7888 cmdline: C:\Windows\system32\Chhmdaph.exe MD5: D30DD4CB909C0DCDF8B969B3CAFCEC75)

Dhjiianf.exe (PID: 7908 cmdline: C:\Windows\system32\Dhjiianf.exe MD5: 77581000CD02F1ED9CB904C9B74DE8CD)

Dhmfoq32.exe (PID: 7932 cmdline: C:\Windows\system32\Dhmfoq32.exe MD5: BEA31997B09E9725D90FD2167EEC8454)

Dhocdp32.exe (PID: 7952 cmdline: C:\Windows\system32\Dhocdp32.exe MD5: 453B400B5EF6F0691B4C0D8F63FCCBAB)

Dokhgj32.exe (PID: 7996 cmdline: C:\Windows\system32\Dokhgj32.exe MD5: 9D538F74DD129807862055418BA66516)

Dondlj32.exe (PID: 8020 cmdline: C:\Windows\system32\Dondlj32.exe MD5: 050CC0C9B689D1279CE63E024862BEB2)

Encamf32.exe (PID: 8044 cmdline: C:\Windows\system32\Encamf32.exe MD5: D9927454266D3C3C4C3922B4700DEA98)

Eaqjcdhf.exe (PID: 8072 cmdline: C:\Windows\system32\Eaqjcdhf.exe MD5: 77F19FD0D7400777F69AC32B5B6894B9)

Engkhenj.exe (PID: 8092 cmdline: C:\Windows\system32\Engkhenj.exe MD5: BEDC708033AAEBF173125EB3CC35DE1B)

Eddpko32.exe (PID: 8124 cmdline: C:\Windows\system32\Eddpko32.exe MD5: ED53702B46FB96FDAA85D9FBD50F094E)

Fqjqpp32.exe (PID: 8168 cmdline: C:\Windows\system32\Fqjqpp32.exe MD5: 00327C6E6F00E63C522F7343AB49CEFB)

Fbjmjcpl.exe (PID: 6392 cmdline: C:\Windows\system32\Fbjmjcpl.exe MD5: E38CD6BE96753B5DB620C5E4DD9F76C0)

Fnanodfp.exe (PID: 5996 cmdline: C:\Windows\system32\Fnanodfp.exe MD5: 55A4B7603CB2C9B073EA14FDBEE03A04)

Fopjig32.exe (PID: 7792 cmdline: C:\Windows\system32\Fopjig32.exe MD5: F222095DBE04188BDB8284E9739F3A34)

Fbacjbjc.exe (PID: 8196 cmdline: C:\Windows\system32\Fbacjbjc.exe MD5: 33A1FEB6093A65F79340260F733736C8)

Gqfpko32.exe (PID: 8348 cmdline: C:\Windows\system32\Gqfpko32.exe MD5: F7BDAA4590101221E24716F3CADA16C5)

Ggbenh32.exe (PID: 8416 cmdline: C:\Windows\system32\Ggbenh32.exe MD5: EBB19CADE99BBD6A74F308D252176565)

Gibahklh.exe (PID: 8456 cmdline: C:\Windows\system32\Gibahklh.exe MD5: 9262D74958C9B1E5A3122A661A33941D)

Gidnmk32.exe (PID: 8476 cmdline: C:\Windows\system32\Gidnmk32.exe MD5: D841BB678773C56DD208D221D9C5A080)

Gekobloj.exe (PID: 8496 cmdline: C:\Windows\system32\Gekobloj.exe MD5: 7B35790CD3D0D056602A532E3DC1BF4D)

Hglhdg32.exe (PID: 8516 cmdline: C:\Windows\system32\Hglhdg32.exe MD5: 354659F72C3B7DF6E500B1B894493295)

Hkjqjeba.exe (PID: 8572 cmdline: C:\Windows\system32\Hkjqjeba.exe MD5: AC3D32F82D2E4E4395C338E6D90C9118)

Hgqaofhe.exe (PID: 8592 cmdline: C:\Windows\system32\Hgqaofhe.exe MD5: AAFC2C6550358CB651A04E01938091E0)

Hedahkgo.exe (PID: 8620 cmdline: C:\Windows\system32\Hedahkgo.exe MD5: A8C169D77F1E266C9BE70F294115E922)

Hbhbbofi.exe (PID: 8656 cmdline: C:\Windows\system32\Hbhbbofi.exe MD5: B974DFFD9DA496E34AB1FE8BC5BC079A)

Ibkogn32.exe (PID: 8684 cmdline: C:\Windows\system32\Ibkogn32.exe MD5: 7CB1E5D01A30884ACFB1EAE10EDBCB00)

Inaplpij.exe (PID: 8708 cmdline: C:\Windows\system32\Inaplpij.exe MD5: 281B22664ECD377C0E60DD7248A5F3D9)

Iiiqoh32.exe (PID: 8728 cmdline: C:\Windows\system32\Iiiqoh32.exe MD5: C419CE01A52E18766D6BD2017E1CBEF3)

Ipfeaa32.exe (PID: 8748 cmdline: C:\Windows\system32\Ipfeaa32.exe MD5: 19A04E73A48D6B45AD78E3177A2BD76E)

Jphbga32.exe (PID: 8768 cmdline: C:\Windows\system32\Jphbga32.exe MD5: DCCAAA5CD5EBB1F65A04F28578AC1796)

Jomohnom.exe (PID: 8788 cmdline: C:\Windows\system32\Jomohnom.exe MD5: AD2B33BE78D882595F80846D509DD977)

Jpmlbqfp.exe (PID: 8812 cmdline: C:\Windows\system32\Jpmlbqfp.exe MD5: 585690F7E5662B1937165055691B69A0)

Jlclga32.exe (PID: 8840 cmdline: C:\Windows\system32\Jlclga32.exe MD5: 1BF0E14DD800F56A109B1A56E2B87E1F)

Jhjmlb32.exe (PID: 8860 cmdline: C:\Windows\system32\Jhjmlb32.exe MD5: CFEF1CB1F7B67D20DA8348AD2E2F5E65)

Jacaehhi.exe (PID: 8880 cmdline: C:\Windows\system32\Jacaehhi.exe MD5: EDC4604D0959E8F90D2077369F0A8885)

Khofgbnc.exe (PID: 8900 cmdline: C:\Windows\system32\Khofgbnc.exe MD5: 375A2A590535F074A5EC7B0C2AE78CB6)

Khacmalp.exe (PID: 8920 cmdline: C:\Windows\system32\Khacmalp.exe MD5: 8625CFCC194DA649508631917CB195F9)

Konhokaj.exe (PID: 8944 cmdline: C:\Windows\system32\Konhokaj.exe MD5: 660E39B1114AED1BA4C9748300633DD0)

Kejmae32.exe (PID: 8964 cmdline: C:\Windows\system32\Kejmae32.exe MD5: F2BF7E3C1963D26759BFB5FC65EE87A9)

Lpbndndh.exe (PID: 8984 cmdline: C:\Windows\system32\Lpbndndh.exe MD5: 4AD5A5A2F9AF33B92B2F6015B89F9971)

Lcbgfi32.exe (PID: 9020 cmdline: C:\Windows\system32\Lcbgfi32.exe MD5: F6AF1B6787AFC9280C9271A3B3F4FB9E)

Lceckh32.exe (PID: 9040 cmdline: C:\Windows\system32\Lceckh32.exe MD5: 1D9BFCA87A0DA770C9E9FD20A33FE22E)

Lcgpahmc.exe (PID: 9060 cmdline: C:\Windows\system32\Lcgpahmc.exe MD5: 379F5542C0D7426ED07C8C3AFC786C4A)

Mpkajllm.exe (PID: 9080 cmdline: C:\Windows\system32\Mpkajllm.exe MD5: F7C4652B3BB32147FC3D08FD38D54BCC)

Mhibdn32.exe (PID: 9100 cmdline: C:\Windows\system32\Mhibdn32.exe MD5: 13E672696FFF2F20E90FD5D1CE75D046)

Mhkojn32.exe (PID: 9120 cmdline: C:\Windows\system32\Mhkojn32.exe MD5: 181F8D5D26AE595317A84A402DB72A32)

Mlihpl32.exe (PID: 9144 cmdline: C:\Windows\system32\Mlihpl32.exe MD5: 70C05F837250BBDA17028AB2CD20CB5D)

Njoeophq.exe (PID: 9164 cmdline: C:\Windows\system32\Njoeophq.exe MD5: B2D5A60C3F034BCEE8CC51F289BD3FCD)

Nbkicbfk.exe (PID: 9184 cmdline: C:\Windows\system32\Nbkicbfk.exe MD5: 282E1531263EB09AEC952F29A313F627)

Nqnfgjlh.exe (PID: 9204 cmdline: C:\Windows\system32\Nqnfgjlh.exe MD5: 24E62B7945B794927B18F01080E97157)

Ofmldphm.exe (PID: 1444 cmdline: C:\Windows\system32\Ofmldphm.exe MD5: C56B34F7F066E5C29F1803C95BB004CD)

Ojkdkonc.exe (PID: 8328 cmdline: C:\Windows\system32\Ojkdkonc.exe MD5: DD39E8EA6133BB6BC4C8356A17230ED0)

Ojmapnlq.exe (PID: 8380 cmdline: C:\Windows\system32\Ojmapnlq.exe MD5: 13C62470DE2053BE4357A654F0743547)

Ofdbeobd.exe (PID: 3908 cmdline: C:\Windows\system32\Ofdbeobd.exe MD5: 86A8C5AB2433C2FE8816AB658C483599)

Offokopb.exe (PID: 1428 cmdline: C:\Windows\system32\Offokopb.exe MD5: 0AAC46B0637A2DD21568C6B95259206A)

Pfikpo32.exe (PID: 2216 cmdline: C:\Windows\system32\Pfikpo32.exe MD5: 2DBDA90E8BFD7725E48E2EB89F2B0C4E)

Pijdbj32.exe (PID: 4132 cmdline: C:\Windows\system32\Pijdbj32.exe MD5: 9EAA1D1F9E6D01B58B4725185F364387)

Pjiqlm32.exe (PID: 2136 cmdline: C:\Windows\system32\Pjiqlm32.exe MD5: 9082CC35DBB70E84C1B0CDCAF0B482CA)

Pbdepo32.exe (PID: 400 cmdline: C:\Windows\system32\Pbdepo32.exe MD5: 73DADE5D100104D84C9F1BC6584DF4AC)

Pqhbdf32.exe (PID: 1776 cmdline: C:\Windows\system32\Pqhbdf32.exe MD5: 0069F393AB5926E269E6ABEE494573A4)

Qmocigko.exe (PID: 5792 cmdline: C:\Windows\system32\Qmocigko.exe MD5: AEBDAB74D7094A1B26EE8CD51B36A43C)

Qiecnhac.exe (PID: 9224 cmdline: C:\Windows\system32\Qiecnhac.exe MD5: DE67472E183BA9D5D6C79271B71C3E87)

Amcldf32.exe (PID: 9248 cmdline: C:\Windows\system32\Amcldf32.exe MD5: 98BB300687B86FC31658C994F7FD98DD)

Ameiifeg.exe (PID: 9268 cmdline: C:\Windows\system32\Ameiifeg.exe MD5: 203F00B74CC344E38FE2083C1159EC99)

Ailjng32.exe (PID: 9288 cmdline: C:\Windows\system32\Ailjng32.exe MD5: 9975052C062877336FFC395E1E5BF125)

Ajlfhjbn.exe (PID: 9308 cmdline: C:\Windows\system32\Ajlfhjbn.exe MD5: 9BAC645828B85CC684D728709E73476C)

Bpkkfq32.exe (PID: 9328 cmdline: C:\Windows\system32\Bpkkfq32.exe MD5: EE0D93D86859E3BBDCDA6A6AA527734E)

Bajhpc32.exe (PID: 9348 cmdline: C:\Windows\system32\Bajhpc32.exe MD5: F8117561FA40405AA09AE3326E252543)

Bdkabo32.exe (PID: 9368 cmdline: C:\Windows\system32\Bdkabo32.exe MD5: 1FB4A882186C4D006770F19E510BA88C)

Bdnngnpc.exe (PID: 9388 cmdline: C:\Windows\system32\Bdnngnpc.exe MD5: 3E8C654024E1C949D22D886E59B1842F)

Baanabom.exe (PID: 9408 cmdline: C:\Windows\system32\Baanabom.exe MD5: B0BDF633E9954F31AB9DCF0B4BB4078C)

Bmhofc32.exe (PID: 9428 cmdline: C:\Windows\system32\Bmhofc32.exe MD5: 8F6FE4546A067A79ED8581E3A87455C3)

Cafglb32.exe (PID: 9448 cmdline: C:\Windows\system32\Cafglb32.exe MD5: F6C928B6C05279B60044C26C5F1DAF42)

Cmmhacal.exe (PID: 9468 cmdline: C:\Windows\system32\Cmmhacal.exe MD5: 8460D5B933EAA8E503092F85B74FD8C0)

Cmoefb32.exe (PID: 9488 cmdline: C:\Windows\system32\Cmoefb32.exe MD5: 59E86D08DE193B9123F4C20CDCE3105C)

Cppnhn32.exe (PID: 9508 cmdline: C:\Windows\system32\Cppnhn32.exe MD5: 48A71709C53F3A224D5CB50516E8D472)

Dbagjiik.exe (PID: 9528 cmdline: C:\Windows\system32\Dbagjiik.exe MD5: CB10EB9A6535FCFF9C9947C8ACE40476)

Dmihma32.exe (PID: 9548 cmdline: C:\Windows\system32\Dmihma32.exe MD5: EF018AB14CFC6516C33BBAB50DD3E7DB)

Dafpcpme.exe (PID: 9568 cmdline: C:\Windows\system32\Dafpcpme.exe MD5: 2E7A746C041939D51A400B97BE33D072)

Dkoele32.exe (PID: 9588 cmdline: C:\Windows\system32\Dkoele32.exe MD5: 540DA0680430C8F5EB3045FD2BE6BE74)

Dcjjpgaa.exe (PID: 9608 cmdline: C:\Windows\system32\Dcjjpgaa.exe MD5: FF41E5E27E3C961CE0056AA6981C9DD5)

Ecmfegon.exe (PID: 9628 cmdline: C:\Windows\system32\Ecmfegon.exe MD5: 71A064EA854B3DAAA55C3EC667F98B9C)

Edlcpjfa.exe (PID: 9648 cmdline: C:\Windows\system32\Edlcpjfa.exe MD5: 64E65672A0570AC9CE52A135D43D5C1C)

Ednpeidn.exe (PID: 9668 cmdline: C:\Windows\system32\Ednpeidn.exe MD5: 28376B695EEC7971FD792BDB92CF697A)

Edqlki32.exe (PID: 9688 cmdline: C:\Windows\system32\Edqlki32.exe MD5: 0A92ACC92CC6BED51F48606EE87CE5CD)

Eniqcohl.exe (PID: 9708 cmdline: C:\Windows\system32\Eniqcohl.exe MD5: 322CF0E88DD29C28FA132D11DCAA4916)

Fnkmiofi.exe (PID: 9728 cmdline: C:\Windows\system32\Fnkmiofi.exe MD5: C3469D44CDAA3D88C1C90625BEA95497)

Fplfki32.exe (PID: 9752 cmdline: C:\Windows\system32\Fplfki32.exe MD5: 3CBC68E296EE6D8959C1BD9B0F68CF1E)

Fghkmc32.exe (PID: 9768 cmdline: C:\Windows\system32\Fghkmc32.exe MD5: DE1CD82F781474D7B58CF64719076254)

Fjidoo32.exe (PID: 9792 cmdline: C:\Windows\system32\Fjidoo32.exe MD5: 61FC48308823ED23933EBC6196211520)

Gbeekkbb.exe (PID: 9812 cmdline: C:\Windows\system32\Gbeekkbb.exe MD5: C2AA153106A5E2F0658879F0DD720474)

Gqjblggj.exe (PID: 9832 cmdline: C:\Windows\system32\Gqjblggj.exe MD5: A030316B03B2B4FA8FA69F80898AE833)

Gbjofj32.exe (PID: 9852 cmdline: C:\Windows\system32\Gbjofj32.exe MD5: 4A6F328836A0CBA36ABDED74068DF297)

Gqolgg32.exe (PID: 9872 cmdline: C:\Windows\system32\Gqolgg32.exe MD5: CDC15D23C8555EC96B2BE52D39F2A47B)

Hbohajjh.exe (PID: 9892 cmdline: C:\Windows\system32\Hbohajjh.exe MD5: 81E28B292407655D754A7489EBB6775C)

Hneifkpl.exe (PID: 9912 cmdline: C:\Windows\system32\Hneifkpl.exe MD5: C8623D2C17B287710CA4A2343B712206)

Hbcbli32.exe (PID: 9932 cmdline: C:\Windows\system32\Hbcbli32.exe MD5: BC93929318FA992D880106E977038476)

Hjnfqk32.exe (PID: 9952 cmdline: C:\Windows\system32\Hjnfqk32.exe MD5: 8FE4187EA99BD4B03EE99D3280AC34D1)

Hnlogj32.exe (PID: 9972 cmdline: C:\Windows\system32\Hnlogj32.exe MD5: 56EAC5818D9696613D5E167CB0B7FB33)

Iehdic32.exe (PID: 9992 cmdline: C:\Windows\system32\Iehdic32.exe MD5: 321E6FE0B79BC046111CE5F232E8B4F9)

Ibmebh32.exe (PID: 10012 cmdline: C:\Windows\system32\Ibmebh32.exe MD5: F73087E08157AF47B58A23722A20EF4D)

Incegidl.exe (PID: 10032 cmdline: C:\Windows\system32\Incegidl.exe MD5: 3107C7B799735E98AE296DA835C64F56)

Ijjfljip.exe (PID: 10052 cmdline: C:\Windows\system32\Ijjfljip.exe MD5: 9802761539C74D2C88CCFAFD8D392DFD)

Icbkeo32.exe (PID: 10072 cmdline: C:\Windows\system32\Icbkeo32.exe MD5: FF372D2807E3B33E33905D7C8FBF83CB)

Iafkoc32.exe (PID: 10092 cmdline: C:\Windows\system32\Iafkoc32.exe MD5: 08B9024FDBED6A9D583280323CAEDE39)

Jbfgif32.exe (PID: 10112 cmdline: C:\Windows\system32\Jbfgif32.exe MD5: 7286A3B74BCF2D30FDD8A148047919AE)

Jbhdnf32.exe (PID: 10132 cmdline: C:\Windows\system32\Jbhdnf32.exe MD5: 0FFA354E51AE20CE8103A058E34A06A0)

Jamaob32.exe (PID: 10152 cmdline: C:\Windows\system32\Jamaob32.exe MD5: CE165E4441FF99451B64E4B228ED976E)

Jdnjan32.exe (PID: 10172 cmdline: C:\Windows\system32\Jdnjan32.exe MD5: E6AFCB3AC7540B4F161A5DB34DE4BB26)

Kenfkq32.exe (PID: 10192 cmdline: C:\Windows\system32\Kenfkq32.exe MD5: E78BEED61F5CA4D2F71E4F65DD4DBF9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Berbew		No Attribution	https://blog.sonicwall.com/en-us/2023/02/berbew-backdoor-spotted-in-the-wild/	https://malpedia.caad.fkie.fraunhofer.de/details/win.berbew

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: jQ3NFDayJm.exe PID: 2972	JoeSecurity_Berbew	Yara detected Berbew	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.jQ3NFDayJm.exe.42aa84.0.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {79FEACFF-FFCE-815E-A900-316290B5B738}, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\jQ3NFDayJm.exe, ProcessId: 2972, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jQ3NFDayJm

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\Beqfpgmi.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ameiifeg.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Baanabom.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Aefbqf32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Amcldf32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Akcokgql.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Aabldk32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Aljbfgpf.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Bhiabhja.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bmhofc32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Alghniec.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ajjjec32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Afkgdh32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Ailjng32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bccbfjkm.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Apgieg32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Aidobh32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Bhfgjioo.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Bdkabo32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bajhpc32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Amkiol32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Baphfiel.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Aelink32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Badaah32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB

Multi AV Scanner detection for dropped file

Source: C:\Windows\SysWOW64\Aefbqf32.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Aelink32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Aelink32.dll	Virustotal: Detection: 82%	Perma Link
Source: C:\Windows\SysWOW64\Afkgdh32.dll	ReversingLabs: Detection: 90%
Source: C:\Windows\SysWOW64\Aidobh32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Aidobh32.dll	Virustotal: Detection: 83%	Perma Link
Source: C:\Windows\SysWOW64\Ajjjec32.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Akcokgql.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Akcokgql.dll	Virustotal: Detection: 83%	Perma Link
Source: C:\Windows\SysWOW64\Alghniec.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Alghniec.dll	Virustotal: Detection: 83%	Perma Link
Source: C:\Windows\SysWOW64\Aljbfgpf.dll	ReversingLabs: Detection: 100%
Source: C:\Windows\SysWOW64\Aljbfgpf.dll	Virustotal: Detection: 82%	Perma Link
Source: C:\Windows\SysWOW64\Bccbfjkm.dll	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: jQ3NFDayJm

Virustotal: Detection: 88%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\Beqfpgmi.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ameiifeg.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Baanabom.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Aefbqf32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Amcldf32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Akcokgql.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Aabldk32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Aljbfgpf.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bhiabhja.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bmhofc32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Alghniec.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ajjjec32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Afkgdh32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ailjng32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bccbfjkm.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Apgieg32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Aidobh32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bhfgjioo.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bdkabo32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bajhpc32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Amkiol32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Baphfiel.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Aelink32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Badaah32.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: jQ3NFDayJm

Joe Sandbox ML: detected

Source: jQ3NFDayJm

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	0_2_00403A6B
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then add ebx, 04h	0_2_00403A6B
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then jl 00403A8Fh	0_2_00403A6B
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then add eax, 0Ch	0_2_00403A6B
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then popad	0_2_00403A6B
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then pop edi	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then mov ebx, 00407EF8h	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then sub ecx, eax	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then xor edx, edx	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then push eax	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then div edi	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then xchg eax, ecx	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then add eax, edi	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then loop 00403B3Eh	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then mov eax, 0042A000h	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then mov ebx, 0042CD70h	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then sub ecx, eax	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then xor edx, edx	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then push eax	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then div edi	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then xchg eax, ecx	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then add eax, edi	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then loop 00403B9Eh	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then popad	0_2_00403AC7
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then je 00403A1Ch	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then xor dword ptr [eax], ecx	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then inc eax	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then jne 004039F2h	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then mov eax, 0042A000h	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then je 00403A52h	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then xor dword ptr [eax], ecx	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then add eax, 04h	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then jne 00403A3Ah	0_2_004039CE
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Code function: 4x nop then popad	0_2_004039CE

Source: jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://tat-neftbank.ru/kkq.php
Source: jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware
Source: jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://tat-neftbank.ru/wcmd.htm

System Summary

PE file has a writeable .text section

Source: jQ3NFDayJm	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Enmknk32.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Fnohck32.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Fkchmojh.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Fekmfd32.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Foaacm32.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Fmeamaph.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ffmfeg32.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Febcfckp.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Gbfcph32.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Gbipeg32.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Gpmqolfa.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Geiigbeh.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Gnbnph32.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Gpajjk32.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Genbbb32.exe.15.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Hbbclf32.exe.16.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Hpfcejof.exe.17.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Hphpkjlc.exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Hloapk32.exe.19.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Iejbnp32.exe.20.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Iflknc32.exe.21.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ipdpfhbf.exe.22.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ilkpkihj.exe.23.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Imjmel32.exe.24.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ifcanaen.exe.25.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jfenda32.exe.26.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jopbhd32.exe.27.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jppobf32.exe.28.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jlfpghnm.exe.29.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Jlimmg32.exe.30.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kmhigjcm.exe.31.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kiojlk32.exe.32.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kefjql32.exe.33.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kgegkoeh.exe.34.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kpnkcdli.exe.35.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Kjfplj32.exe.36.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ljimbj32.exe.38.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Leomgk32.exe.39.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Lgojanmn.exe.40.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Lgaffm32.exe.41.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Llnood32.exe.42.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ljbphh32.exe.43.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mjdlnhfi.exe.44.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mjgichdg.exe.45.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mjieig32.exe.46.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mgmfbl32.exe.47.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mohkfn32.exe.48.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Mnikde32.exe.49.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Njplifll.exe.50.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nchpbl32.exe.51.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nooagm32.exe.52.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nqomappc.exe.53.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nmenfa32.exe.54.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oqcglo32.exe.55.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ophcmlpf.exe.56.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oqhpgogi.exe.57.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Omoalp32.exe.58.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Onnmfb32.exe.59.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Onqjlb32.exe.60.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pjgkac32.exe.61.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pfnkfdne.exe.62.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pfqhkdkc.exe.63.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pfceac32.exe.64.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pfeafc32.exe.65.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Qjcjma32.exe.66.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Qhgkff32.exe.67.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Apbpjhji.exe.68.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Aabldk32.exe.69.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ajjqmqgl.exe.70.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Apgieg32.exe.71.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Amkiol32.exe.72.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ajojhp32.exe.73.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bombon32.exe.74.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bmbppkoe.exe.75.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Baphfiel.exe.76.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bmgikj32.exe.77.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Badaah32.exe.78.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Cohbjm32.exe.79.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Cokoplnm.exe.80.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Cgfcdokh.exe.81.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ckdljm32.exe.82.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Chhmdaph.exe.83.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Dhjiianf.exe.84.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe

Code function: 0_2_00406FF6 GetWindowRect,GetWindowRect,MoveWindow,SetTextColor,SetTextColor,SetBkColor,CreateBrushIndirect,GetWindowTextA,MessageBoxA,SetFocus,GetWindowTextA,MessageBoxA,SetFocus,MessageBoxA,SetFocus,MessageBoxA,SetFocus,GetWindowTextA,MessageBoxA,SetFocus,GetWindowTextA,MessageBoxA,SetFocus,GetWindowTextA,MessageBoxA,SetFocus,MessageBoxA,SetFocus,MessageBoxA,SetFocus,GetWindowTextA,MessageBoxA,SetFocus,MessageBoxA,SetFocus,CreateFileA,SetFilePointer,WriteFile,WriteFile,WriteFile,WriteFile,CloseHandle,CreateFileA,SetFilePointer,WriteFile,WriteFile,CloseHandle,ShowWindow,NtdllDefWindowProc_A,

0_2_00406FF6

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Enmknk32.exe	Jump to behavior
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Enmknk32.exe:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Gopkbc32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	File created: C:\Windows\SysWOW64\Fnohck32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	File created: C:\Windows\SysWOW64\Jjhmem32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	File created: C:\Windows\SysWOW64\Fkchmojh.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	File created: C:\Windows\SysWOW64\Kiolqecl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	File created: C:\Windows\SysWOW64\Fekmfd32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	File created: C:\Windows\SysWOW64\Kjkggl32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	File created: C:\Windows\SysWOW64\Foaacm32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	File created: C:\Windows\SysWOW64\Fkoqiobi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	File created: C:\Windows\SysWOW64\Fmeamaph.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	File created: C:\Windows\SysWOW64\Njlgcl32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	File created: C:\Windows\SysWOW64\Ffmfeg32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	File created: C:\Windows\SysWOW64\Iamocmjl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	File created: C:\Windows\SysWOW64\Febcfckp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	File created: C:\Windows\SysWOW64\Gllhcm32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	File created: C:\Windows\SysWOW64\Gbfcph32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	File created: C:\Windows\SysWOW64\Alghniec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	File created: C:\Windows\SysWOW64\Gbipeg32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	File created: C:\Windows\SysWOW64\Kfkiao32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	File created: C:\Windows\SysWOW64\Gpmqolfa.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	File created: C:\Windows\SysWOW64\Cjojjp32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	File created: C:\Windows\SysWOW64\Geiigbeh.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	File created: C:\Windows\SysWOW64\Jeoqiq32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	File created: C:\Windows\SysWOW64\Gnbnph32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	File created: C:\Windows\SysWOW64\Dnjcfdoi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	File created: C:\Windows\SysWOW64\Gpajjk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	File created: C:\Windows\SysWOW64\Giamobql.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	File created: C:\Windows\SysWOW64\Genbbb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	File created: C:\Windows\SysWOW64\Domiglci.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	File created: C:\Windows\SysWOW64\Hbbclf32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	File created: C:\Windows\SysWOW64\Mejcahjf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	File created: C:\Windows\SysWOW64\Hpfcejof.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	File created: C:\Windows\SysWOW64\Dddgooib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	File created: C:\Windows\SysWOW64\Hphpkjlc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	File created: C:\Windows\SysWOW64\Ncafmodl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	File created: C:\Windows\SysWOW64\Hloapk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	File created: C:\Windows\SysWOW64\Lecjmhnq.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	File created: C:\Windows\SysWOW64\Iejbnp32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	File created: C:\Windows\SysWOW64\Kcamoc32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	File created: C:\Windows\SysWOW64\Iflknc32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	File created: C:\Windows\SysWOW64\Gchqcf32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	File created: C:\Windows\SysWOW64\Ipdpfhbf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	File created: C:\Windows\SysWOW64\Lpdccbgf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	File created: C:\Windows\SysWOW64\Ilkpkihj.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	File created: C:\Windows\SysWOW64\Ohblco32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	File created: C:\Windows\SysWOW64\Imjmel32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	File created: C:\Windows\SysWOW64\Okbebenm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	File created: C:\Windows\SysWOW64\Ifcanaen.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	File created: C:\Windows\SysWOW64\Nnpajnal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ifcanaen.exe	File created: C:\Windows\SysWOW64\Jfenda32.exe
Source: C:\Windows\SysWOW64\Ifcanaen.exe	File created: C:\Windows\SysWOW64\Docmmc32.dll
Source: C:\Windows\SysWOW64\Jfenda32.exe	File created: C:\Windows\SysWOW64\Jopbhd32.exe
Source: C:\Windows\SysWOW64\Jfenda32.exe	File created: C:\Windows\SysWOW64\Ipoden32.dll
Source: C:\Windows\SysWOW64\Jopbhd32.exe	File created: C:\Windows\SysWOW64\Jppobf32.exe
Source: C:\Windows\SysWOW64\Jopbhd32.exe	File created: C:\Windows\SysWOW64\Hcddga32.dll
Source: C:\Windows\SysWOW64\Jppobf32.exe	File created: C:\Windows\SysWOW64\Jlfpghnm.exe
Source: C:\Windows\SysWOW64\Jppobf32.exe	File created: C:\Windows\SysWOW64\Knggaeba.dll
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	File created: C:\Windows\SysWOW64\Jlimmg32.exe
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	File created: C:\Windows\SysWOW64\Akcokgql.dll
Source: C:\Windows\SysWOW64\Jlimmg32.exe	File created: C:\Windows\SysWOW64\Kmhigjcm.exe
Source: C:\Windows\SysWOW64\Jlimmg32.exe	File created: C:\Windows\SysWOW64\Ieiomg32.dll
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	File created: C:\Windows\SysWOW64\Kiojlk32.exe
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	File created: C:\Windows\SysWOW64\Eeapjigc.dll
Source: C:\Windows\SysWOW64\Kiojlk32.exe	File created: C:\Windows\SysWOW64\Kefjql32.exe
Source: C:\Windows\SysWOW64\Kiojlk32.exe	File created: C:\Windows\SysWOW64\Dgibhggn.dll
Source: C:\Windows\SysWOW64\Kefjql32.exe	File created: C:\Windows\SysWOW64\Kgegkoeh.exe
Source: C:\Windows\SysWOW64\Kefjql32.exe	File created: C:\Windows\SysWOW64\Hppahlmk.dll
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	File created: C:\Windows\SysWOW64\Kpnkcdli.exe
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	File created: C:\Windows\SysWOW64\Cpdhdolk.dll
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	File created: C:\Windows\SysWOW64\Kjfplj32.exe
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	File created: C:\Windows\SysWOW64\Chjnlmda.dll
Source: C:\Windows\SysWOW64\Kjfplj32.exe	File created: C:\Windows\SysWOW64\Ljimbj32.exe
Source: C:\Windows\SysWOW64\Kjfplj32.exe	File created: C:\Windows\SysWOW64\Heaepkaj.dll
Source: C:\Windows\SysWOW64\Ljimbj32.exe	File created: C:\Windows\SysWOW64\Leomgk32.exe
Source: C:\Windows\SysWOW64\Ljimbj32.exe	File created: C:\Windows\SysWOW64\Jiipjfip.dll
Source: C:\Windows\SysWOW64\Leomgk32.exe	File created: C:\Windows\SysWOW64\Lgojanmn.exe
Source: C:\Windows\SysWOW64\Leomgk32.exe	File created: C:\Windows\SysWOW64\Iciglbko.dll
Source: C:\Windows\SysWOW64\Lgojanmn.exe	File created: C:\Windows\SysWOW64\Lgaffm32.exe
Source: C:\Windows\SysWOW64\Lgojanmn.exe	File created: C:\Windows\SysWOW64\Fjpdni32.dll
Source: C:\Windows\SysWOW64\Lgaffm32.exe	File created: C:\Windows\SysWOW64\Llnood32.exe
Source: C:\Windows\SysWOW64\Lgaffm32.exe	File created: C:\Windows\SysWOW64\Njmgoh32.dll
Source: C:\Windows\SysWOW64\Llnood32.exe	File created: C:\Windows\SysWOW64\Ljbphh32.exe
Source: C:\Windows\SysWOW64\Llnood32.exe	File created: C:\Windows\SysWOW64\Aljbfgpf.dll
Source: C:\Windows\SysWOW64\Ljbphh32.exe	File created: C:\Windows\SysWOW64\Mjdlnhfi.exe
Source: C:\Windows\SysWOW64\Ljbphh32.exe	File created: C:\Windows\SysWOW64\Aelink32.dll
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	File created: C:\Windows\SysWOW64\Mjgichdg.exe
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	File created: C:\Windows\SysWOW64\Cemjaq32.dll
Source: C:\Windows\SysWOW64\Mjgichdg.exe	File created: C:\Windows\SysWOW64\Mjieig32.exe
Source: C:\Windows\SysWOW64\Mjgichdg.exe	File created: C:\Windows\SysWOW64\Haiooqfk.dll
Source: C:\Windows\SysWOW64\Mjieig32.exe	File created: C:\Windows\SysWOW64\Mgmfbl32.exe
Source: C:\Windows\SysWOW64\Mjieig32.exe	File created: C:\Windows\SysWOW64\Impfdpln.dll
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	File created: C:\Windows\SysWOW64\Mohkfn32.exe
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	File created: C:\Windows\SysWOW64\Oqkkln32.dll
Source: C:\Windows\SysWOW64\Mohkfn32.exe	File created: C:\Windows\SysWOW64\Mnikde32.exe
Source: C:\Windows\SysWOW64\Mohkfn32.exe	File created: C:\Windows\SysWOW64\Ingcjaio.dll
Source: C:\Windows\SysWOW64\Mnikde32.exe	File created: C:\Windows\SysWOW64\Njplifll.exe
Source: C:\Windows\SysWOW64\Mnikde32.exe	File created: C:\Windows\SysWOW64\Nhljaibo.dll
Source: C:\Windows\SysWOW64\Njplifll.exe	File created: C:\Windows\SysWOW64\Nchpbl32.exe
Source: C:\Windows\SysWOW64\Njplifll.exe	File created: C:\Windows\SysWOW64\Ajjjec32.dll
Source: C:\Windows\SysWOW64\Nchpbl32.exe	File created: C:\Windows\SysWOW64\Nooagm32.exe
Source: C:\Windows\SysWOW64\Nchpbl32.exe	File created: C:\Windows\SysWOW64\Homjaafk.dll
Source: C:\Windows\SysWOW64\Nooagm32.exe	File created: C:\Windows\SysWOW64\Nqomappc.exe
Source: C:\Windows\SysWOW64\Nooagm32.exe	File created: C:\Windows\SysWOW64\Chbmaj32.dll
Source: C:\Windows\SysWOW64\Nqomappc.exe	File created: C:\Windows\SysWOW64\Nmenfa32.exe
Source: C:\Windows\SysWOW64\Nqomappc.exe	File created: C:\Windows\SysWOW64\Mfpeda32.dll
Source: C:\Windows\SysWOW64\Nmenfa32.exe	File created: C:\Windows\SysWOW64\Oqcglo32.exe
Source: C:\Windows\SysWOW64\Nmenfa32.exe	File created: C:\Windows\SysWOW64\Glgklpcj.dll
Source: C:\Windows\SysWOW64\Oqcglo32.exe	File created: C:\Windows\SysWOW64\Ophcmlpf.exe
Source: C:\Windows\SysWOW64\Oqcglo32.exe	File created: C:\Windows\SysWOW64\Dbhphf32.dll
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	File created: C:\Windows\SysWOW64\Oqhpgogi.exe
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	File created: C:\Windows\SysWOW64\Lpkigf32.dll
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	File created: C:\Windows\SysWOW64\Omoalp32.exe
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	File created: C:\Windows\SysWOW64\Glgafh32.dll
Source: C:\Windows\SysWOW64\Omoalp32.exe	File created: C:\Windows\SysWOW64\Onnmfb32.exe
Source: C:\Windows\SysWOW64\Omoalp32.exe	File created: C:\Windows\SysWOW64\Nnclcm32.dll
Source: C:\Windows\SysWOW64\Onnmfb32.exe	File created: C:\Windows\SysWOW64\Onqjlb32.exe
Source: C:\Windows\SysWOW64\Onnmfb32.exe	File created: C:\Windows\SysWOW64\Jmclho32.dll
Source: C:\Windows\SysWOW64\Onqjlb32.exe	File created: C:\Windows\SysWOW64\Pjgkac32.exe
Source: C:\Windows\SysWOW64\Onqjlb32.exe	File created: C:\Windows\SysWOW64\Eqacmgol.dll
Source: C:\Windows\SysWOW64\Pjgkac32.exe	File created: C:\Windows\SysWOW64\Pfnkfdne.exe
Source: C:\Windows\SysWOW64\Pjgkac32.exe	File created: C:\Windows\SysWOW64\Dodmipcd.dll
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	File created: C:\Windows\SysWOW64\Pfqhkdkc.exe
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	File created: C:\Windows\SysWOW64\Mbpekpdk.dll
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	File created: C:\Windows\SysWOW64\Pfceac32.exe
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	File created: C:\Windows\SysWOW64\Lmaaqi32.dll
Source: C:\Windows\SysWOW64\Pfceac32.exe	File created: C:\Windows\SysWOW64\Pfeafc32.exe
Source: C:\Windows\SysWOW64\Pfceac32.exe	File created: C:\Windows\SysWOW64\Jmcpkl32.dll
Source: C:\Windows\SysWOW64\Pfeafc32.exe	File created: C:\Windows\SysWOW64\Qjcjma32.exe
Source: C:\Windows\SysWOW64\Pfeafc32.exe	File created: C:\Windows\SysWOW64\Qappag32.dll
Source: C:\Windows\SysWOW64\Qjcjma32.exe	File created: C:\Windows\SysWOW64\Qhgkff32.exe
Source: C:\Windows\SysWOW64\Qjcjma32.exe	File created: C:\Windows\SysWOW64\Fnjcoo32.dll
Source: C:\Windows\SysWOW64\Qhgkff32.exe	File created: C:\Windows\SysWOW64\Apbpjhji.exe
Source: C:\Windows\SysWOW64\Qhgkff32.exe	File created: C:\Windows\SysWOW64\Inbgmhop.dll
Source: C:\Windows\SysWOW64\Apbpjhji.exe	File created: C:\Windows\SysWOW64\Aabldk32.exe
Source: C:\Windows\SysWOW64\Apbpjhji.exe	File created: C:\Windows\SysWOW64\Ekifajpc.dll
Source: C:\Windows\SysWOW64\Aabldk32.exe	File created: C:\Windows\SysWOW64\Ajjqmqgl.exe
Source: C:\Windows\SysWOW64\Aabldk32.exe	File created: C:\Windows\SysWOW64\Hfplhlei.dll
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	File created: C:\Windows\SysWOW64\Apgieg32.exe
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	File created: C:\Windows\SysWOW64\Magfho32.dll
Source: C:\Windows\SysWOW64\Apgieg32.exe	File created: C:\Windows\SysWOW64\Amkiol32.exe
Source: C:\Windows\SysWOW64\Apgieg32.exe	File created: C:\Windows\SysWOW64\Mmgiocda.dll
Source: C:\Windows\SysWOW64\Amkiol32.exe	File created: C:\Windows\SysWOW64\Ajojhp32.exe
Source: C:\Windows\SysWOW64\Amkiol32.exe	File created: C:\Windows\SysWOW64\Pdlope32.dll
Source: C:\Windows\SysWOW64\Ajojhp32.exe	File created: C:\Windows\SysWOW64\Bombon32.exe
Source: C:\Windows\SysWOW64\Ajojhp32.exe	File created: C:\Windows\SysWOW64\Hmnmcf32.dll
Source: C:\Windows\SysWOW64\Bombon32.exe	File created: C:\Windows\SysWOW64\Bmbppkoe.exe
Source: C:\Windows\SysWOW64\Bombon32.exe	File created: C:\Windows\SysWOW64\Cccfolfa.dll
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	File created: C:\Windows\SysWOW64\Baphfiel.exe
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	File created: C:\Windows\SysWOW64\Hcliif32.dll
Source: C:\Windows\SysWOW64\Baphfiel.exe	File created: C:\Windows\SysWOW64\Bmgikj32.exe
Source: C:\Windows\SysWOW64\Baphfiel.exe	File created: C:\Windows\SysWOW64\Oogkej32.dll
Source: C:\Windows\SysWOW64\Bmgikj32.exe	File created: C:\Windows\SysWOW64\Badaah32.exe
Source: C:\Windows\SysWOW64\Bmgikj32.exe	File created: C:\Windows\SysWOW64\Galjgp32.dll
Source: C:\Windows\SysWOW64\Badaah32.exe	File created: C:\Windows\SysWOW64\Cohbjm32.exe
Source: C:\Windows\SysWOW64\Badaah32.exe	File created: C:\Windows\SysWOW64\Kpnojmgp.dll
Source: C:\Windows\SysWOW64\Cohbjm32.exe	File created: C:\Windows\SysWOW64\Cokoplnm.exe
Source: C:\Windows\SysWOW64\Cohbjm32.exe	File created: C:\Windows\SysWOW64\Iodlcfjb.dll
Source: C:\Windows\SysWOW64\Cokoplnm.exe	File created: C:\Windows\SysWOW64\Cgfcdokh.exe
Source: C:\Windows\SysWOW64\Cokoplnm.exe	File created: C:\Windows\SysWOW64\Lhhhfbih.dll
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	File created: C:\Windows\SysWOW64\Ckdljm32.exe
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	File created: C:\Windows\SysWOW64\Qjndnbei.dll
Source: C:\Windows\SysWOW64\Ckdljm32.exe	File created: C:\Windows\SysWOW64\Chhmdaph.exe
Source: C:\Windows\SysWOW64\Ckdljm32.exe	File created: C:\Windows\SysWOW64\Hiolkefh.dll
Source: C:\Windows\SysWOW64\Chhmdaph.exe	File created: C:\Windows\SysWOW64\Dhjiianf.exe
Source: C:\Windows\SysWOW64\Chhmdaph.exe	File created: C:\Windows\SysWOW64\Bhfgjioo.dll
Source: C:\Windows\SysWOW64\Dhjiianf.exe	File created: C:\Windows\SysWOW64\Dhmfoq32.exe
Source: C:\Windows\SysWOW64\Dhjiianf.exe	File created: C:\Windows\SysWOW64\Fcbfja32.dll
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	File created: C:\Windows\SysWOW64\Dhocdp32.exe
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	File created: C:\Windows\SysWOW64\Gljedo32.dll
Source: C:\Windows\SysWOW64\Dhocdp32.exe	File created: C:\Windows\SysWOW64\Dokhgj32.exe
Source: C:\Windows\SysWOW64\Dhocdp32.exe	File created: C:\Windows\SysWOW64\Imdckjjd.dll
Source: C:\Windows\SysWOW64\Dokhgj32.exe	File created: C:\Windows\SysWOW64\Dondlj32.exe
Source: C:\Windows\SysWOW64\Dokhgj32.exe	File created: C:\Windows\SysWOW64\Jiceolni.dll
Source: C:\Windows\SysWOW64\Dondlj32.exe	File created: C:\Windows\SysWOW64\Encamf32.exe
Source: C:\Windows\SysWOW64\Dondlj32.exe	File created: C:\Windows\SysWOW64\Clakkf32.dll
Source: C:\Windows\SysWOW64\Encamf32.exe	File created: C:\Windows\SysWOW64\Eaqjcdhf.exe
Source: C:\Windows\SysWOW64\Encamf32.exe	File created: C:\Windows\SysWOW64\Aefbqf32.dll
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	File created: C:\Windows\SysWOW64\Engkhenj.exe
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	File created: C:\Windows\SysWOW64\Hoeiflna.dll
Source: C:\Windows\SysWOW64\Engkhenj.exe	File created: C:\Windows\SysWOW64\Eddpko32.exe
Source: C:\Windows\SysWOW64\Engkhenj.exe	File created: C:\Windows\SysWOW64\Jofjci32.dll
Source: C:\Windows\SysWOW64\Eddpko32.exe	File created: C:\Windows\SysWOW64\Fqjqpp32.exe
Source: C:\Windows\SysWOW64\Eddpko32.exe	File created: C:\Windows\SysWOW64\Giommjni.dll
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	File created: C:\Windows\SysWOW64\Fbjmjcpl.exe
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	File created: C:\Windows\SysWOW64\Lmolop32.dll
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	File created: C:\Windows\SysWOW64\Fnanodfp.exe
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	File created: C:\Windows\SysWOW64\Mpahpi32.dll
Source: C:\Windows\SysWOW64\Fnanodfp.exe	File created: C:\Windows\SysWOW64\Fopjig32.exe
Source: C:\Windows\SysWOW64\Fnanodfp.exe	File created: C:\Windows\SysWOW64\Nlfojgba.dll
Source: C:\Windows\SysWOW64\Fopjig32.exe	File created: C:\Windows\SysWOW64\Fbacjbjc.exe
Source: C:\Windows\SysWOW64\Fopjig32.exe	File created: C:\Windows\SysWOW64\Ffchlo32.dll
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	File created: C:\Windows\SysWOW64\Gqfpko32.exe
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	File created: C:\Windows\SysWOW64\Jlnoca32.dll
Source: C:\Windows\SysWOW64\Gqfpko32.exe	File created: C:\Windows\SysWOW64\Ggbenh32.exe
Source: C:\Windows\SysWOW64\Gqfpko32.exe	File created: C:\Windows\SysWOW64\Majppnhp.dll
Source: C:\Windows\SysWOW64\Ggbenh32.exe	File created: C:\Windows\SysWOW64\Gibahklh.exe
Source: C:\Windows\SysWOW64\Ggbenh32.exe	File created: C:\Windows\SysWOW64\Ejjjedcj.dll
Source: C:\Windows\SysWOW64\Gibahklh.exe	File created: C:\Windows\SysWOW64\Gidnmk32.exe
Source: C:\Windows\SysWOW64\Gibahklh.exe	File created: C:\Windows\SysWOW64\Khmhlo32.dll
Source: C:\Windows\SysWOW64\Gidnmk32.exe	File created: C:\Windows\SysWOW64\Gekobloj.exe
Source: C:\Windows\SysWOW64\Gidnmk32.exe	File created: C:\Windows\SysWOW64\Gmakid32.dll
Source: C:\Windows\SysWOW64\Gekobloj.exe	File created: C:\Windows\SysWOW64\Hglhdg32.exe
Source: C:\Windows\SysWOW64\Gekobloj.exe	File created: C:\Windows\SysWOW64\Llbhhh32.dll
Source: C:\Windows\SysWOW64\Hglhdg32.exe	File created: C:\Windows\SysWOW64\Hkjqjeba.exe
Source: C:\Windows\SysWOW64\Hglhdg32.exe	File created: C:\Windows\SysWOW64\Ebgacgaj.dll
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	File created: C:\Windows\SysWOW64\Hgqaofhe.exe
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	File created: C:\Windows\SysWOW64\Jfebge32.dll
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	File created: C:\Windows\SysWOW64\Hedahkgo.exe
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	File created: C:\Windows\SysWOW64\Hikbigjf.dll
Source: C:\Windows\SysWOW64\Hedahkgo.exe	File created: C:\Windows\SysWOW64\Hbhbbofi.exe
Source: C:\Windows\SysWOW64\Hedahkgo.exe	File created: C:\Windows\SysWOW64\Gjhongok.dll
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	File created: C:\Windows\SysWOW64\Ibkogn32.exe
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	File created: C:\Windows\SysWOW64\Kdjdhipm.dll
Source: C:\Windows\SysWOW64\Ibkogn32.exe	File created: C:\Windows\SysWOW64\Inaplpij.exe
Source: C:\Windows\SysWOW64\Ibkogn32.exe	File created: C:\Windows\SysWOW64\Nlfalpdi.dll
Source: C:\Windows\SysWOW64\Inaplpij.exe	File created: C:\Windows\SysWOW64\Iiiqoh32.exe
Source: C:\Windows\SysWOW64\Inaplpij.exe	File created: C:\Windows\SysWOW64\Phhqek32.dll
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	File created: C:\Windows\SysWOW64\Ipfeaa32.exe
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	File created: C:\Windows\SysWOW64\Bhiabhja.dll
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	File created: C:\Windows\SysWOW64\Jphbga32.exe
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	File created: C:\Windows\SysWOW64\Hgpoon32.dll
Source: C:\Windows\SysWOW64\Jphbga32.exe	File created: C:\Windows\SysWOW64\Jomohnom.exe
Source: C:\Windows\SysWOW64\Jphbga32.exe	File created: C:\Windows\SysWOW64\Mhoflbja.dll
Source: C:\Windows\SysWOW64\Jomohnom.exe	File created: C:\Windows\SysWOW64\Jpmlbqfp.exe
Source: C:\Windows\SysWOW64\Jomohnom.exe	File created: C:\Windows\SysWOW64\Kaigjjqk.dll
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	File created: C:\Windows\SysWOW64\Jlclga32.exe
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	File created: C:\Windows\SysWOW64\Nfghhi32.dll
Source: C:\Windows\SysWOW64\Jlclga32.exe	File created: C:\Windows\SysWOW64\Jhjmlb32.exe
Source: C:\Windows\SysWOW64\Jlclga32.exe	File created: C:\Windows\SysWOW64\Ecjgjl32.dll
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	File created: C:\Windows\SysWOW64\Jacaehhi.exe
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	File created: C:\Windows\SysWOW64\Fbjocj32.dll
Source: C:\Windows\SysWOW64\Jacaehhi.exe	File created: C:\Windows\SysWOW64\Khofgbnc.exe
Source: C:\Windows\SysWOW64\Jacaehhi.exe	File created: C:\Windows\SysWOW64\Mafkbeoj.dll
Source: C:\Windows\SysWOW64\Khofgbnc.exe	File created: C:\Windows\SysWOW64\Khacmalp.exe
Source: C:\Windows\SysWOW64\Khofgbnc.exe	File created: C:\Windows\SysWOW64\Lbjkckae.dll
Source: C:\Windows\SysWOW64\Khacmalp.exe	File created: C:\Windows\SysWOW64\Konhokaj.exe
Source: C:\Windows\SysWOW64\Khacmalp.exe	File created: C:\Windows\SysWOW64\Mdfpjg32.dll
Source: C:\Windows\SysWOW64\Konhokaj.exe	File created: C:\Windows\SysWOW64\Kejmae32.exe
Source: C:\Windows\SysWOW64\Konhokaj.exe	File created: C:\Windows\SysWOW64\Iibphp32.dll
Source: C:\Windows\SysWOW64\Kejmae32.exe	File created: C:\Windows\SysWOW64\Lpbndndh.exe
Source: C:\Windows\SysWOW64\Kejmae32.exe	File created: C:\Windows\SysWOW64\Hqcomlbp.dll
Source: C:\Windows\SysWOW64\Lpbndndh.exe	File created: C:\Windows\SysWOW64\Lcbgfi32.exe
Source: C:\Windows\SysWOW64\Lpbndndh.exe	File created: C:\Windows\SysWOW64\Dkbmhf32.dll
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	File created: C:\Windows\SysWOW64\Lceckh32.exe
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	File created: C:\Windows\SysWOW64\Efcana32.dll
Source: C:\Windows\SysWOW64\Lceckh32.exe	File created: C:\Windows\SysWOW64\Lcgpahmc.exe
Source: C:\Windows\SysWOW64\Lceckh32.exe	File created: C:\Windows\SysWOW64\Aidobh32.dll
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	File created: C:\Windows\SysWOW64\Mpkajllm.exe
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	File created: C:\Windows\SysWOW64\Fdldjhaq.dll
Source: C:\Windows\SysWOW64\Mpkajllm.exe	File created: C:\Windows\SysWOW64\Mhibdn32.exe
Source: C:\Windows\SysWOW64\Mpkajllm.exe	File created: C:\Windows\SysWOW64\Afkgdh32.dll
Source: C:\Windows\SysWOW64\Mhibdn32.exe	File created: C:\Windows\SysWOW64\Mhkojn32.exe
Source: C:\Windows\SysWOW64\Mhibdn32.exe	File created: C:\Windows\SysWOW64\Heblggpd.dll
Source: C:\Windows\SysWOW64\Mhkojn32.exe	File created: C:\Windows\SysWOW64\Mlihpl32.exe
Source: C:\Windows\SysWOW64\Mhkojn32.exe	File created: C:\Windows\SysWOW64\Cbjkoi32.dll
Source: C:\Windows\SysWOW64\Mlihpl32.exe	File created: C:\Windows\SysWOW64\Njoeophq.exe
Source: C:\Windows\SysWOW64\Mlihpl32.exe	File created: C:\Windows\SysWOW64\Dqamkq32.dll
Source: C:\Windows\SysWOW64\Njoeophq.exe	File created: C:\Windows\SysWOW64\Nbkicbfk.exe
Source: C:\Windows\SysWOW64\Njoeophq.exe	File created: C:\Windows\SysWOW64\Kgamdcln.dll
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	File created: C:\Windows\SysWOW64\Nqnfgjlh.exe
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	File created: C:\Windows\SysWOW64\Hkkoqdmp.dll
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	File created: C:\Windows\SysWOW64\Ofmldphm.exe
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	File created: C:\Windows\SysWOW64\Qoejampk.dll
Source: C:\Windows\SysWOW64\Ofmldphm.exe	File created: C:\Windows\SysWOW64\Ojkdkonc.exe
Source: C:\Windows\SysWOW64\Ofmldphm.exe	File created: C:\Windows\SysWOW64\Pidiop32.dll
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	File created: C:\Windows\SysWOW64\Ojmapnlq.exe
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	File created: C:\Windows\SysWOW64\Ecllamlh.dll
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	File created: C:\Windows\SysWOW64\Ofdbeobd.exe
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	File created: C:\Windows\SysWOW64\Hdnaik32.dll
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	File created: C:\Windows\SysWOW64\Offokopb.exe
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	File created: C:\Windows\SysWOW64\Oollcpnc.dll
Source: C:\Windows\SysWOW64\Offokopb.exe	File created: C:\Windows\SysWOW64\Pfikpo32.exe
Source: C:\Windows\SysWOW64\Offokopb.exe	File created: C:\Windows\SysWOW64\Lgbpdadc.dll
Source: C:\Windows\SysWOW64\Pfikpo32.exe	File created: C:\Windows\SysWOW64\Pijdbj32.exe
Source: C:\Windows\SysWOW64\Pfikpo32.exe	File created: C:\Windows\SysWOW64\Lpgaep32.dll
Source: C:\Windows\SysWOW64\Pijdbj32.exe	File created: C:\Windows\SysWOW64\Pjiqlm32.exe
Source: C:\Windows\SysWOW64\Pijdbj32.exe	File created: C:\Windows\SysWOW64\Hfknhcaf.dll
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	File created: C:\Windows\SysWOW64\Pbdepo32.exe
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	File created: C:\Windows\SysWOW64\Pdhionab.dll
Source: C:\Windows\SysWOW64\Pbdepo32.exe	File created: C:\Windows\SysWOW64\Pqhbdf32.exe
Source: C:\Windows\SysWOW64\Pbdepo32.exe	File created: C:\Windows\SysWOW64\Obgbhn32.dll
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	File created: C:\Windows\SysWOW64\Qmocigko.exe
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	File created: C:\Windows\SysWOW64\Golngj32.dll
Source: C:\Windows\SysWOW64\Qmocigko.exe	File created: C:\Windows\SysWOW64\Qiecnhac.exe
Source: C:\Windows\SysWOW64\Qmocigko.exe	File created: C:\Windows\SysWOW64\Hchcho32.dll
Source: C:\Windows\SysWOW64\Qiecnhac.exe	File created: C:\Windows\SysWOW64\Amcldf32.exe
Source: C:\Windows\SysWOW64\Qiecnhac.exe	File created: C:\Windows\SysWOW64\Cmkokg32.dll
Source: C:\Windows\SysWOW64\Amcldf32.exe	File created: C:\Windows\SysWOW64\Ameiifeg.exe
Source: C:\Windows\SysWOW64\Amcldf32.exe	File created: C:\Windows\SysWOW64\Ndkkoc32.dll
Source: C:\Windows\SysWOW64\Ameiifeg.exe	File created: C:\Windows\SysWOW64\Ailjng32.exe
Source: C:\Windows\SysWOW64\Ameiifeg.exe	File created: C:\Windows\SysWOW64\Knjaiq32.dll
Source: C:\Windows\SysWOW64\Ailjng32.exe	File created: C:\Windows\SysWOW64\Ajlfhjbn.exe
Source: C:\Windows\SysWOW64\Ailjng32.exe	File created: C:\Windows\SysWOW64\Cbaabn32.dll
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	File created: C:\Windows\SysWOW64\Bpkkfq32.exe
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	File created: C:\Windows\SysWOW64\Ipdpiheo.dll
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	File created: C:\Windows\SysWOW64\Bajhpc32.exe
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	File created: C:\Windows\SysWOW64\Ddnmejkm.dll
Source: C:\Windows\SysWOW64\Bajhpc32.exe	File created: C:\Windows\SysWOW64\Bdkabo32.exe
Source: C:\Windows\SysWOW64\Bajhpc32.exe	File created: C:\Windows\SysWOW64\Ikdhblhl.dll
Source: C:\Windows\SysWOW64\Bdkabo32.exe	File created: C:\Windows\SysWOW64\Bdnngnpc.exe
Source: C:\Windows\SysWOW64\Bdkabo32.exe	File created: C:\Windows\SysWOW64\Cgbcokgg.dll
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	File created: C:\Windows\SysWOW64\Baanabom.exe
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	File created: C:\Windows\SysWOW64\Kilkncaa.dll
Source: C:\Windows\SysWOW64\Baanabom.exe	File created: C:\Windows\SysWOW64\Bmhofc32.exe
Source: C:\Windows\SysWOW64\Baanabom.exe	File created: C:\Windows\SysWOW64\Beqfpgmi.dll
Source: C:\Windows\SysWOW64\Bmhofc32.exe	File created: C:\Windows\SysWOW64\Cafglb32.exe
Source: C:\Windows\SysWOW64\Bmhofc32.exe	File created: C:\Windows\SysWOW64\Pmqiii32.dll
Source: C:\Windows\SysWOW64\Cafglb32.exe	File created: C:\Windows\SysWOW64\Cmmhacal.exe
Source: C:\Windows\SysWOW64\Cafglb32.exe	File created: C:\Windows\SysWOW64\Ppcqpc32.dll
Source: C:\Windows\SysWOW64\Cmmhacal.exe	File created: C:\Windows\SysWOW64\Cmoefb32.exe
Source: C:\Windows\SysWOW64\Cmmhacal.exe	File created: C:\Windows\SysWOW64\Ggjbcdlg.dll
Source: C:\Windows\SysWOW64\Cmoefb32.exe	File created: C:\Windows\SysWOW64\Cppnhn32.exe
Source: C:\Windows\SysWOW64\Cmoefb32.exe	File created: C:\Windows\SysWOW64\Epnhmj32.dll
Source: C:\Windows\SysWOW64\Cppnhn32.exe	File created: C:\Windows\SysWOW64\Dbagjiik.exe
Source: C:\Windows\SysWOW64\Cppnhn32.exe	File created: C:\Windows\SysWOW64\Foqfph32.dll
Source: C:\Windows\SysWOW64\Dbagjiik.exe	File created: C:\Windows\SysWOW64\Dmihma32.exe
Source: C:\Windows\SysWOW64\Dbagjiik.exe	File created: C:\Windows\SysWOW64\Bccbfjkm.dll
Source: C:\Windows\SysWOW64\Dmihma32.exe	File created: C:\Windows\SysWOW64\Dafpcpme.exe
Source: C:\Windows\SysWOW64\Dmihma32.exe	File created: C:\Windows\SysWOW64\Pihcgoep.dll
Source: C:\Windows\SysWOW64\Dafpcpme.exe	File created: C:\Windows\SysWOW64\Dkoele32.exe
Source: C:\Windows\SysWOW64\Dafpcpme.exe	File created: C:\Windows\SysWOW64\Hjfniidf.dll
Source: C:\Windows\SysWOW64\Dkoele32.exe	File created: C:\Windows\SysWOW64\Dcjjpgaa.exe
Source: C:\Windows\SysWOW64\Dkoele32.exe	File created: C:\Windows\SysWOW64\Fflljpnc.dll
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	File created: C:\Windows\SysWOW64\Ecmfegon.exe
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	File created: C:\Windows\SysWOW64\Ibphfofn.dll
Source: C:\Windows\SysWOW64\Ecmfegon.exe	File created: C:\Windows\SysWOW64\Edlcpjfa.exe
Source: C:\Windows\SysWOW64\Ecmfegon.exe	File created: C:\Windows\SysWOW64\Igiglfjj.dll
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	File created: C:\Windows\SysWOW64\Ednpeidn.exe
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	File created: C:\Windows\SysWOW64\Ecglja32.dll
Source: C:\Windows\SysWOW64\Ednpeidn.exe	File created: C:\Windows\SysWOW64\Edqlki32.exe
Source: C:\Windows\SysWOW64\Ednpeidn.exe	File created: C:\Windows\SysWOW64\Nggkimpl.dll
Source: C:\Windows\SysWOW64\Edqlki32.exe	File created: C:\Windows\SysWOW64\Eniqcohl.exe
Source: C:\Windows\SysWOW64\Edqlki32.exe	File created: C:\Windows\SysWOW64\Cqeolm32.dll
Source: C:\Windows\SysWOW64\Eniqcohl.exe	File created: C:\Windows\SysWOW64\Fnkmiofi.exe
Source: C:\Windows\SysWOW64\Eniqcohl.exe	File created: C:\Windows\SysWOW64\Fifbonoq.dll
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	File created: C:\Windows\SysWOW64\Fplfki32.exe
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	File created: C:\Windows\SysWOW64\Gdkolaoq.dll
Source: C:\Windows\SysWOW64\Fplfki32.exe	File created: C:\Windows\SysWOW64\Fghkmc32.exe
Source: C:\Windows\SysWOW64\Fplfki32.exe	File created: C:\Windows\SysWOW64\Pigmmehh.dll

Source: jQ3NFDayJm

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.win@362/339@0/0

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jQ3NFDayJm

Virustotal: Detection: 88%

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe

File read: C:\Users\user\Desktop\jQ3NFDayJm.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jQ3NFDayJm.exe "C:\Users\user\Desktop\jQ3NFDayJm.exe"
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Process created: C:\Windows\SysWOW64\Enmknk32.exe C:\Windows\system32\Enmknk32.exe
Source: C:\Windows\SysWOW64\Enmknk32.exe	Process created: C:\Windows\SysWOW64\Fnohck32.exe C:\Windows\system32\Fnohck32.exe
Source: C:\Windows\SysWOW64\Fnohck32.exe	Process created: C:\Windows\SysWOW64\Fkchmojh.exe C:\Windows\system32\Fkchmojh.exe
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Process created: C:\Windows\SysWOW64\Fekmfd32.exe C:\Windows\system32\Fekmfd32.exe
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Process created: C:\Windows\SysWOW64\Foaacm32.exe C:\Windows\system32\Foaacm32.exe
Source: C:\Windows\SysWOW64\Foaacm32.exe	Process created: C:\Windows\SysWOW64\Fmeamaph.exe C:\Windows\system32\Fmeamaph.exe
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Process created: C:\Windows\SysWOW64\Ffmfeg32.exe C:\Windows\system32\Ffmfeg32.exe
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Process created: C:\Windows\SysWOW64\Febcfckp.exe C:\Windows\system32\Febcfckp.exe
Source: C:\Windows\SysWOW64\Febcfckp.exe	Process created: C:\Windows\SysWOW64\Gbfcph32.exe C:\Windows\system32\Gbfcph32.exe
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Process created: C:\Windows\SysWOW64\Gbipeg32.exe C:\Windows\system32\Gbipeg32.exe
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Process created: C:\Windows\SysWOW64\Gpmqolfa.exe C:\Windows\system32\Gpmqolfa.exe
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Process created: C:\Windows\SysWOW64\Geiigbeh.exe C:\Windows\system32\Geiigbeh.exe
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Process created: C:\Windows\SysWOW64\Gnbnph32.exe C:\Windows\system32\Gnbnph32.exe
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Process created: C:\Windows\SysWOW64\Gpajjk32.exe C:\Windows\system32\Gpajjk32.exe
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Process created: C:\Windows\SysWOW64\Genbbb32.exe C:\Windows\system32\Genbbb32.exe
Source: C:\Windows\SysWOW64\Genbbb32.exe	Process created: C:\Windows\SysWOW64\Hbbclf32.exe C:\Windows\system32\Hbbclf32.exe
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Process created: C:\Windows\SysWOW64\Hpfcejof.exe C:\Windows\system32\Hpfcejof.exe
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Process created: C:\Windows\SysWOW64\Hphpkjlc.exe C:\Windows\system32\Hphpkjlc.exe
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Process created: C:\Windows\SysWOW64\Hloapk32.exe C:\Windows\system32\Hloapk32.exe
Source: C:\Windows\SysWOW64\Hloapk32.exe	Process created: C:\Windows\SysWOW64\Iejbnp32.exe C:\Windows\system32\Iejbnp32.exe
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Process created: C:\Windows\SysWOW64\Iflknc32.exe C:\Windows\system32\Iflknc32.exe
Source: C:\Windows\SysWOW64\Iflknc32.exe	Process created: C:\Windows\SysWOW64\Ipdpfhbf.exe C:\Windows\system32\Ipdpfhbf.exe
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Process created: C:\Windows\SysWOW64\Ilkpkihj.exe C:\Windows\system32\Ilkpkihj.exe
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Process created: C:\Windows\SysWOW64\Imjmel32.exe C:\Windows\system32\Imjmel32.exe
Source: C:\Windows\SysWOW64\Imjmel32.exe	Process created: C:\Windows\SysWOW64\Ifcanaen.exe C:\Windows\system32\Ifcanaen.exe
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Process created: C:\Windows\SysWOW64\Jfenda32.exe C:\Windows\system32\Jfenda32.exe
Source: C:\Windows\SysWOW64\Jfenda32.exe	Process created: C:\Windows\SysWOW64\Jopbhd32.exe C:\Windows\system32\Jopbhd32.exe
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Process created: C:\Windows\SysWOW64\Jppobf32.exe C:\Windows\system32\Jppobf32.exe
Source: C:\Windows\SysWOW64\Jppobf32.exe	Process created: C:\Windows\SysWOW64\Jlfpghnm.exe C:\Windows\system32\Jlfpghnm.exe
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Process created: C:\Windows\SysWOW64\Jlimmg32.exe C:\Windows\system32\Jlimmg32.exe
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Process created: C:\Windows\SysWOW64\Kmhigjcm.exe C:\Windows\system32\Kmhigjcm.exe
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Process created: C:\Windows\SysWOW64\Kiojlk32.exe C:\Windows\system32\Kiojlk32.exe
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Process created: C:\Windows\SysWOW64\Kefjql32.exe C:\Windows\system32\Kefjql32.exe
Source: C:\Windows\SysWOW64\Kefjql32.exe	Process created: C:\Windows\SysWOW64\Kgegkoeh.exe C:\Windows\system32\Kgegkoeh.exe
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Process created: C:\Windows\SysWOW64\Kpnkcdli.exe C:\Windows\system32\Kpnkcdli.exe
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Process created: C:\Windows\SysWOW64\Kjfplj32.exe C:\Windows\system32\Kjfplj32.exe
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Process created: C:\Windows\SysWOW64\Ljimbj32.exe C:\Windows\system32\Ljimbj32.exe
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Process created: C:\Windows\SysWOW64\Leomgk32.exe C:\Windows\system32\Leomgk32.exe
Source: C:\Windows\SysWOW64\Leomgk32.exe	Process created: C:\Windows\SysWOW64\Lgojanmn.exe C:\Windows\system32\Lgojanmn.exe
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Process created: C:\Windows\SysWOW64\Lgaffm32.exe C:\Windows\system32\Lgaffm32.exe
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Process created: C:\Windows\SysWOW64\Llnood32.exe C:\Windows\system32\Llnood32.exe
Source: C:\Windows\SysWOW64\Llnood32.exe	Process created: C:\Windows\SysWOW64\Ljbphh32.exe C:\Windows\system32\Ljbphh32.exe
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Process created: C:\Windows\SysWOW64\Mjdlnhfi.exe C:\Windows\system32\Mjdlnhfi.exe
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Process created: C:\Windows\SysWOW64\Mjgichdg.exe C:\Windows\system32\Mjgichdg.exe
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Process created: C:\Windows\SysWOW64\Mjieig32.exe C:\Windows\system32\Mjieig32.exe
Source: C:\Windows\SysWOW64\Mjieig32.exe	Process created: C:\Windows\SysWOW64\Mgmfbl32.exe C:\Windows\system32\Mgmfbl32.exe
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Process created: C:\Windows\SysWOW64\Mohkfn32.exe C:\Windows\system32\Mohkfn32.exe
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Process created: C:\Windows\SysWOW64\Mnikde32.exe C:\Windows\system32\Mnikde32.exe
Source: C:\Windows\SysWOW64\Mnikde32.exe	Process created: C:\Windows\SysWOW64\Njplifll.exe C:\Windows\system32\Njplifll.exe
Source: C:\Windows\SysWOW64\Njplifll.exe	Process created: C:\Windows\SysWOW64\Nchpbl32.exe C:\Windows\system32\Nchpbl32.exe
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Process created: C:\Windows\SysWOW64\Nooagm32.exe C:\Windows\system32\Nooagm32.exe
Source: C:\Windows\SysWOW64\Nooagm32.exe	Process created: C:\Windows\SysWOW64\Nqomappc.exe C:\Windows\system32\Nqomappc.exe
Source: C:\Windows\SysWOW64\Nqomappc.exe	Process created: C:\Windows\SysWOW64\Nmenfa32.exe C:\Windows\system32\Nmenfa32.exe
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Process created: C:\Windows\SysWOW64\Oqcglo32.exe C:\Windows\system32\Oqcglo32.exe
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Process created: C:\Windows\SysWOW64\Ophcmlpf.exe C:\Windows\system32\Ophcmlpf.exe
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Process created: C:\Windows\SysWOW64\Oqhpgogi.exe C:\Windows\system32\Oqhpgogi.exe
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Process created: C:\Windows\SysWOW64\Omoalp32.exe C:\Windows\system32\Omoalp32.exe
Source: C:\Windows\SysWOW64\Omoalp32.exe	Process created: C:\Windows\SysWOW64\Onnmfb32.exe C:\Windows\system32\Onnmfb32.exe
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Process created: C:\Windows\SysWOW64\Onqjlb32.exe C:\Windows\system32\Onqjlb32.exe
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Process created: C:\Windows\SysWOW64\Pjgkac32.exe C:\Windows\system32\Pjgkac32.exe
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Process created: C:\Windows\SysWOW64\Pfnkfdne.exe C:\Windows\system32\Pfnkfdne.exe
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Process created: C:\Windows\SysWOW64\Pfqhkdkc.exe C:\Windows\system32\Pfqhkdkc.exe
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Process created: C:\Windows\SysWOW64\Pfceac32.exe C:\Windows\system32\Pfceac32.exe
Source: C:\Windows\SysWOW64\Pfceac32.exe	Process created: C:\Windows\SysWOW64\Pfeafc32.exe C:\Windows\system32\Pfeafc32.exe
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Process created: C:\Windows\SysWOW64\Qjcjma32.exe C:\Windows\system32\Qjcjma32.exe
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Process created: C:\Windows\SysWOW64\Qhgkff32.exe C:\Windows\system32\Qhgkff32.exe
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Process created: C:\Windows\SysWOW64\Apbpjhji.exe C:\Windows\system32\Apbpjhji.exe
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Process created: C:\Windows\SysWOW64\Aabldk32.exe C:\Windows\system32\Aabldk32.exe
Source: C:\Windows\SysWOW64\Aabldk32.exe	Process created: C:\Windows\SysWOW64\Ajjqmqgl.exe C:\Windows\system32\Ajjqmqgl.exe
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Process created: C:\Windows\SysWOW64\Apgieg32.exe C:\Windows\system32\Apgieg32.exe
Source: C:\Windows\SysWOW64\Apgieg32.exe	Process created: C:\Windows\SysWOW64\Amkiol32.exe C:\Windows\system32\Amkiol32.exe
Source: C:\Windows\SysWOW64\Amkiol32.exe	Process created: C:\Windows\SysWOW64\Ajojhp32.exe C:\Windows\system32\Ajojhp32.exe
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Process created: C:\Windows\SysWOW64\Bombon32.exe C:\Windows\system32\Bombon32.exe
Source: C:\Windows\SysWOW64\Bombon32.exe	Process created: C:\Windows\SysWOW64\Bmbppkoe.exe C:\Windows\system32\Bmbppkoe.exe
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Process created: C:\Windows\SysWOW64\Baphfiel.exe C:\Windows\system32\Baphfiel.exe
Source: C:\Windows\SysWOW64\Baphfiel.exe	Process created: C:\Windows\SysWOW64\Bmgikj32.exe C:\Windows\system32\Bmgikj32.exe
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Process created: C:\Windows\SysWOW64\Badaah32.exe C:\Windows\system32\Badaah32.exe
Source: C:\Windows\SysWOW64\Badaah32.exe	Process created: C:\Windows\SysWOW64\Cohbjm32.exe C:\Windows\system32\Cohbjm32.exe
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Process created: C:\Windows\SysWOW64\Cokoplnm.exe C:\Windows\system32\Cokoplnm.exe
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Process created: C:\Windows\SysWOW64\Cgfcdokh.exe C:\Windows\system32\Cgfcdokh.exe
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Process created: C:\Windows\SysWOW64\Ckdljm32.exe C:\Windows\system32\Ckdljm32.exe
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Process created: C:\Windows\SysWOW64\Chhmdaph.exe C:\Windows\system32\Chhmdaph.exe
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Process created: C:\Windows\SysWOW64\Dhjiianf.exe C:\Windows\system32\Dhjiianf.exe
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Process created: C:\Windows\SysWOW64\Dhmfoq32.exe C:\Windows\system32\Dhmfoq32.exe
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Process created: C:\Windows\SysWOW64\Dhocdp32.exe C:\Windows\system32\Dhocdp32.exe
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Process created: C:\Windows\SysWOW64\Dokhgj32.exe C:\Windows\system32\Dokhgj32.exe
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Process created: C:\Windows\SysWOW64\Dondlj32.exe C:\Windows\system32\Dondlj32.exe
Source: C:\Windows\SysWOW64\Dondlj32.exe	Process created: C:\Windows\SysWOW64\Encamf32.exe C:\Windows\system32\Encamf32.exe
Source: C:\Windows\SysWOW64\Encamf32.exe	Process created: C:\Windows\SysWOW64\Eaqjcdhf.exe C:\Windows\system32\Eaqjcdhf.exe
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Process created: C:\Windows\SysWOW64\Engkhenj.exe C:\Windows\system32\Engkhenj.exe
Source: C:\Windows\SysWOW64\Engkhenj.exe	Process created: C:\Windows\SysWOW64\Eddpko32.exe C:\Windows\system32\Eddpko32.exe
Source: C:\Windows\SysWOW64\Eddpko32.exe	Process created: C:\Windows\SysWOW64\Fqjqpp32.exe C:\Windows\system32\Fqjqpp32.exe
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Process created: C:\Windows\SysWOW64\Fbjmjcpl.exe C:\Windows\system32\Fbjmjcpl.exe
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Process created: C:\Windows\SysWOW64\Fnanodfp.exe C:\Windows\system32\Fnanodfp.exe
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Process created: C:\Windows\SysWOW64\Fopjig32.exe C:\Windows\system32\Fopjig32.exe
Source: C:\Windows\SysWOW64\Fopjig32.exe	Process created: C:\Windows\SysWOW64\Fbacjbjc.exe C:\Windows\system32\Fbacjbjc.exe
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Process created: C:\Windows\SysWOW64\Gqfpko32.exe C:\Windows\system32\Gqfpko32.exe
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Process created: C:\Windows\SysWOW64\Ggbenh32.exe C:\Windows\system32\Ggbenh32.exe
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Process created: C:\Windows\SysWOW64\Gibahklh.exe C:\Windows\system32\Gibahklh.exe
Source: C:\Windows\SysWOW64\Gibahklh.exe	Process created: C:\Windows\SysWOW64\Gidnmk32.exe C:\Windows\system32\Gidnmk32.exe
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Process created: C:\Windows\SysWOW64\Gekobloj.exe C:\Windows\system32\Gekobloj.exe
Source: C:\Windows\SysWOW64\Gekobloj.exe	Process created: C:\Windows\SysWOW64\Hglhdg32.exe C:\Windows\system32\Hglhdg32.exe
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Process created: C:\Windows\SysWOW64\Hkjqjeba.exe C:\Windows\system32\Hkjqjeba.exe
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Process created: C:\Windows\SysWOW64\Hgqaofhe.exe C:\Windows\system32\Hgqaofhe.exe
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Process created: C:\Windows\SysWOW64\Hedahkgo.exe C:\Windows\system32\Hedahkgo.exe
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Process created: C:\Windows\SysWOW64\Hbhbbofi.exe C:\Windows\system32\Hbhbbofi.exe
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Process created: C:\Windows\SysWOW64\Ibkogn32.exe C:\Windows\system32\Ibkogn32.exe
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Process created: C:\Windows\SysWOW64\Inaplpij.exe C:\Windows\system32\Inaplpij.exe
Source: C:\Windows\SysWOW64\Inaplpij.exe	Process created: C:\Windows\SysWOW64\Iiiqoh32.exe C:\Windows\system32\Iiiqoh32.exe
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Process created: C:\Windows\SysWOW64\Ipfeaa32.exe C:\Windows\system32\Ipfeaa32.exe
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Process created: C:\Windows\SysWOW64\Jphbga32.exe C:\Windows\system32\Jphbga32.exe
Source: C:\Windows\SysWOW64\Jphbga32.exe	Process created: C:\Windows\SysWOW64\Jomohnom.exe C:\Windows\system32\Jomohnom.exe
Source: C:\Windows\SysWOW64\Jomohnom.exe	Process created: C:\Windows\SysWOW64\Jpmlbqfp.exe C:\Windows\system32\Jpmlbqfp.exe
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Process created: C:\Windows\SysWOW64\Jlclga32.exe C:\Windows\system32\Jlclga32.exe
Source: C:\Windows\SysWOW64\Jlclga32.exe	Process created: C:\Windows\SysWOW64\Jhjmlb32.exe C:\Windows\system32\Jhjmlb32.exe
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Process created: C:\Windows\SysWOW64\Jacaehhi.exe C:\Windows\system32\Jacaehhi.exe
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Process created: C:\Windows\SysWOW64\Khofgbnc.exe C:\Windows\system32\Khofgbnc.exe
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Process created: C:\Windows\SysWOW64\Khacmalp.exe C:\Windows\system32\Khacmalp.exe
Source: C:\Windows\SysWOW64\Khacmalp.exe	Process created: C:\Windows\SysWOW64\Konhokaj.exe C:\Windows\system32\Konhokaj.exe
Source: C:\Windows\SysWOW64\Konhokaj.exe	Process created: C:\Windows\SysWOW64\Kejmae32.exe C:\Windows\system32\Kejmae32.exe
Source: C:\Windows\SysWOW64\Kejmae32.exe	Process created: C:\Windows\SysWOW64\Lpbndndh.exe C:\Windows\system32\Lpbndndh.exe
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Process created: C:\Windows\SysWOW64\Lcbgfi32.exe C:\Windows\system32\Lcbgfi32.exe
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Process created: C:\Windows\SysWOW64\Lceckh32.exe C:\Windows\system32\Lceckh32.exe
Source: C:\Windows\SysWOW64\Lceckh32.exe	Process created: C:\Windows\SysWOW64\Lcgpahmc.exe C:\Windows\system32\Lcgpahmc.exe
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Process created: C:\Windows\SysWOW64\Mpkajllm.exe C:\Windows\system32\Mpkajllm.exe
Source: C:\Windows\SysWOW64\Mpkajllm.exe	Process created: C:\Windows\SysWOW64\Mhibdn32.exe C:\Windows\system32\Mhibdn32.exe
Source: C:\Windows\SysWOW64\Mhibdn32.exe	Process created: C:\Windows\SysWOW64\Mhkojn32.exe C:\Windows\system32\Mhkojn32.exe
Source: C:\Windows\SysWOW64\Mhkojn32.exe	Process created: C:\Windows\SysWOW64\Mlihpl32.exe C:\Windows\system32\Mlihpl32.exe
Source: C:\Windows\SysWOW64\Mlihpl32.exe	Process created: C:\Windows\SysWOW64\Njoeophq.exe C:\Windows\system32\Njoeophq.exe
Source: C:\Windows\SysWOW64\Njoeophq.exe	Process created: C:\Windows\SysWOW64\Nbkicbfk.exe C:\Windows\system32\Nbkicbfk.exe
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	Process created: C:\Windows\SysWOW64\Nqnfgjlh.exe C:\Windows\system32\Nqnfgjlh.exe
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	Process created: C:\Windows\SysWOW64\Ofmldphm.exe C:\Windows\system32\Ofmldphm.exe
Source: C:\Windows\SysWOW64\Ofmldphm.exe	Process created: C:\Windows\SysWOW64\Ojkdkonc.exe C:\Windows\system32\Ojkdkonc.exe
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	Process created: C:\Windows\SysWOW64\Ojmapnlq.exe C:\Windows\system32\Ojmapnlq.exe
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	Process created: C:\Windows\SysWOW64\Ofdbeobd.exe C:\Windows\system32\Ofdbeobd.exe
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	Process created: C:\Windows\SysWOW64\Offokopb.exe C:\Windows\system32\Offokopb.exe
Source: C:\Windows\SysWOW64\Offokopb.exe	Process created: C:\Windows\SysWOW64\Pfikpo32.exe C:\Windows\system32\Pfikpo32.exe
Source: C:\Windows\SysWOW64\Pfikpo32.exe	Process created: C:\Windows\SysWOW64\Pijdbj32.exe C:\Windows\system32\Pijdbj32.exe
Source: C:\Windows\SysWOW64\Pijdbj32.exe	Process created: C:\Windows\SysWOW64\Pjiqlm32.exe C:\Windows\system32\Pjiqlm32.exe
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	Process created: C:\Windows\SysWOW64\Pbdepo32.exe C:\Windows\system32\Pbdepo32.exe
Source: C:\Windows\SysWOW64\Pbdepo32.exe	Process created: C:\Windows\SysWOW64\Pqhbdf32.exe C:\Windows\system32\Pqhbdf32.exe
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	Process created: C:\Windows\SysWOW64\Qmocigko.exe C:\Windows\system32\Qmocigko.exe
Source: C:\Windows\SysWOW64\Qmocigko.exe	Process created: C:\Windows\SysWOW64\Qiecnhac.exe C:\Windows\system32\Qiecnhac.exe
Source: C:\Windows\SysWOW64\Qiecnhac.exe	Process created: C:\Windows\SysWOW64\Amcldf32.exe C:\Windows\system32\Amcldf32.exe
Source: C:\Windows\SysWOW64\Amcldf32.exe	Process created: C:\Windows\SysWOW64\Ameiifeg.exe C:\Windows\system32\Ameiifeg.exe
Source: C:\Windows\SysWOW64\Ameiifeg.exe	Process created: C:\Windows\SysWOW64\Ailjng32.exe C:\Windows\system32\Ailjng32.exe
Source: C:\Windows\SysWOW64\Ailjng32.exe	Process created: C:\Windows\SysWOW64\Ajlfhjbn.exe C:\Windows\system32\Ajlfhjbn.exe
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	Process created: C:\Windows\SysWOW64\Bpkkfq32.exe C:\Windows\system32\Bpkkfq32.exe
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	Process created: C:\Windows\SysWOW64\Bajhpc32.exe C:\Windows\system32\Bajhpc32.exe
Source: C:\Windows\SysWOW64\Bajhpc32.exe	Process created: C:\Windows\SysWOW64\Bdkabo32.exe C:\Windows\system32\Bdkabo32.exe
Source: C:\Windows\SysWOW64\Bdkabo32.exe	Process created: C:\Windows\SysWOW64\Bdnngnpc.exe C:\Windows\system32\Bdnngnpc.exe
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	Process created: C:\Windows\SysWOW64\Baanabom.exe C:\Windows\system32\Baanabom.exe
Source: C:\Windows\SysWOW64\Baanabom.exe	Process created: C:\Windows\SysWOW64\Bmhofc32.exe C:\Windows\system32\Bmhofc32.exe
Source: C:\Windows\SysWOW64\Bmhofc32.exe	Process created: C:\Windows\SysWOW64\Cafglb32.exe C:\Windows\system32\Cafglb32.exe
Source: C:\Windows\SysWOW64\Cafglb32.exe	Process created: C:\Windows\SysWOW64\Cmmhacal.exe C:\Windows\system32\Cmmhacal.exe
Source: C:\Windows\SysWOW64\Cmmhacal.exe	Process created: C:\Windows\SysWOW64\Cmoefb32.exe C:\Windows\system32\Cmoefb32.exe
Source: C:\Windows\SysWOW64\Cmoefb32.exe	Process created: C:\Windows\SysWOW64\Cppnhn32.exe C:\Windows\system32\Cppnhn32.exe
Source: C:\Windows\SysWOW64\Cppnhn32.exe	Process created: C:\Windows\SysWOW64\Dbagjiik.exe C:\Windows\system32\Dbagjiik.exe
Source: C:\Windows\SysWOW64\Dbagjiik.exe	Process created: C:\Windows\SysWOW64\Dmihma32.exe C:\Windows\system32\Dmihma32.exe
Source: C:\Windows\SysWOW64\Dmihma32.exe	Process created: C:\Windows\SysWOW64\Dafpcpme.exe C:\Windows\system32\Dafpcpme.exe
Source: C:\Windows\SysWOW64\Dafpcpme.exe	Process created: C:\Windows\SysWOW64\Dkoele32.exe C:\Windows\system32\Dkoele32.exe
Source: C:\Windows\SysWOW64\Dkoele32.exe	Process created: C:\Windows\SysWOW64\Dcjjpgaa.exe C:\Windows\system32\Dcjjpgaa.exe
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	Process created: C:\Windows\SysWOW64\Ecmfegon.exe C:\Windows\system32\Ecmfegon.exe
Source: C:\Windows\SysWOW64\Ecmfegon.exe	Process created: C:\Windows\SysWOW64\Edlcpjfa.exe C:\Windows\system32\Edlcpjfa.exe
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	Process created: C:\Windows\SysWOW64\Ednpeidn.exe C:\Windows\system32\Ednpeidn.exe
Source: C:\Windows\SysWOW64\Ednpeidn.exe	Process created: C:\Windows\SysWOW64\Edqlki32.exe C:\Windows\system32\Edqlki32.exe
Source: C:\Windows\SysWOW64\Edqlki32.exe	Process created: C:\Windows\SysWOW64\Eniqcohl.exe C:\Windows\system32\Eniqcohl.exe
Source: C:\Windows\SysWOW64\Eniqcohl.exe	Process created: C:\Windows\SysWOW64\Fnkmiofi.exe C:\Windows\system32\Fnkmiofi.exe
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	Process created: C:\Windows\SysWOW64\Fplfki32.exe C:\Windows\system32\Fplfki32.exe
Source: C:\Windows\SysWOW64\Fplfki32.exe	Process created: C:\Windows\SysWOW64\Fghkmc32.exe C:\Windows\system32\Fghkmc32.exe
Source: C:\Windows\SysWOW64\Fghkmc32.exe	Process created: C:\Windows\SysWOW64\Fjidoo32.exe C:\Windows\system32\Fjidoo32.exe
Source: C:\Windows\SysWOW64\Fjidoo32.exe	Process created: C:\Windows\SysWOW64\Gbeekkbb.exe C:\Windows\system32\Gbeekkbb.exe
Source: C:\Windows\SysWOW64\Gbeekkbb.exe	Process created: C:\Windows\SysWOW64\Gqjblggj.exe C:\Windows\system32\Gqjblggj.exe
Source: C:\Windows\SysWOW64\Gqjblggj.exe	Process created: C:\Windows\SysWOW64\Gbjofj32.exe C:\Windows\system32\Gbjofj32.exe
Source: C:\Windows\SysWOW64\Gbjofj32.exe	Process created: C:\Windows\SysWOW64\Gqolgg32.exe C:\Windows\system32\Gqolgg32.exe
Source: C:\Windows\SysWOW64\Gqolgg32.exe	Process created: C:\Windows\SysWOW64\Hbohajjh.exe C:\Windows\system32\Hbohajjh.exe
Source: C:\Windows\SysWOW64\Hbohajjh.exe	Process created: C:\Windows\SysWOW64\Hneifkpl.exe C:\Windows\system32\Hneifkpl.exe
Source: C:\Windows\SysWOW64\Hneifkpl.exe	Process created: C:\Windows\SysWOW64\Hbcbli32.exe C:\Windows\system32\Hbcbli32.exe
Source: C:\Windows\SysWOW64\Hbcbli32.exe	Process created: C:\Windows\SysWOW64\Hjnfqk32.exe C:\Windows\system32\Hjnfqk32.exe
Source: C:\Windows\SysWOW64\Hjnfqk32.exe	Process created: C:\Windows\SysWOW64\Hnlogj32.exe C:\Windows\system32\Hnlogj32.exe
Source: C:\Windows\SysWOW64\Hnlogj32.exe	Process created: C:\Windows\SysWOW64\Iehdic32.exe C:\Windows\system32\Iehdic32.exe
Source: C:\Windows\SysWOW64\Iehdic32.exe	Process created: C:\Windows\SysWOW64\Ibmebh32.exe C:\Windows\system32\Ibmebh32.exe
Source: C:\Windows\SysWOW64\Ibmebh32.exe	Process created: C:\Windows\SysWOW64\Incegidl.exe C:\Windows\system32\Incegidl.exe
Source: C:\Windows\SysWOW64\Incegidl.exe	Process created: C:\Windows\SysWOW64\Ijjfljip.exe C:\Windows\system32\Ijjfljip.exe
Source: C:\Windows\SysWOW64\Ijjfljip.exe	Process created: C:\Windows\SysWOW64\Icbkeo32.exe C:\Windows\system32\Icbkeo32.exe
Source: C:\Windows\SysWOW64\Icbkeo32.exe	Process created: C:\Windows\SysWOW64\Iafkoc32.exe C:\Windows\system32\Iafkoc32.exe
Source: C:\Windows\SysWOW64\Iafkoc32.exe	Process created: C:\Windows\SysWOW64\Jbfgif32.exe C:\Windows\system32\Jbfgif32.exe
Source: C:\Windows\SysWOW64\Jbfgif32.exe	Process created: C:\Windows\SysWOW64\Jbhdnf32.exe C:\Windows\system32\Jbhdnf32.exe
Source: C:\Windows\SysWOW64\Jbhdnf32.exe	Process created: C:\Windows\SysWOW64\Jamaob32.exe C:\Windows\system32\Jamaob32.exe
Source: C:\Windows\SysWOW64\Jamaob32.exe	Process created: C:\Windows\SysWOW64\Jdnjan32.exe C:\Windows\system32\Jdnjan32.exe
Source: C:\Windows\SysWOW64\Jdnjan32.exe	Process created: C:\Windows\SysWOW64\Kenfkq32.exe C:\Windows\system32\Kenfkq32.exe
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Process created: C:\Windows\SysWOW64\Enmknk32.exe C:\Windows\system32\Enmknk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	Process created: C:\Windows\SysWOW64\Fnohck32.exe C:\Windows\system32\Fnohck32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	Process created: C:\Windows\SysWOW64\Fkchmojh.exe C:\Windows\system32\Fkchmojh.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Process created: C:\Windows\SysWOW64\Fekmfd32.exe C:\Windows\system32\Fekmfd32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Process created: C:\Windows\SysWOW64\Foaacm32.exe C:\Windows\system32\Foaacm32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	Process created: C:\Windows\SysWOW64\Fmeamaph.exe C:\Windows\system32\Fmeamaph.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Process created: C:\Windows\SysWOW64\Ffmfeg32.exe C:\Windows\system32\Ffmfeg32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Process created: C:\Windows\SysWOW64\Febcfckp.exe C:\Windows\system32\Febcfckp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	Process created: C:\Windows\SysWOW64\Gbfcph32.exe C:\Windows\system32\Gbfcph32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Process created: C:\Windows\SysWOW64\Gbipeg32.exe C:\Windows\system32\Gbipeg32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Process created: C:\Windows\SysWOW64\Gpmqolfa.exe C:\Windows\system32\Gpmqolfa.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Process created: C:\Windows\SysWOW64\Geiigbeh.exe C:\Windows\system32\Geiigbeh.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Process created: C:\Windows\SysWOW64\Gnbnph32.exe C:\Windows\system32\Gnbnph32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Process created: C:\Windows\SysWOW64\Gpajjk32.exe C:\Windows\system32\Gpajjk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Process created: C:\Windows\SysWOW64\Genbbb32.exe C:\Windows\system32\Genbbb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	Process created: C:\Windows\SysWOW64\Hbbclf32.exe C:\Windows\system32\Hbbclf32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Process created: C:\Windows\SysWOW64\Hpfcejof.exe C:\Windows\system32\Hpfcejof.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Process created: C:\Windows\SysWOW64\Hphpkjlc.exe C:\Windows\system32\Hphpkjlc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Process created: C:\Windows\SysWOW64\Hloapk32.exe C:\Windows\system32\Hloapk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	Process created: C:\Windows\SysWOW64\Iejbnp32.exe C:\Windows\system32\Iejbnp32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Process created: C:\Windows\SysWOW64\Iflknc32.exe C:\Windows\system32\Iflknc32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	Process created: C:\Windows\SysWOW64\Ipdpfhbf.exe C:\Windows\system32\Ipdpfhbf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Process created: C:\Windows\SysWOW64\Ilkpkihj.exe C:\Windows\system32\Ilkpkihj.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Process created: C:\Windows\SysWOW64\Imjmel32.exe C:\Windows\system32\Imjmel32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	Process created: C:\Windows\SysWOW64\Ifcanaen.exe C:\Windows\system32\Ifcanaen.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Process created: C:\Windows\SysWOW64\Jfenda32.exe C:\Windows\system32\Jfenda32.exe
Source: C:\Windows\SysWOW64\Jfenda32.exe	Process created: C:\Windows\SysWOW64\Jopbhd32.exe C:\Windows\system32\Jopbhd32.exe
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Process created: C:\Windows\SysWOW64\Jppobf32.exe C:\Windows\system32\Jppobf32.exe
Source: C:\Windows\SysWOW64\Jppobf32.exe	Process created: C:\Windows\SysWOW64\Jlfpghnm.exe C:\Windows\system32\Jlfpghnm.exe
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Process created: C:\Windows\SysWOW64\Jlimmg32.exe C:\Windows\system32\Jlimmg32.exe
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Process created: C:\Windows\SysWOW64\Kmhigjcm.exe C:\Windows\system32\Kmhigjcm.exe
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Process created: C:\Windows\SysWOW64\Kiojlk32.exe C:\Windows\system32\Kiojlk32.exe
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Process created: C:\Windows\SysWOW64\Kefjql32.exe C:\Windows\system32\Kefjql32.exe
Source: C:\Windows\SysWOW64\Kefjql32.exe	Process created: C:\Windows\SysWOW64\Kgegkoeh.exe C:\Windows\system32\Kgegkoeh.exe
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Process created: C:\Windows\SysWOW64\Kpnkcdli.exe C:\Windows\system32\Kpnkcdli.exe
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Process created: C:\Windows\SysWOW64\Kjfplj32.exe C:\Windows\system32\Kjfplj32.exe
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Process created: C:\Windows\SysWOW64\Ljimbj32.exe C:\Windows\system32\Ljimbj32.exe
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Process created: C:\Windows\SysWOW64\Leomgk32.exe C:\Windows\system32\Leomgk32.exe
Source: C:\Windows\SysWOW64\Leomgk32.exe	Process created: C:\Windows\SysWOW64\Lgojanmn.exe C:\Windows\system32\Lgojanmn.exe
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Process created: C:\Windows\SysWOW64\Lgaffm32.exe C:\Windows\system32\Lgaffm32.exe
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Process created: C:\Windows\SysWOW64\Llnood32.exe C:\Windows\system32\Llnood32.exe
Source: C:\Windows\SysWOW64\Llnood32.exe	Process created: C:\Windows\SysWOW64\Ljbphh32.exe C:\Windows\system32\Ljbphh32.exe
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Process created: C:\Windows\SysWOW64\Mjdlnhfi.exe C:\Windows\system32\Mjdlnhfi.exe
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Process created: C:\Windows\SysWOW64\Mjgichdg.exe C:\Windows\system32\Mjgichdg.exe
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Process created: C:\Windows\SysWOW64\Mjieig32.exe C:\Windows\system32\Mjieig32.exe
Source: C:\Windows\SysWOW64\Mjieig32.exe	Process created: C:\Windows\SysWOW64\Mgmfbl32.exe C:\Windows\system32\Mgmfbl32.exe
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Process created: C:\Windows\SysWOW64\Mohkfn32.exe C:\Windows\system32\Mohkfn32.exe
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Process created: C:\Windows\SysWOW64\Mnikde32.exe C:\Windows\system32\Mnikde32.exe
Source: C:\Windows\SysWOW64\Mnikde32.exe	Process created: C:\Windows\SysWOW64\Njplifll.exe C:\Windows\system32\Njplifll.exe
Source: C:\Windows\SysWOW64\Njplifll.exe	Process created: C:\Windows\SysWOW64\Nchpbl32.exe C:\Windows\system32\Nchpbl32.exe
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Process created: C:\Windows\SysWOW64\Nooagm32.exe C:\Windows\system32\Nooagm32.exe
Source: C:\Windows\SysWOW64\Nooagm32.exe	Process created: C:\Windows\SysWOW64\Nqomappc.exe C:\Windows\system32\Nqomappc.exe
Source: C:\Windows\SysWOW64\Nqomappc.exe	Process created: C:\Windows\SysWOW64\Nmenfa32.exe C:\Windows\system32\Nmenfa32.exe
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Process created: C:\Windows\SysWOW64\Oqcglo32.exe C:\Windows\system32\Oqcglo32.exe
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Process created: C:\Windows\SysWOW64\Ophcmlpf.exe C:\Windows\system32\Ophcmlpf.exe
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Process created: C:\Windows\SysWOW64\Oqhpgogi.exe C:\Windows\system32\Oqhpgogi.exe
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Process created: C:\Windows\SysWOW64\Omoalp32.exe C:\Windows\system32\Omoalp32.exe
Source: C:\Windows\SysWOW64\Omoalp32.exe	Process created: C:\Windows\SysWOW64\Onnmfb32.exe C:\Windows\system32\Onnmfb32.exe
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Process created: C:\Windows\SysWOW64\Onqjlb32.exe C:\Windows\system32\Onqjlb32.exe
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Process created: C:\Windows\SysWOW64\Pjgkac32.exe C:\Windows\system32\Pjgkac32.exe
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Process created: C:\Windows\SysWOW64\Pfnkfdne.exe C:\Windows\system32\Pfnkfdne.exe
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Process created: C:\Windows\SysWOW64\Pfqhkdkc.exe C:\Windows\system32\Pfqhkdkc.exe
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Process created: C:\Windows\SysWOW64\Pfceac32.exe C:\Windows\system32\Pfceac32.exe
Source: C:\Windows\SysWOW64\Pfceac32.exe	Process created: C:\Windows\SysWOW64\Pfeafc32.exe C:\Windows\system32\Pfeafc32.exe
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Process created: C:\Windows\SysWOW64\Qjcjma32.exe C:\Windows\system32\Qjcjma32.exe
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Process created: C:\Windows\SysWOW64\Qhgkff32.exe C:\Windows\system32\Qhgkff32.exe
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Process created: C:\Windows\SysWOW64\Apbpjhji.exe C:\Windows\system32\Apbpjhji.exe
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Process created: C:\Windows\SysWOW64\Aabldk32.exe C:\Windows\system32\Aabldk32.exe
Source: C:\Windows\SysWOW64\Aabldk32.exe	Process created: C:\Windows\SysWOW64\Ajjqmqgl.exe C:\Windows\system32\Ajjqmqgl.exe
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Process created: C:\Windows\SysWOW64\Apgieg32.exe C:\Windows\system32\Apgieg32.exe
Source: C:\Windows\SysWOW64\Apgieg32.exe	Process created: C:\Windows\SysWOW64\Amkiol32.exe C:\Windows\system32\Amkiol32.exe
Source: C:\Windows\SysWOW64\Amkiol32.exe	Process created: C:\Windows\SysWOW64\Ajojhp32.exe C:\Windows\system32\Ajojhp32.exe
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Process created: C:\Windows\SysWOW64\Bombon32.exe C:\Windows\system32\Bombon32.exe
Source: C:\Windows\SysWOW64\Bombon32.exe	Process created: C:\Windows\SysWOW64\Bmbppkoe.exe C:\Windows\system32\Bmbppkoe.exe
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Process created: C:\Windows\SysWOW64\Baphfiel.exe C:\Windows\system32\Baphfiel.exe
Source: C:\Windows\SysWOW64\Baphfiel.exe	Process created: C:\Windows\SysWOW64\Bmgikj32.exe C:\Windows\system32\Bmgikj32.exe
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Process created: C:\Windows\SysWOW64\Badaah32.exe C:\Windows\system32\Badaah32.exe
Source: C:\Windows\SysWOW64\Badaah32.exe	Process created: C:\Windows\SysWOW64\Cohbjm32.exe C:\Windows\system32\Cohbjm32.exe
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Process created: C:\Windows\SysWOW64\Cokoplnm.exe C:\Windows\system32\Cokoplnm.exe
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Process created: C:\Windows\SysWOW64\Cgfcdokh.exe C:\Windows\system32\Cgfcdokh.exe
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Process created: C:\Windows\SysWOW64\Ckdljm32.exe C:\Windows\system32\Ckdljm32.exe
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Process created: C:\Windows\SysWOW64\Chhmdaph.exe C:\Windows\system32\Chhmdaph.exe
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Process created: C:\Windows\SysWOW64\Dhjiianf.exe C:\Windows\system32\Dhjiianf.exe
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Process created: C:\Windows\SysWOW64\Dhmfoq32.exe C:\Windows\system32\Dhmfoq32.exe
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Process created: C:\Windows\SysWOW64\Dhocdp32.exe C:\Windows\system32\Dhocdp32.exe
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Process created: C:\Windows\SysWOW64\Dokhgj32.exe C:\Windows\system32\Dokhgj32.exe
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Process created: C:\Windows\SysWOW64\Dondlj32.exe C:\Windows\system32\Dondlj32.exe
Source: C:\Windows\SysWOW64\Dondlj32.exe	Process created: C:\Windows\SysWOW64\Encamf32.exe C:\Windows\system32\Encamf32.exe
Source: C:\Windows\SysWOW64\Encamf32.exe	Process created: C:\Windows\SysWOW64\Eaqjcdhf.exe C:\Windows\system32\Eaqjcdhf.exe
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Process created: C:\Windows\SysWOW64\Engkhenj.exe C:\Windows\system32\Engkhenj.exe
Source: C:\Windows\SysWOW64\Engkhenj.exe	Process created: C:\Windows\SysWOW64\Eddpko32.exe C:\Windows\system32\Eddpko32.exe
Source: C:\Windows\SysWOW64\Eddpko32.exe	Process created: C:\Windows\SysWOW64\Fqjqpp32.exe C:\Windows\system32\Fqjqpp32.exe
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Process created: C:\Windows\SysWOW64\Fbjmjcpl.exe C:\Windows\system32\Fbjmjcpl.exe
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Process created: C:\Windows\SysWOW64\Fnanodfp.exe C:\Windows\system32\Fnanodfp.exe
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Process created: C:\Windows\SysWOW64\Fopjig32.exe C:\Windows\system32\Fopjig32.exe
Source: C:\Windows\SysWOW64\Fopjig32.exe	Process created: C:\Windows\SysWOW64\Fbacjbjc.exe C:\Windows\system32\Fbacjbjc.exe
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Process created: C:\Windows\SysWOW64\Gqfpko32.exe C:\Windows\system32\Gqfpko32.exe
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Process created: C:\Windows\SysWOW64\Ggbenh32.exe C:\Windows\system32\Ggbenh32.exe
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Process created: C:\Windows\SysWOW64\Gibahklh.exe C:\Windows\system32\Gibahklh.exe
Source: C:\Windows\SysWOW64\Gibahklh.exe	Process created: C:\Windows\SysWOW64\Gidnmk32.exe C:\Windows\system32\Gidnmk32.exe
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Process created: C:\Windows\SysWOW64\Gekobloj.exe C:\Windows\system32\Gekobloj.exe
Source: C:\Windows\SysWOW64\Gekobloj.exe	Process created: C:\Windows\SysWOW64\Hglhdg32.exe C:\Windows\system32\Hglhdg32.exe
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Process created: C:\Windows\SysWOW64\Hkjqjeba.exe C:\Windows\system32\Hkjqjeba.exe
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Process created: C:\Windows\SysWOW64\Hgqaofhe.exe C:\Windows\system32\Hgqaofhe.exe
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Process created: C:\Windows\SysWOW64\Hedahkgo.exe C:\Windows\system32\Hedahkgo.exe
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Process created: C:\Windows\SysWOW64\Hbhbbofi.exe C:\Windows\system32\Hbhbbofi.exe
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Process created: C:\Windows\SysWOW64\Ibkogn32.exe C:\Windows\system32\Ibkogn32.exe
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Process created: C:\Windows\SysWOW64\Inaplpij.exe C:\Windows\system32\Inaplpij.exe
Source: C:\Windows\SysWOW64\Inaplpij.exe	Process created: C:\Windows\SysWOW64\Iiiqoh32.exe C:\Windows\system32\Iiiqoh32.exe
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Process created: C:\Windows\SysWOW64\Ipfeaa32.exe C:\Windows\system32\Ipfeaa32.exe
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Process created: C:\Windows\SysWOW64\Jphbga32.exe C:\Windows\system32\Jphbga32.exe
Source: C:\Windows\SysWOW64\Jphbga32.exe	Process created: C:\Windows\SysWOW64\Jomohnom.exe C:\Windows\system32\Jomohnom.exe
Source: C:\Windows\SysWOW64\Jomohnom.exe	Process created: C:\Windows\SysWOW64\Jpmlbqfp.exe C:\Windows\system32\Jpmlbqfp.exe
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Process created: C:\Windows\SysWOW64\Jlclga32.exe C:\Windows\system32\Jlclga32.exe
Source: C:\Windows\SysWOW64\Jlclga32.exe	Process created: C:\Windows\SysWOW64\Jhjmlb32.exe C:\Windows\system32\Jhjmlb32.exe
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Process created: C:\Windows\SysWOW64\Jacaehhi.exe C:\Windows\system32\Jacaehhi.exe
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Process created: C:\Windows\SysWOW64\Khofgbnc.exe C:\Windows\system32\Khofgbnc.exe
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Process created: C:\Windows\SysWOW64\Khacmalp.exe C:\Windows\system32\Khacmalp.exe
Source: C:\Windows\SysWOW64\Khacmalp.exe	Process created: C:\Windows\SysWOW64\Konhokaj.exe C:\Windows\system32\Konhokaj.exe
Source: C:\Windows\SysWOW64\Konhokaj.exe	Process created: C:\Windows\SysWOW64\Kejmae32.exe C:\Windows\system32\Kejmae32.exe
Source: C:\Windows\SysWOW64\Kejmae32.exe	Process created: C:\Windows\SysWOW64\Lpbndndh.exe C:\Windows\system32\Lpbndndh.exe
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Process created: C:\Windows\SysWOW64\Lcbgfi32.exe C:\Windows\system32\Lcbgfi32.exe
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Process created: C:\Windows\SysWOW64\Lceckh32.exe C:\Windows\system32\Lceckh32.exe
Source: C:\Windows\SysWOW64\Lceckh32.exe	Process created: C:\Windows\SysWOW64\Lcgpahmc.exe C:\Windows\system32\Lcgpahmc.exe
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Process created: C:\Windows\SysWOW64\Mpkajllm.exe C:\Windows\system32\Mpkajllm.exe
Source: C:\Windows\SysWOW64\Mpkajllm.exe	Process created: C:\Windows\SysWOW64\Mhibdn32.exe C:\Windows\system32\Mhibdn32.exe
Source: C:\Windows\SysWOW64\Mhibdn32.exe	Process created: C:\Windows\SysWOW64\Mhkojn32.exe C:\Windows\system32\Mhkojn32.exe
Source: C:\Windows\SysWOW64\Mhkojn32.exe	Process created: C:\Windows\SysWOW64\Mlihpl32.exe C:\Windows\system32\Mlihpl32.exe
Source: C:\Windows\SysWOW64\Mlihpl32.exe	Process created: C:\Windows\SysWOW64\Njoeophq.exe C:\Windows\system32\Njoeophq.exe
Source: C:\Windows\SysWOW64\Njoeophq.exe	Process created: C:\Windows\SysWOW64\Nbkicbfk.exe C:\Windows\system32\Nbkicbfk.exe
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	Process created: C:\Windows\SysWOW64\Nqnfgjlh.exe C:\Windows\system32\Nqnfgjlh.exe
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	Process created: C:\Windows\SysWOW64\Ofmldphm.exe C:\Windows\system32\Ofmldphm.exe
Source: C:\Windows\SysWOW64\Ofmldphm.exe	Process created: C:\Windows\SysWOW64\Ojkdkonc.exe C:\Windows\system32\Ojkdkonc.exe
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	Process created: C:\Windows\SysWOW64\Ojmapnlq.exe C:\Windows\system32\Ojmapnlq.exe
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	Process created: C:\Windows\SysWOW64\Ofdbeobd.exe C:\Windows\system32\Ofdbeobd.exe
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	Process created: C:\Windows\SysWOW64\Offokopb.exe C:\Windows\system32\Offokopb.exe
Source: C:\Windows\SysWOW64\Offokopb.exe	Process created: C:\Windows\SysWOW64\Pfikpo32.exe C:\Windows\system32\Pfikpo32.exe
Source: C:\Windows\SysWOW64\Pfikpo32.exe	Process created: C:\Windows\SysWOW64\Pijdbj32.exe C:\Windows\system32\Pijdbj32.exe
Source: C:\Windows\SysWOW64\Pijdbj32.exe	Process created: C:\Windows\SysWOW64\Pjiqlm32.exe C:\Windows\system32\Pjiqlm32.exe
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	Process created: C:\Windows\SysWOW64\Pbdepo32.exe C:\Windows\system32\Pbdepo32.exe
Source: C:\Windows\SysWOW64\Pbdepo32.exe	Process created: C:\Windows\SysWOW64\Pqhbdf32.exe C:\Windows\system32\Pqhbdf32.exe
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	Process created: C:\Windows\SysWOW64\Qmocigko.exe C:\Windows\system32\Qmocigko.exe
Source: C:\Windows\SysWOW64\Qmocigko.exe	Process created: C:\Windows\SysWOW64\Qiecnhac.exe C:\Windows\system32\Qiecnhac.exe
Source: C:\Windows\SysWOW64\Qiecnhac.exe	Process created: C:\Windows\SysWOW64\Amcldf32.exe C:\Windows\system32\Amcldf32.exe
Source: C:\Windows\SysWOW64\Amcldf32.exe	Process created: C:\Windows\SysWOW64\Ameiifeg.exe C:\Windows\system32\Ameiifeg.exe
Source: C:\Windows\SysWOW64\Ameiifeg.exe	Process created: C:\Windows\SysWOW64\Ailjng32.exe C:\Windows\system32\Ailjng32.exe
Source: C:\Windows\SysWOW64\Ailjng32.exe	Process created: C:\Windows\SysWOW64\Ajlfhjbn.exe C:\Windows\system32\Ajlfhjbn.exe
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	Process created: C:\Windows\SysWOW64\Bpkkfq32.exe C:\Windows\system32\Bpkkfq32.exe
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	Process created: C:\Windows\SysWOW64\Bajhpc32.exe C:\Windows\system32\Bajhpc32.exe
Source: C:\Windows\SysWOW64\Bajhpc32.exe	Process created: C:\Windows\SysWOW64\Bdkabo32.exe C:\Windows\system32\Bdkabo32.exe
Source: C:\Windows\SysWOW64\Bdkabo32.exe	Process created: C:\Windows\SysWOW64\Bdnngnpc.exe C:\Windows\system32\Bdnngnpc.exe
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	Process created: C:\Windows\SysWOW64\Baanabom.exe C:\Windows\system32\Baanabom.exe
Source: C:\Windows\SysWOW64\Baanabom.exe	Process created: C:\Windows\SysWOW64\Bmhofc32.exe C:\Windows\system32\Bmhofc32.exe
Source: C:\Windows\SysWOW64\Bmhofc32.exe	Process created: C:\Windows\SysWOW64\Cafglb32.exe C:\Windows\system32\Cafglb32.exe
Source: C:\Windows\SysWOW64\Cafglb32.exe	Process created: C:\Windows\SysWOW64\Cmmhacal.exe C:\Windows\system32\Cmmhacal.exe
Source: C:\Windows\SysWOW64\Cmmhacal.exe	Process created: C:\Windows\SysWOW64\Cmoefb32.exe C:\Windows\system32\Cmoefb32.exe
Source: C:\Windows\SysWOW64\Cmoefb32.exe	Process created: C:\Windows\SysWOW64\Cppnhn32.exe C:\Windows\system32\Cppnhn32.exe
Source: C:\Windows\SysWOW64\Cppnhn32.exe	Process created: C:\Windows\SysWOW64\Dbagjiik.exe C:\Windows\system32\Dbagjiik.exe
Source: C:\Windows\SysWOW64\Dbagjiik.exe	Process created: C:\Windows\SysWOW64\Dmihma32.exe C:\Windows\system32\Dmihma32.exe
Source: C:\Windows\SysWOW64\Dmihma32.exe	Process created: C:\Windows\SysWOW64\Dafpcpme.exe C:\Windows\system32\Dafpcpme.exe
Source: C:\Windows\SysWOW64\Dafpcpme.exe	Process created: C:\Windows\SysWOW64\Dkoele32.exe C:\Windows\system32\Dkoele32.exe
Source: C:\Windows\SysWOW64\Dkoele32.exe	Process created: C:\Windows\SysWOW64\Dcjjpgaa.exe C:\Windows\system32\Dcjjpgaa.exe
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	Process created: C:\Windows\SysWOW64\Ecmfegon.exe C:\Windows\system32\Ecmfegon.exe
Source: C:\Windows\SysWOW64\Ecmfegon.exe	Process created: C:\Windows\SysWOW64\Edlcpjfa.exe C:\Windows\system32\Edlcpjfa.exe
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	Process created: C:\Windows\SysWOW64\Ednpeidn.exe C:\Windows\system32\Ednpeidn.exe
Source: C:\Windows\SysWOW64\Ednpeidn.exe	Process created: C:\Windows\SysWOW64\Edqlki32.exe C:\Windows\system32\Edqlki32.exe
Source: C:\Windows\SysWOW64\Edqlki32.exe	Process created: C:\Windows\SysWOW64\Eniqcohl.exe C:\Windows\system32\Eniqcohl.exe
Source: C:\Windows\SysWOW64\Eniqcohl.exe	Process created: C:\Windows\SysWOW64\Fnkmiofi.exe C:\Windows\system32\Fnkmiofi.exe
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	Process created: C:\Windows\SysWOW64\Fplfki32.exe C:\Windows\system32\Fplfki32.exe
Source: C:\Windows\SysWOW64\Fplfki32.exe	Process created: C:\Windows\SysWOW64\Fghkmc32.exe C:\Windows\system32\Fghkmc32.exe

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Enmknk32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fnohck32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Foaacm32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Febcfckp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Hloapk32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Iflknc32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Imjmel32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jfenda32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jfenda32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jfenda32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jfenda32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jppobf32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jppobf32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jppobf32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jppobf32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kefjql32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kefjql32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kefjql32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kefjql32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Leomgk32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Leomgk32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Leomgk32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Leomgk32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Llnood32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Llnood32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Llnood32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Llnood32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Mjieig32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Mjieig32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Mjieig32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Mjieig32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Mnikde32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Mnikde32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Mnikde32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Mnikde32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Njplifll.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Njplifll.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Njplifll.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Njplifll.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Nooagm32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Nooagm32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Nooagm32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Nooagm32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Nqomappc.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Nqomappc.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Nqomappc.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Nqomappc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Omoalp32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Omoalp32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Omoalp32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Omoalp32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Pfceac32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Pfceac32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Pfceac32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Pfceac32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Aabldk32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Aabldk32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Aabldk32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Aabldk32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Apgieg32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Apgieg32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Apgieg32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Apgieg32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Amkiol32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Amkiol32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Amkiol32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Amkiol32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Bombon32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Bombon32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Bombon32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Bombon32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Baphfiel.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Baphfiel.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Baphfiel.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Baphfiel.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Badaah32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Badaah32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Badaah32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Badaah32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dondlj32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dondlj32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dondlj32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dondlj32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Encamf32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Encamf32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Encamf32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Encamf32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Engkhenj.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Engkhenj.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Engkhenj.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Engkhenj.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Eddpko32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Eddpko32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Eddpko32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Eddpko32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fopjig32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fopjig32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fopjig32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fopjig32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Gibahklh.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Gibahklh.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Gibahklh.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Gibahklh.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Gekobloj.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Gekobloj.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Gekobloj.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Gekobloj.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Inaplpij.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Inaplpij.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Inaplpij.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Inaplpij.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jphbga32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jphbga32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jphbga32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jphbga32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jomohnom.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jomohnom.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jomohnom.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jomohnom.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jlclga32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jlclga32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jlclga32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jlclga32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Khacmalp.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Khacmalp.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Khacmalp.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Khacmalp.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Konhokaj.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Konhokaj.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Konhokaj.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Konhokaj.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Kejmae32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Kejmae32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Kejmae32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Kejmae32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Lceckh32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Lceckh32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Lceckh32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Lceckh32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Section loaded: ntmarta.dll

Source: initial sample

Static PE information: section where entry point is pointing to: .embm

Source: jQ3NFDayJm	Static PE information: section name: .embm
Source: Enmknk32.exe.0.dr	Static PE information: section name: .embm
Source: Fnohck32.exe.1.dr	Static PE information: section name: .embm
Source: Fkchmojh.exe.2.dr	Static PE information: section name: .embm
Source: Fekmfd32.exe.3.dr	Static PE information: section name: .embm
Source: Foaacm32.exe.5.dr	Static PE information: section name: .embm
Source: Fmeamaph.exe.6.dr	Static PE information: section name: .embm
Source: Ffmfeg32.exe.7.dr	Static PE information: section name: .embm
Source: Febcfckp.exe.8.dr	Static PE information: section name: .embm
Source: Gbfcph32.exe.9.dr	Static PE information: section name: .embm
Source: Gbipeg32.exe.10.dr	Static PE information: section name: .embm
Source: Gpmqolfa.exe.11.dr	Static PE information: section name: .embm
Source: Geiigbeh.exe.12.dr	Static PE information: section name: .embm
Source: Gnbnph32.exe.13.dr	Static PE information: section name: .embm
Source: Gpajjk32.exe.14.dr	Static PE information: section name: .embm
Source: Genbbb32.exe.15.dr	Static PE information: section name: .embm
Source: Hbbclf32.exe.16.dr	Static PE information: section name: .embm
Source: Hpfcejof.exe.17.dr	Static PE information: section name: .embm
Source: Hphpkjlc.exe.18.dr	Static PE information: section name: .embm
Source: Hloapk32.exe.19.dr	Static PE information: section name: .embm
Source: Iejbnp32.exe.20.dr	Static PE information: section name: .embm
Source: Iflknc32.exe.21.dr	Static PE information: section name: .embm
Source: Ipdpfhbf.exe.22.dr	Static PE information: section name: .embm
Source: Ilkpkihj.exe.23.dr	Static PE information: section name: .embm
Source: Imjmel32.exe.24.dr	Static PE information: section name: .embm
Source: Ifcanaen.exe.25.dr	Static PE information: section name: .embm
Source: Jfenda32.exe.26.dr	Static PE information: section name: .embm
Source: Jopbhd32.exe.27.dr	Static PE information: section name: .embm
Source: Jppobf32.exe.28.dr	Static PE information: section name: .embm
Source: Jlfpghnm.exe.29.dr	Static PE information: section name: .embm
Source: Jlimmg32.exe.30.dr	Static PE information: section name: .embm
Source: Kmhigjcm.exe.31.dr	Static PE information: section name: .embm
Source: Kiojlk32.exe.32.dr	Static PE information: section name: .embm
Source: Kefjql32.exe.33.dr	Static PE information: section name: .embm
Source: Kgegkoeh.exe.34.dr	Static PE information: section name: .embm
Source: Kpnkcdli.exe.35.dr	Static PE information: section name: .embm
Source: Kjfplj32.exe.36.dr	Static PE information: section name: .embm
Source: Ljimbj32.exe.38.dr	Static PE information: section name: .embm
Source: Leomgk32.exe.39.dr	Static PE information: section name: .embm
Source: Lgojanmn.exe.40.dr	Static PE information: section name: .embm
Source: Lgaffm32.exe.41.dr	Static PE information: section name: .embm
Source: Llnood32.exe.42.dr	Static PE information: section name: .embm
Source: Ljbphh32.exe.43.dr	Static PE information: section name: .embm
Source: Mjdlnhfi.exe.44.dr	Static PE information: section name: .embm
Source: Mjgichdg.exe.45.dr	Static PE information: section name: .embm
Source: Mjieig32.exe.46.dr	Static PE information: section name: .embm
Source: Mgmfbl32.exe.47.dr	Static PE information: section name: .embm
Source: Mohkfn32.exe.48.dr	Static PE information: section name: .embm
Source: Mnikde32.exe.49.dr	Static PE information: section name: .embm
Source: Njplifll.exe.50.dr	Static PE information: section name: .embm
Source: Nchpbl32.exe.51.dr	Static PE information: section name: .embm
Source: Nooagm32.exe.52.dr	Static PE information: section name: .embm
Source: Nqomappc.exe.53.dr	Static PE information: section name: .embm
Source: Nmenfa32.exe.54.dr	Static PE information: section name: .embm
Source: Oqcglo32.exe.55.dr	Static PE information: section name: .embm
Source: Ophcmlpf.exe.56.dr	Static PE information: section name: .embm
Source: Oqhpgogi.exe.57.dr	Static PE information: section name: .embm
Source: Omoalp32.exe.58.dr	Static PE information: section name: .embm
Source: Onnmfb32.exe.59.dr	Static PE information: section name: .embm
Source: Onqjlb32.exe.60.dr	Static PE information: section name: .embm
Source: Pjgkac32.exe.61.dr	Static PE information: section name: .embm
Source: Pfnkfdne.exe.62.dr	Static PE information: section name: .embm
Source: Pfqhkdkc.exe.63.dr	Static PE information: section name: .embm
Source: Pfceac32.exe.64.dr	Static PE information: section name: .embm
Source: Pfeafc32.exe.65.dr	Static PE information: section name: .embm
Source: Qjcjma32.exe.66.dr	Static PE information: section name: .embm
Source: Qhgkff32.exe.67.dr	Static PE information: section name: .embm
Source: Apbpjhji.exe.68.dr	Static PE information: section name: .embm
Source: Aabldk32.exe.69.dr	Static PE information: section name: .embm
Source: Ajjqmqgl.exe.70.dr	Static PE information: section name: .embm
Source: Apgieg32.exe.71.dr	Static PE information: section name: .embm
Source: Amkiol32.exe.72.dr	Static PE information: section name: .embm
Source: Ajojhp32.exe.73.dr	Static PE information: section name: .embm
Source: Bombon32.exe.74.dr	Static PE information: section name: .embm
Source: Bmbppkoe.exe.75.dr	Static PE information: section name: .embm
Source: Baphfiel.exe.76.dr	Static PE information: section name: .embm
Source: Bmgikj32.exe.77.dr	Static PE information: section name: .embm
Source: Badaah32.exe.78.dr	Static PE information: section name: .embm
Source: Cohbjm32.exe.79.dr	Static PE information: section name: .embm
Source: Cokoplnm.exe.80.dr	Static PE information: section name: .embm
Source: Cgfcdokh.exe.81.dr	Static PE information: section name: .embm
Source: Ckdljm32.exe.82.dr	Static PE information: section name: .embm
Source: Chhmdaph.exe.83.dr	Static PE information: section name: .embm
Source: Dhjiianf.exe.84.dr	Static PE information: section name: .embm

Source: jQ3NFDayJm	Static PE information: section name: .text entropy: 6.967795675976894
Source: Enmknk32.exe.0.dr	Static PE information: section name: .text entropy: 7.0880725316755555
Source: Fnohck32.exe.1.dr	Static PE information: section name: .text entropy: 7.204697784522738
Source: Fkchmojh.exe.2.dr	Static PE information: section name: .text entropy: 7.189205574281606
Source: Fekmfd32.exe.3.dr	Static PE information: section name: .text entropy: 7.184238875284019
Source: Foaacm32.exe.5.dr	Static PE information: section name: .text entropy: 7.135974140163313
Source: Fmeamaph.exe.6.dr	Static PE information: section name: .text entropy: 7.0716217535923525
Source: Ffmfeg32.exe.7.dr	Static PE information: section name: .text entropy: 7.010695943539895
Source: Febcfckp.exe.8.dr	Static PE information: section name: .text entropy: 7.220731641062342
Source: Gbfcph32.exe.9.dr	Static PE information: section name: .text entropy: 7.155772215790841
Source: Gbipeg32.exe.10.dr	Static PE information: section name: .text entropy: 7.100606846841398
Source: Gpmqolfa.exe.11.dr	Static PE information: section name: .text entropy: 7.154707924144056
Source: Geiigbeh.exe.12.dr	Static PE information: section name: .text entropy: 7.2001223765676405
Source: Gnbnph32.exe.13.dr	Static PE information: section name: .text entropy: 7.156794794237128
Source: Gpajjk32.exe.14.dr	Static PE information: section name: .text entropy: 7.184421525399273
Source: Genbbb32.exe.15.dr	Static PE information: section name: .text entropy: 7.17786991562426
Source: Hbbclf32.exe.16.dr	Static PE information: section name: .text entropy: 7.177998388238537
Source: Hpfcejof.exe.17.dr	Static PE information: section name: .text entropy: 7.230380149949785
Source: Hphpkjlc.exe.18.dr	Static PE information: section name: .text entropy: 7.18348958086663
Source: Hloapk32.exe.19.dr	Static PE information: section name: .text entropy: 7.130209325388142
Source: Iejbnp32.exe.20.dr	Static PE information: section name: .text entropy: 7.108291035319974
Source: Iflknc32.exe.21.dr	Static PE information: section name: .text entropy: 7.173336926705286
Source: Ipdpfhbf.exe.22.dr	Static PE information: section name: .text entropy: 7.1360801464761385
Source: Ilkpkihj.exe.23.dr	Static PE information: section name: .text entropy: 7.243940550782323
Source: Imjmel32.exe.24.dr	Static PE information: section name: .text entropy: 7.16704199937331
Source: Ifcanaen.exe.25.dr	Static PE information: section name: .text entropy: 7.134971138222919
Source: Jfenda32.exe.26.dr	Static PE information: section name: .text entropy: 7.1687828613035816
Source: Jopbhd32.exe.27.dr	Static PE information: section name: .text entropy: 6.986096098162108
Source: Jppobf32.exe.28.dr	Static PE information: section name: .text entropy: 7.141626768499709
Source: Jlfpghnm.exe.29.dr	Static PE information: section name: .text entropy: 7.218833873140882
Source: Jlimmg32.exe.30.dr	Static PE information: section name: .text entropy: 7.166871633482736
Source: Kmhigjcm.exe.31.dr	Static PE information: section name: .text entropy: 7.1749907376089075
Source: Kiojlk32.exe.32.dr	Static PE information: section name: .text entropy: 7.136947481095759
Source: Kefjql32.exe.33.dr	Static PE information: section name: .text entropy: 7.194379303198812
Source: Kgegkoeh.exe.34.dr	Static PE information: section name: .text entropy: 7.154514943332378
Source: Kpnkcdli.exe.35.dr	Static PE information: section name: .text entropy: 7.184472278858186
Source: Kjfplj32.exe.36.dr	Static PE information: section name: .text entropy: 7.20481398648761
Source: Ljimbj32.exe.38.dr	Static PE information: section name: .text entropy: 7.171423645288901
Source: Leomgk32.exe.39.dr	Static PE information: section name: .text entropy: 7.112409693971807
Source: Lgojanmn.exe.40.dr	Static PE information: section name: .text entropy: 7.057581126747963
Source: Lgaffm32.exe.41.dr	Static PE information: section name: .text entropy: 7.160037224066742
Source: Llnood32.exe.42.dr	Static PE information: section name: .text entropy: 7.111025978944535
Source: Ljbphh32.exe.43.dr	Static PE information: section name: .text entropy: 7.1737461564992495
Source: Mjdlnhfi.exe.44.dr	Static PE information: section name: .text entropy: 7.153296046248593
Source: Mjgichdg.exe.45.dr	Static PE information: section name: .text entropy: 7.0591683492769235
Source: Mjieig32.exe.46.dr	Static PE information: section name: .text entropy: 7.081682927854323
Source: Mgmfbl32.exe.47.dr	Static PE information: section name: .text entropy: 7.214626498336459
Source: Mohkfn32.exe.48.dr	Static PE information: section name: .text entropy: 7.183704744546774
Source: Mnikde32.exe.49.dr	Static PE information: section name: .text entropy: 7.187027508092678
Source: Njplifll.exe.50.dr	Static PE information: section name: .text entropy: 7.192055798569515
Source: Nchpbl32.exe.51.dr	Static PE information: section name: .text entropy: 7.23525004754913
Source: Nooagm32.exe.52.dr	Static PE information: section name: .text entropy: 7.190698405723743
Source: Nqomappc.exe.53.dr	Static PE information: section name: .text entropy: 7.1460204164625445
Source: Nmenfa32.exe.54.dr	Static PE information: section name: .text entropy: 7.022633190727473
Source: Oqcglo32.exe.55.dr	Static PE information: section name: .text entropy: 6.999308406944921
Source: Ophcmlpf.exe.56.dr	Static PE information: section name: .text entropy: 7.14007589681238
Source: Oqhpgogi.exe.57.dr	Static PE information: section name: .text entropy: 7.154953895704857
Source: Omoalp32.exe.58.dr	Static PE information: section name: .text entropy: 7.169676499383685
Source: Onnmfb32.exe.59.dr	Static PE information: section name: .text entropy: 7.170212873520649
Source: Onqjlb32.exe.60.dr	Static PE information: section name: .text entropy: 7.116386416806007
Source: Pjgkac32.exe.61.dr	Static PE information: section name: .text entropy: 7.1955219885767
Source: Pfnkfdne.exe.62.dr	Static PE information: section name: .text entropy: 7.146895247877552
Source: Pfqhkdkc.exe.63.dr	Static PE information: section name: .text entropy: 7.161467255225603
Source: Pfceac32.exe.64.dr	Static PE information: section name: .text entropy: 7.1494786719792724
Source: Pfeafc32.exe.65.dr	Static PE information: section name: .text entropy: 7.203686485634131
Source: Qjcjma32.exe.66.dr	Static PE information: section name: .text entropy: 7.1508002253519685
Source: Qhgkff32.exe.67.dr	Static PE information: section name: .text entropy: 7.141312070488272
Source: Apbpjhji.exe.68.dr	Static PE information: section name: .text entropy: 7.162149762184501
Source: Aabldk32.exe.69.dr	Static PE information: section name: .text entropy: 7.135942839703284
Source: Ajjqmqgl.exe.70.dr	Static PE information: section name: .text entropy: 7.2158055047526135
Source: Apgieg32.exe.71.dr	Static PE information: section name: .text entropy: 7.174897289453085
Source: Amkiol32.exe.72.dr	Static PE information: section name: .text entropy: 7.166310875061317
Source: Ajojhp32.exe.73.dr	Static PE information: section name: .text entropy: 7.206772116282912
Source: Bombon32.exe.74.dr	Static PE information: section name: .text entropy: 7.127698805125321
Source: Bmbppkoe.exe.75.dr	Static PE information: section name: .text entropy: 7.2047099976093785
Source: Baphfiel.exe.76.dr	Static PE information: section name: .text entropy: 7.153065618640719
Source: Bmgikj32.exe.77.dr	Static PE information: section name: .text entropy: 7.185275526455101
Source: Badaah32.exe.78.dr	Static PE information: section name: .text entropy: 7.151430505816835
Source: Cohbjm32.exe.79.dr	Static PE information: section name: .text entropy: 7.158796189308544
Source: Cokoplnm.exe.80.dr	Static PE information: section name: .text entropy: 7.153909788292788
Source: Cgfcdokh.exe.81.dr	Static PE information: section name: .text entropy: 7.173685316728015
Source: Ckdljm32.exe.82.dr	Static PE information: section name: .text entropy: 7.161158115030997
Source: Chhmdaph.exe.83.dr	Static PE information: section name: .text entropy: 7.125512647320786
Source: Dhjiianf.exe.84.dr	Static PE information: section name: .text entropy: 7.144421430917175

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\Dkoele32.exe	Executable created and started: C:\Windows\SysWOW64\Dcjjpgaa.exe
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Executable created and started: C:\Windows\SysWOW64\Fbjmjcpl.exe
Source: C:\Windows\SysWOW64\Mlihpl32.exe	Executable created and started: C:\Windows\SysWOW64\Njoeophq.exe
Source: C:\Windows\SysWOW64\Nooagm32.exe	Executable created and started: C:\Windows\SysWOW64\Nqomappc.exe
Source: C:\Windows\SysWOW64\Mpkajllm.exe	Executable created and started: C:\Windows\SysWOW64\Mhibdn32.exe
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Executable created and started: C:\Windows\SysWOW64\Pfqhkdkc.exe
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Executable created and started: C:\Windows\SysWOW64\Cokoplnm.exe
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Executable created and started: C:\Windows\SysWOW64\Jfenda32.exe
Source: C:\Windows\SysWOW64\Jomohnom.exe	Executable created and started: C:\Windows\SysWOW64\Jpmlbqfp.exe
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Executable created and started: C:\Windows\SysWOW64\Oqhpgogi.exe
Source: C:\Windows\SysWOW64\Konhokaj.exe	Executable created and started: C:\Windows\SysWOW64\Kejmae32.exe
Source: C:\Windows\SysWOW64\Dondlj32.exe	Executable created and started: C:\Windows\SysWOW64\Encamf32.exe
Source: C:\Windows\SysWOW64\Imjmel32.exe	Executable created and started: C:\Windows\SysWOW64\Ifcanaen.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Executable created and started: C:\Windows\SysWOW64\Chhmdaph.exe
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Executable created and started: C:\Windows\SysWOW64\Hedahkgo.exe
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	Executable created and started: C:\Windows\SysWOW64\Bajhpc32.exe
Source: C:\Windows\SysWOW64\Apgieg32.exe	Executable created and started: C:\Windows\SysWOW64\Amkiol32.exe
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Executable created and started: C:\Windows\SysWOW64\Leomgk32.exe
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	Executable created and started: C:\Windows\SysWOW64\Fplfki32.exe
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Executable created and started: C:\Windows\SysWOW64\Khofgbnc.exe
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Executable created and started: C:\Windows\SysWOW64\Gqfpko32.exe
Source: C:\Windows\SysWOW64\Offokopb.exe	Executable created and started: C:\Windows\SysWOW64\Pfikpo32.exe
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	Executable created and started: C:\Windows\SysWOW64\Baanabom.exe
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Executable created and started: C:\Windows\SysWOW64\Geiigbeh.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Executable created and started: C:\Windows\SysWOW64\Hbhbbofi.exe
Source: C:\Windows\SysWOW64\Baanabom.exe	Executable created and started: C:\Windows\SysWOW64\Bmhofc32.exe
Source: C:\Windows\SysWOW64\Dmihma32.exe	Executable created and started: C:\Windows\SysWOW64\Dafpcpme.exe
Source: C:\Windows\SysWOW64\Llnood32.exe	Executable created and started: C:\Windows\SysWOW64\Ljbphh32.exe
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Executable created and started: C:\Windows\SysWOW64\Ggbenh32.exe
Source: C:\Windows\SysWOW64\Mjieig32.exe	Executable created and started: C:\Windows\SysWOW64\Mgmfbl32.exe
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Executable created and started: C:\Windows\SysWOW64\Ipfeaa32.exe
Source: C:\Windows\SysWOW64\Amcldf32.exe	Executable created and started: C:\Windows\SysWOW64\Ameiifeg.exe
Source: C:\Windows\SysWOW64\Baphfiel.exe	Executable created and started: C:\Windows\SysWOW64\Bmgikj32.exe
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	Executable created and started: C:\Windows\SysWOW64\Pbdepo32.exe
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Executable created and started: C:\Windows\SysWOW64\Pfceac32.exe
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Executable created and started: C:\Windows\SysWOW64\Gpmqolfa.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Executable created and started: C:\Windows\SysWOW64\Lgaffm32.exe
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Executable created and started: C:\Windows\SysWOW64\Ckdljm32.exe
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Executable created and started: C:\Windows\SysWOW64\Ibkogn32.exe
Source: C:\Windows\SysWOW64\Nqomappc.exe	Executable created and started: C:\Windows\SysWOW64\Nmenfa32.exe
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Executable created and started: C:\Windows\SysWOW64\Mjgichdg.exe
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	Executable created and started: C:\Windows\SysWOW64\Qmocigko.exe
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Executable created and started: C:\Windows\SysWOW64\Genbbb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Pbdepo32.exe	Executable created and started: C:\Windows\SysWOW64\Pqhbdf32.exe
Source: C:\Windows\SysWOW64\Ednpeidn.exe	Executable created and started: C:\Windows\SysWOW64\Edqlki32.exe
Source: C:\Windows\SysWOW64\Jlclga32.exe	Executable created and started: C:\Windows\SysWOW64\Jhjmlb32.exe
Source: C:\Windows\SysWOW64\Ailjng32.exe	Executable created and started: C:\Windows\SysWOW64\Ajlfhjbn.exe
Source: C:\Windows\SysWOW64\Omoalp32.exe	Executable created and started: C:\Windows\SysWOW64\Onnmfb32.exe
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Executable created and started: C:\Windows\SysWOW64\Ophcmlpf.exe
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Executable created and started: C:\Windows\SysWOW64\Fopjig32.exe
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Executable created and started: C:\Windows\SysWOW64\Badaah32.exe
Source: C:\Windows\SysWOW64\Eddpko32.exe	Executable created and started: C:\Windows\SysWOW64\Fqjqpp32.exe
Source: C:\Windows\SysWOW64\Cafglb32.exe	Executable created and started: C:\Windows\SysWOW64\Cmmhacal.exe
Source: C:\Windows\SysWOW64\Iflknc32.exe	Executable created and started: C:\Windows\SysWOW64\Ipdpfhbf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Genbbb32.exe	Executable created and started: C:\Windows\SysWOW64\Hbbclf32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ecmfegon.exe	Executable created and started: C:\Windows\SysWOW64\Edlcpjfa.exe
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	Executable created and started: C:\Windows\SysWOW64\Nqnfgjlh.exe
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Executable created and started: C:\Windows\SysWOW64\Fnanodfp.exe
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Executable created and started: C:\Windows\SysWOW64\Gbipeg32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Executable created and started: C:\Windows\SysWOW64\Pfnkfdne.exe
Source: C:\Windows\SysWOW64\Engkhenj.exe	Executable created and started: C:\Windows\SysWOW64\Eddpko32.exe
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Executable created and started: C:\Windows\SysWOW64\Foaacm32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Cmoefb32.exe	Executable created and started: C:\Windows\SysWOW64\Cppnhn32.exe
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Executable created and started: C:\Windows\SysWOW64\Lceckh32.exe
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Executable created and started: C:\Windows\SysWOW64\Mohkfn32.exe
Source: C:\Windows\SysWOW64\Pfikpo32.exe	Executable created and started: C:\Windows\SysWOW64\Pijdbj32.exe
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Executable created and started: C:\Windows\SysWOW64\Kmhigjcm.exe
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Executable created and started: C:\Windows\SysWOW64\Hloapk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Executable created and started: C:\Windows\SysWOW64\Jphbga32.exe
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	Executable created and started: C:\Windows\SysWOW64\Ecmfegon.exe
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Executable created and started: C:\Windows\SysWOW64\Gnbnph32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Executable created and started: C:\Windows\SysWOW64\Hgqaofhe.exe
Source: C:\Windows\SysWOW64\Kefjql32.exe	Executable created and started: C:\Windows\SysWOW64\Kgegkoeh.exe
Source: C:\Windows\SysWOW64\Foaacm32.exe	Executable created and started: C:\Windows\SysWOW64\Fmeamaph.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Executable created and started: C:\Windows\SysWOW64\Dondlj32.exe
Source: C:\Windows\SysWOW64\Pfceac32.exe	Executable created and started: C:\Windows\SysWOW64\Pfeafc32.exe
Source: C:\Windows\SysWOW64\Febcfckp.exe	Executable created and started: C:\Windows\SysWOW64\Gbfcph32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Executable created and started: C:\Windows\SysWOW64\Dhjiianf.exe
Source: C:\Windows\SysWOW64\Badaah32.exe	Executable created and started: C:\Windows\SysWOW64\Cohbjm32.exe
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	Executable created and started: C:\Windows\SysWOW64\Ofmldphm.exe
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Executable created and started: C:\Windows\SysWOW64\Khacmalp.exe
Source: C:\Windows\SysWOW64\Inaplpij.exe	Executable created and started: C:\Windows\SysWOW64\Iiiqoh32.exe
Source: C:\Windows\SysWOW64\Mhkojn32.exe	Executable created and started: C:\Windows\SysWOW64\Mlihpl32.exe
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	Executable created and started: C:\Windows\SysWOW64\Ojmapnlq.exe
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Executable created and started: C:\Windows\SysWOW64\Jlimmg32.exe
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Executable created and started: C:\Windows\SysWOW64\Apbpjhji.exe
Source: C:\Windows\SysWOW64\Dbagjiik.exe	Executable created and started: C:\Windows\SysWOW64\Dmihma32.exe
Source: C:\Windows\SysWOW64\Fnohck32.exe	Executable created and started: C:\Windows\SysWOW64\Fkchmojh.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Executable created and started: C:\Windows\SysWOW64\Oqcglo32.exe
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Executable created and started: C:\Windows\SysWOW64\Mjdlnhfi.exe
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Executable created and started: C:\Windows\SysWOW64\Gpajjk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bdkabo32.exe	Executable created and started: C:\Windows\SysWOW64\Bdnngnpc.exe
Source: C:\Windows\SysWOW64\Mnikde32.exe	Executable created and started: C:\Windows\SysWOW64\Njplifll.exe
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Executable created and started: C:\Windows\SysWOW64\Pjgkac32.exe
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Executable created and started: C:\Windows\SysWOW64\Qhgkff32.exe
Source: C:\Windows\SysWOW64\Bombon32.exe	Executable created and started: C:\Windows\SysWOW64\Bmbppkoe.exe
Source: C:\Windows\SysWOW64\Eniqcohl.exe	Executable created and started: C:\Windows\SysWOW64\Fnkmiofi.exe
Source: C:\Windows\SysWOW64\Aabldk32.exe	Executable created and started: C:\Windows\SysWOW64\Ajjqmqgl.exe
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Executable created and started: C:\Windows\SysWOW64\Gekobloj.exe
Source: C:\Windows\SysWOW64\Qmocigko.exe	Executable created and started: C:\Windows\SysWOW64\Qiecnhac.exe
Source: C:\Windows\SysWOW64\Jphbga32.exe	Executable created and started: C:\Windows\SysWOW64\Jomohnom.exe
Source: C:\Windows\SysWOW64\Bmhofc32.exe	Executable created and started: C:\Windows\SysWOW64\Cafglb32.exe
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Executable created and started: C:\Windows\SysWOW64\Onqjlb32.exe
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Executable created and started: C:\Windows\SysWOW64\Apgieg32.exe
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Executable created and started: C:\Windows\SysWOW64\Inaplpij.exe
Source: C:\Windows\SysWOW64\Enmknk32.exe	Executable created and started: C:\Windows\SysWOW64\Fnohck32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Khacmalp.exe	Executable created and started: C:\Windows\SysWOW64\Konhokaj.exe
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Executable created and started: C:\Windows\SysWOW64\Jacaehhi.exe
Source: C:\Windows\SysWOW64\Qiecnhac.exe	Executable created and started: C:\Windows\SysWOW64\Amcldf32.exe
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Executable created and started: C:\Windows\SysWOW64\Kefjql32.exe
Source: C:\Windows\SysWOW64\Pijdbj32.exe	Executable created and started: C:\Windows\SysWOW64\Pjiqlm32.exe
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Executable created and started: C:\Windows\SysWOW64\Cgfcdokh.exe
Source: C:\Windows\SysWOW64\Amkiol32.exe	Executable created and started: C:\Windows\SysWOW64\Ajojhp32.exe
Source: C:\Windows\SysWOW64\Njplifll.exe	Executable created and started: C:\Windows\SysWOW64\Nchpbl32.exe
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Executable created and started: C:\Windows\SysWOW64\Dhocdp32.exe
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	Executable created and started: C:\Windows\SysWOW64\Ednpeidn.exe
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	Executable created and started: C:\Windows\SysWOW64\Offokopb.exe
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Executable created and started: C:\Windows\SysWOW64\Fekmfd32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Jppobf32.exe	Executable created and started: C:\Windows\SysWOW64\Jlfpghnm.exe
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Executable created and started: C:\Windows\SysWOW64\Ilkpkihj.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Executable created and started: C:\Windows\SysWOW64\Gibahklh.exe
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Executable created and started: C:\Windows\SysWOW64\Enmknk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ameiifeg.exe	Executable created and started: C:\Windows\SysWOW64\Ailjng32.exe
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Executable created and started: C:\Windows\SysWOW64\Dokhgj32.exe
Source: C:\Windows\SysWOW64\Cmmhacal.exe	Executable created and started: C:\Windows\SysWOW64\Cmoefb32.exe
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Executable created and started: C:\Windows\SysWOW64\Engkhenj.exe
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Executable created and started: C:\Windows\SysWOW64\Hpfcejof.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Dafpcpme.exe	Executable created and started: C:\Windows\SysWOW64\Dkoele32.exe
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Executable created and started: C:\Windows\SysWOW64\Qjcjma32.exe
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Executable created and started: C:\Windows\SysWOW64\Kpnkcdli.exe
Source: C:\Windows\SysWOW64\Encamf32.exe	Executable created and started: C:\Windows\SysWOW64\Eaqjcdhf.exe
Source: C:\Windows\SysWOW64\Leomgk32.exe	Executable created and started: C:\Windows\SysWOW64\Lgojanmn.exe
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Executable created and started: C:\Windows\SysWOW64\Mpkajllm.exe
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Executable created and started: C:\Windows\SysWOW64\Kjfplj32.exe
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Executable created and started: C:\Windows\SysWOW64\Jppobf32.exe
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Executable created and started: C:\Windows\SysWOW64\Ffmfeg32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Executable created and started: C:\Windows\SysWOW64\Aabldk32.exe
Source: C:\Windows\SysWOW64\Edqlki32.exe	Executable created and started: C:\Windows\SysWOW64\Eniqcohl.exe
Source: C:\Windows\SysWOW64\Jfenda32.exe	Executable created and started: C:\Windows\SysWOW64\Jopbhd32.exe
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Executable created and started: C:\Windows\SysWOW64\Baphfiel.exe
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Executable created and started: C:\Windows\SysWOW64\Ljimbj32.exe
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	Executable created and started: C:\Windows\SysWOW64\Ofdbeobd.exe
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Executable created and started: C:\Windows\SysWOW64\Kiojlk32.exe
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Executable created and started: C:\Windows\SysWOW64\Imjmel32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	Executable created and started: C:\Windows\SysWOW64\Bpkkfq32.exe
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Executable created and started: C:\Windows\SysWOW64\Iflknc32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Gekobloj.exe	Executable created and started: C:\Windows\SysWOW64\Hglhdg32.exe
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Executable created and started: C:\Windows\SysWOW64\Bombon32.exe
Source: C:\Windows\SysWOW64\Gibahklh.exe	Executable created and started: C:\Windows\SysWOW64\Gidnmk32.exe
Source: C:\Windows\SysWOW64\Hloapk32.exe	Executable created and started: C:\Windows\SysWOW64\Iejbnp32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fopjig32.exe	Executable created and started: C:\Windows\SysWOW64\Fbacjbjc.exe
Source: C:\Windows\SysWOW64\Fplfki32.exe	Executable created and started: C:\Windows\SysWOW64\Fghkmc32.exe
Source: C:\Windows\SysWOW64\Kejmae32.exe	Executable created and started: C:\Windows\SysWOW64\Lpbndndh.exe
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Executable created and started: C:\Windows\SysWOW64\Hphpkjlc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Executable created and started: C:\Windows\SysWOW64\Jlclga32.exe
Source: C:\Windows\SysWOW64\Cppnhn32.exe	Executable created and started: C:\Windows\SysWOW64\Dbagjiik.exe
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Executable created and started: C:\Windows\SysWOW64\Mnikde32.exe
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Executable created and started: C:\Windows\SysWOW64\Mjieig32.exe
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Executable created and started: C:\Windows\SysWOW64\Llnood32.exe
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Executable created and started: C:\Windows\SysWOW64\Lcbgfi32.exe
Source: C:\Windows\SysWOW64\Mhibdn32.exe	Executable created and started: C:\Windows\SysWOW64\Mhkojn32.exe
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Executable created and started: C:\Windows\SysWOW64\Omoalp32.exe
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Executable created and started: C:\Windows\SysWOW64\Febcfckp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ofmldphm.exe	Executable created and started: C:\Windows\SysWOW64\Ojkdkonc.exe
Source: C:\Windows\SysWOW64\Bajhpc32.exe	Executable created and started: C:\Windows\SysWOW64\Bdkabo32.exe
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Executable created and started: C:\Windows\SysWOW64\Dhmfoq32.exe
Source: C:\Windows\SysWOW64\Lceckh32.exe	Executable created and started: C:\Windows\SysWOW64\Lcgpahmc.exe
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Executable created and started: C:\Windows\SysWOW64\Hkjqjeba.exe
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Executable created and started: C:\Windows\SysWOW64\Nooagm32.exe
Source: C:\Windows\SysWOW64\Njoeophq.exe	Executable created and started: C:\Windows\SysWOW64\Nbkicbfk.exe

Source: C:\Windows\SysWOW64\Lgaffm32.exe	File created: C:\Windows\SysWOW64\Njmgoh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbbclf32.exe	File created: C:\Windows\SysWOW64\Dddgooib.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Inaplpij.exe	File created: C:\Windows\SysWOW64\Phhqek32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	File created: C:\Windows\SysWOW64\Gdkolaoq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbfcph32.exe	File created: C:\Windows\SysWOW64\Kfkiao32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	File created: C:\Windows\SysWOW64\Hikbigjf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	File created: C:\Windows\SysWOW64\Akcokgql.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dkoele32.exe	File created: C:\Windows\SysWOW64\Dcjjpgaa.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjieig32.exe	File created: C:\Windows\SysWOW64\Impfdpln.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	File created: C:\Windows\SysWOW64\Qjndnbei.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	File created: C:\Windows\SysWOW64\Fbjmjcpl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mlihpl32.exe	File created: C:\Windows\SysWOW64\Njoeophq.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nooagm32.exe	File created: C:\Windows\SysWOW64\Nqomappc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cokoplnm.exe	File created: C:\Windows\SysWOW64\Lhhhfbih.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mpkajllm.exe	File created: C:\Windows\SysWOW64\Mhibdn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	File created: C:\Windows\SysWOW64\Pfqhkdkc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mlihpl32.exe	File created: C:\Windows\SysWOW64\Dqamkq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cohbjm32.exe	File created: C:\Windows\SysWOW64\Cokoplnm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ifcanaen.exe	File created: C:\Windows\SysWOW64\Jfenda32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmmhacal.exe	File created: C:\Windows\SysWOW64\Ggjbcdlg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jomohnom.exe	File created: C:\Windows\SysWOW64\Jpmlbqfp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	File created: C:\Windows\SysWOW64\Oqhpgogi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlclga32.exe	File created: C:\Windows\SysWOW64\Ecjgjl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ibkogn32.exe	File created: C:\Windows\SysWOW64\Nlfalpdi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	File created: C:\Windows\SysWOW64\Fbjocj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	File created: C:\Windows\SysWOW64\Qoejampk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	File created: C:\Windows\SysWOW64\Bhiabhja.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Konhokaj.exe	File created: C:\Windows\SysWOW64\Kejmae32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dondlj32.exe	File created: C:\Windows\SysWOW64\Encamf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jomohnom.exe	File created: C:\Windows\SysWOW64\Kaigjjqk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kiojlk32.exe	File created: C:\Windows\SysWOW64\Dgibhggn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Imjmel32.exe	File created: C:\Windows\SysWOW64\Ifcanaen.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ckdljm32.exe	File created: C:\Windows\SysWOW64\Chhmdaph.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	File created: C:\Windows\SysWOW64\Hedahkgo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	File created: C:\Windows\SysWOW64\Bajhpc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Apgieg32.exe	File created: C:\Windows\SysWOW64\Amkiol32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljimbj32.exe	File created: C:\Windows\SysWOW64\Leomgk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	File created: C:\Windows\SysWOW64\Cpdhdolk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	File created: C:\Windows\SysWOW64\Fplfki32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Onnmfb32.exe	File created: C:\Windows\SysWOW64\Jmclho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Leomgk32.exe	File created: C:\Windows\SysWOW64\Iciglbko.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jacaehhi.exe	File created: C:\Windows\SysWOW64\Khofgbnc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	File created: C:\Windows\SysWOW64\Jeoqiq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	File created: C:\Windows\SysWOW64\Gqfpko32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Offokopb.exe	File created: C:\Windows\SysWOW64\Pfikpo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	File created: C:\Windows\SysWOW64\Baanabom.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	File created: C:\Windows\SysWOW64\Geiigbeh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hedahkgo.exe	File created: C:\Windows\SysWOW64\Hbhbbofi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Baanabom.exe	File created: C:\Windows\SysWOW64\Bmhofc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njoeophq.exe	File created: C:\Windows\SysWOW64\Kgamdcln.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmihma32.exe	File created: C:\Windows\SysWOW64\Dafpcpme.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	File created: C:\Windows\SysWOW64\Cemjaq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Llnood32.exe	File created: C:\Windows\SysWOW64\Ljbphh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gqfpko32.exe	File created: C:\Windows\SysWOW64\Ggbenh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjieig32.exe	File created: C:\Windows\SysWOW64\Mgmfbl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	File created: C:\Windows\SysWOW64\Ipfeaa32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Baphfiel.exe	File created: C:\Windows\SysWOW64\Oogkej32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amcldf32.exe	File created: C:\Windows\SysWOW64\Ameiifeg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Baphfiel.exe	File created: C:\Windows\SysWOW64\Bmgikj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	File created: C:\Windows\SysWOW64\Kdjdhipm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	File created: C:\Windows\SysWOW64\Pbdepo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmoefb32.exe	File created: C:\Windows\SysWOW64\Epnhmj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	File created: C:\Windows\SysWOW64\Pfceac32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	File created: C:\Windows\SysWOW64\Okbebenm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbipeg32.exe	File created: C:\Windows\SysWOW64\Gpmqolfa.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgojanmn.exe	File created: C:\Windows\SysWOW64\Lgaffm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljbphh32.exe	File created: C:\Windows\SysWOW64\Aelink32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	File created: C:\Windows\SysWOW64\Ckdljm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	File created: C:\Windows\SysWOW64\Lmaaqi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	File created: C:\Windows\SysWOW64\Ibkogn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nooagm32.exe	File created: C:\Windows\SysWOW64\Chbmaj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqomappc.exe	File created: C:\Windows\SysWOW64\Nmenfa32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	File created: C:\Windows\SysWOW64\Mjgichdg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ggbenh32.exe	File created: C:\Windows\SysWOW64\Ejjjedcj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	File created: C:\Windows\SysWOW64\Qmocigko.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmhofc32.exe	File created: C:\Windows\SysWOW64\Pmqiii32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpajjk32.exe	File created: C:\Windows\SysWOW64\Genbbb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	File created: C:\Windows\SysWOW64\Gljedo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ecmfegon.exe	File created: C:\Windows\SysWOW64\Igiglfjj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pbdepo32.exe	File created: C:\Windows\SysWOW64\Pqhbdf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ednpeidn.exe	File created: C:\Windows\SysWOW64\Edqlki32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlclga32.exe	File created: C:\Windows\SysWOW64\Jhjmlb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmihma32.exe	File created: C:\Windows\SysWOW64\Pihcgoep.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ailjng32.exe	File created: C:\Windows\SysWOW64\Ajlfhjbn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Eniqcohl.exe	File created: C:\Windows\SysWOW64\Fifbonoq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Omoalp32.exe	File created: C:\Windows\SysWOW64\Onnmfb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqcglo32.exe	File created: C:\Windows\SysWOW64\Ophcmlpf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnanodfp.exe	File created: C:\Windows\SysWOW64\Fopjig32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmgikj32.exe	File created: C:\Windows\SysWOW64\Badaah32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Eddpko32.exe	File created: C:\Windows\SysWOW64\Fqjqpp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cafglb32.exe	File created: C:\Windows\SysWOW64\Cmmhacal.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cppnhn32.exe	File created: C:\Windows\SysWOW64\Foqfph32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Apgieg32.exe	File created: C:\Windows\SysWOW64\Mmgiocda.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iflknc32.exe	File created: C:\Windows\SysWOW64\Ipdpfhbf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqomappc.exe	File created: C:\Windows\SysWOW64\Mfpeda32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baanabom.exe	File created: C:\Windows\SysWOW64\Beqfpgmi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Genbbb32.exe	File created: C:\Windows\SysWOW64\Hbbclf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dondlj32.exe	File created: C:\Windows\SysWOW64\Clakkf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ecmfegon.exe	File created: C:\Windows\SysWOW64\Edlcpjfa.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	File created: C:\Windows\SysWOW64\Nqnfgjlh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	File created: C:\Windows\SysWOW64\Fnanodfp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bombon32.exe	File created: C:\Windows\SysWOW64\Cccfolfa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	File created: C:\Windows\SysWOW64\Jlnoca32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qhgkff32.exe	File created: C:\Windows\SysWOW64\Inbgmhop.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	File created: C:\Windows\SysWOW64\Magfho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbfcph32.exe	File created: C:\Windows\SysWOW64\Gbipeg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gidnmk32.exe	File created: C:\Windows\SysWOW64\Gmakid32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjgkac32.exe	File created: C:\Windows\SysWOW64\Pfnkfdne.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Engkhenj.exe	File created: C:\Windows\SysWOW64\Eddpko32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	File created: C:\Windows\SysWOW64\Mpahpi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	File created: C:\Windows\SysWOW64\Golngj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Geiigbeh.exe	File created: C:\Windows\SysWOW64\Dnjcfdoi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jppobf32.exe	File created: C:\Windows\SysWOW64\Knggaeba.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cohbjm32.exe	File created: C:\Windows\SysWOW64\Iodlcfjb.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fekmfd32.exe	File created: C:\Windows\SysWOW64\Foaacm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Omoalp32.exe	File created: C:\Windows\SysWOW64\Nnclcm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhkojn32.exe	File created: C:\Windows\SysWOW64\Cbjkoi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Febcfckp.exe	File created: C:\Windows\SysWOW64\Alghniec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	File created: C:\Windows\SysWOW64\Mbpekpdk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	File created: C:\Windows\SysWOW64\Pdhionab.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmoefb32.exe	File created: C:\Windows\SysWOW64\Cppnhn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iflknc32.exe	File created: C:\Windows\SysWOW64\Lpdccbgf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kejmae32.exe	File created: C:\Windows\SysWOW64\Hqcomlbp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	File created: C:\Windows\SysWOW64\Lceckh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	File created: C:\Windows\SysWOW64\Oollcpnc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	File created: C:\Windows\SysWOW64\Mohkfn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ckdljm32.exe	File created: C:\Windows\SysWOW64\Hiolkefh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	File created: C:\Windows\SysWOW64\Efcana32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ameiifeg.exe	File created: C:\Windows\SysWOW64\Knjaiq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljimbj32.exe	File created: C:\Windows\SysWOW64\Jiipjfip.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfikpo32.exe	File created: C:\Windows\SysWOW64\Pijdbj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlimmg32.exe	File created: C:\Windows\SysWOW64\Kmhigjcm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mpkajllm.exe	File created: C:\Windows\SysWOW64\Afkgdh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	File created: C:\Windows\SysWOW64\Eeapjigc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaacm32.exe	File created: C:\Windows\SysWOW64\Njlgcl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jopbhd32.exe	File created: C:\Windows\SysWOW64\Hcddga32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjgichdg.exe	File created: C:\Windows\SysWOW64\Haiooqfk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajojhp32.exe	File created: C:\Windows\SysWOW64\Hmnmcf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	File created: C:\Windows\SysWOW64\Hloapk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lceckh32.exe	File created: C:\Windows\SysWOW64\Aidobh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nmenfa32.exe	File created: C:\Windows\SysWOW64\Glgklpcj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	File created: C:\Windows\SysWOW64\Jphbga32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	File created: C:\Windows\SysWOW64\Ecmfegon.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Geiigbeh.exe	File created: C:\Windows\SysWOW64\Gnbnph32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	File created: C:\Windows\SysWOW64\Hgqaofhe.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kefjql32.exe	File created: C:\Windows\SysWOW64\Kgegkoeh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	File created: C:\Windows\SysWOW64\Hcliif32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaacm32.exe	File created: C:\Windows\SysWOW64\Fmeamaph.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dokhgj32.exe	File created: C:\Windows\SysWOW64\Dondlj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	File created: C:\Windows\SysWOW64\Ipdpiheo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfceac32.exe	File created: C:\Windows\SysWOW64\Pfeafc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hglhdg32.exe	File created: C:\Windows\SysWOW64\Ebgacgaj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbipeg32.exe	File created: C:\Windows\SysWOW64\Cjojjp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onqjlb32.exe	File created: C:\Windows\SysWOW64\Eqacmgol.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hpfcejof.exe	File created: C:\Windows\SysWOW64\Ncafmodl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Febcfckp.exe	File created: C:\Windows\SysWOW64\Gbfcph32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ednpeidn.exe	File created: C:\Windows\SysWOW64\Nggkimpl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fekmfd32.exe	File created: C:\Windows\SysWOW64\Fkoqiobi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Chhmdaph.exe	File created: C:\Windows\SysWOW64\Dhjiianf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhjiianf.exe	File created: C:\Windows\SysWOW64\Fcbfja32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnanodfp.exe	File created: C:\Windows\SysWOW64\Nlfojgba.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	File created: C:\Windows\SysWOW64\Ecllamlh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Badaah32.exe	File created: C:\Windows\SysWOW64\Cohbjm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gekobloj.exe	File created: C:\Windows\SysWOW64\Llbhhh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	File created: C:\Windows\SysWOW64\Ofmldphm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Chhmdaph.exe	File created: C:\Windows\SysWOW64\Bhfgjioo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fmeamaph.exe	File created: C:\Windows\SysWOW64\Iamocmjl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khofgbnc.exe	File created: C:\Windows\SysWOW64\Khacmalp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Inaplpij.exe	File created: C:\Windows\SysWOW64\Iiiqoh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhkojn32.exe	File created: C:\Windows\SysWOW64\Mlihpl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qiecnhac.exe	File created: C:\Windows\SysWOW64\Cmkokg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	File created: C:\Windows\SysWOW64\Lpkigf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	File created: C:\Windows\SysWOW64\Ojmapnlq.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	File created: C:\Windows\SysWOW64\Jlimmg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qhgkff32.exe	File created: C:\Windows\SysWOW64\Apbpjhji.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dbagjiik.exe	File created: C:\Windows\SysWOW64\Dmihma32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Badaah32.exe	File created: C:\Windows\SysWOW64\Kpnojmgp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	File created: C:\Windows\SysWOW64\Ohblco32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnohck32.exe	File created: C:\Windows\SysWOW64\Fkchmojh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nmenfa32.exe	File created: C:\Windows\SysWOW64\Oqcglo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljbphh32.exe	File created: C:\Windows\SysWOW64\Mjdlnhfi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhibdn32.exe	File created: C:\Windows\SysWOW64\Heblggpd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gnbnph32.exe	File created: C:\Windows\SysWOW64\Gpajjk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	File created: C:\Windows\SysWOW64\Hgpoon32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Offokopb.exe	File created: C:\Windows\SysWOW64\Lgbpdadc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eddpko32.exe	File created: C:\Windows\SysWOW64\Giommjni.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdkabo32.exe	File created: C:\Windows\SysWOW64\Bdnngnpc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mnikde32.exe	File created: C:\Windows\SysWOW64\Njplifll.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	File created: C:\Windows\SysWOW64\Oqkkln32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gqfpko32.exe	File created: C:\Windows\SysWOW64\Majppnhp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpajjk32.exe	File created: C:\Windows\SysWOW64\Domiglci.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onqjlb32.exe	File created: C:\Windows\SysWOW64\Pjgkac32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	File created: C:\Windows\SysWOW64\Ibphfofn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qjcjma32.exe	File created: C:\Windows\SysWOW64\Qhgkff32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bombon32.exe	File created: C:\Windows\SysWOW64\Bmbppkoe.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkchmojh.exe	File created: C:\Windows\SysWOW64\Kjkggl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eniqcohl.exe	File created: C:\Windows\SysWOW64\Fnkmiofi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Aabldk32.exe	File created: C:\Windows\SysWOW64\Ajjqmqgl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gidnmk32.exe	File created: C:\Windows\SysWOW64\Gekobloj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qmocigko.exe	File created: C:\Windows\SysWOW64\Qiecnhac.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cafglb32.exe	File created: C:\Windows\SysWOW64\Ppcqpc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	File created: C:\Windows\SysWOW64\Ddnmejkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jphbga32.exe	File created: C:\Windows\SysWOW64\Jomohnom.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmhofc32.exe	File created: C:\Windows\SysWOW64\Cafglb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Onnmfb32.exe	File created: C:\Windows\SysWOW64\Onqjlb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	File created: C:\Windows\SysWOW64\Apgieg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ibkogn32.exe	File created: C:\Windows\SysWOW64\Inaplpij.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jacaehhi.exe	File created: C:\Windows\SysWOW64\Mafkbeoj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	File created: C:\Windows\SysWOW64\Fdldjhaq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Enmknk32.exe	File created: C:\Windows\SysWOW64\Fnohck32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjgkac32.exe	File created: C:\Windows\SysWOW64\Dodmipcd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khacmalp.exe	File created: C:\Windows\SysWOW64\Konhokaj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dkoele32.exe	File created: C:\Windows\SysWOW64\Fflljpnc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqcglo32.exe	File created: C:\Windows\SysWOW64\Dbhphf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	File created: C:\Windows\SysWOW64\Jacaehhi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Khacmalp.exe	File created: C:\Windows\SysWOW64\Mdfpjg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pbdepo32.exe	File created: C:\Windows\SysWOW64\Obgbhn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qiecnhac.exe	File created: C:\Windows\SysWOW64\Amcldf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kiojlk32.exe	File created: C:\Windows\SysWOW64\Kefjql32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pijdbj32.exe	File created: C:\Windows\SysWOW64\Pjiqlm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	File created: C:\Windows\SysWOW64\Ecglja32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Konhokaj.exe	File created: C:\Windows\SysWOW64\Iibphp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Genbbb32.exe	File created: C:\Windows\SysWOW64\Mejcahjf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qmocigko.exe	File created: C:\Windows\SysWOW64\Hchcho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cokoplnm.exe	File created: C:\Windows\SysWOW64\Cgfcdokh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Encamf32.exe	File created: C:\Windows\SysWOW64\Aefbqf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amkiol32.exe	File created: C:\Windows\SysWOW64\Ajojhp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njplifll.exe	File created: C:\Windows\SysWOW64\Nchpbl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	File created: C:\Windows\SysWOW64\Dhocdp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	File created: C:\Windows\SysWOW64\Ednpeidn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Imjmel32.exe	File created: C:\Windows\SysWOW64\Nnpajnal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fopjig32.exe	File created: C:\Windows\SysWOW64\Ffchlo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qjcjma32.exe	File created: C:\Windows\SysWOW64\Fnjcoo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdkabo32.exe	File created: C:\Windows\SysWOW64\Cgbcokgg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	File created: C:\Windows\SysWOW64\Offokopb.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkchmojh.exe	File created: C:\Windows\SysWOW64\Fekmfd32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ifcanaen.exe	File created: C:\Windows\SysWOW64\Docmmc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gibahklh.exe	File created: C:\Windows\SysWOW64\Khmhlo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jppobf32.exe	File created: C:\Windows\SysWOW64\Jlfpghnm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	File created: C:\Windows\SysWOW64\Jfebge32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	File created: C:\Windows\SysWOW64\Lecjmhnq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	File created: C:\Windows\SysWOW64\Hkkoqdmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	File created: C:\Windows\SysWOW64\Ilkpkihj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ggbenh32.exe	File created: C:\Windows\SysWOW64\Gibahklh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlimmg32.exe	File created: C:\Windows\SysWOW64\Ieiomg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gnbnph32.exe	File created: C:\Windows\SysWOW64\Giamobql.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Enmknk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mohkfn32.exe	File created: C:\Windows\SysWOW64\Ingcjaio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ameiifeg.exe	File created: C:\Windows\SysWOW64\Ailjng32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kjfplj32.exe	File created: C:\Windows\SysWOW64\Heaepkaj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhocdp32.exe	File created: C:\Windows\SysWOW64\Dokhgj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	File created: C:\Windows\SysWOW64\Lmolop32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jfenda32.exe	File created: C:\Windows\SysWOW64\Ipoden32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Llnood32.exe	File created: C:\Windows\SysWOW64\Aljbfgpf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmmhacal.exe	File created: C:\Windows\SysWOW64\Cmoefb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ailjng32.exe	File created: C:\Windows\SysWOW64\Cbaabn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	File created: C:\Windows\SysWOW64\Engkhenj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbbclf32.exe	File created: C:\Windows\SysWOW64\Hpfcejof.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mnikde32.exe	File created: C:\Windows\SysWOW64\Nhljaibo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edqlki32.exe	File created: C:\Windows\SysWOW64\Cqeolm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hloapk32.exe	File created: C:\Windows\SysWOW64\Kcamoc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dafpcpme.exe	File created: C:\Windows\SysWOW64\Dkoele32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfeafc32.exe	File created: C:\Windows\SysWOW64\Qjcjma32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfceac32.exe	File created: C:\Windows\SysWOW64\Jmcpkl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	File created: C:\Windows\SysWOW64\Kpnkcdli.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	File created: C:\Windows\SysWOW64\Glgafh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	File created: C:\Windows\SysWOW64\Hoeiflna.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	File created: C:\Windows\SysWOW64\Kilkncaa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Encamf32.exe	File created: C:\Windows\SysWOW64\Eaqjcdhf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Aabldk32.exe	File created: C:\Windows\SysWOW64\Hfplhlei.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khofgbnc.exe	File created: C:\Windows\SysWOW64\Lbjkckae.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Gopkbc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Leomgk32.exe	File created: C:\Windows\SysWOW64\Lgojanmn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	File created: C:\Windows\SysWOW64\Mpkajllm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	File created: C:\Windows\SysWOW64\Kjfplj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lpbndndh.exe	File created: C:\Windows\SysWOW64\Dkbmhf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jopbhd32.exe	File created: C:\Windows\SysWOW64\Jppobf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nchpbl32.exe	File created: C:\Windows\SysWOW64\Homjaafk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fmeamaph.exe	File created: C:\Windows\SysWOW64\Ffmfeg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Apbpjhji.exe	File created: C:\Windows\SysWOW64\Aabldk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dokhgj32.exe	File created: C:\Windows\SysWOW64\Jiceolni.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Engkhenj.exe	File created: C:\Windows\SysWOW64\Jofjci32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmldphm.exe	File created: C:\Windows\SysWOW64\Pidiop32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Enmknk32.exe	File created: C:\Windows\SysWOW64\Jjhmem32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edqlki32.exe	File created: C:\Windows\SysWOW64\Eniqcohl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	File created: C:\Windows\SysWOW64\Nfghhi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dbagjiik.exe	File created: C:\Windows\SysWOW64\Bccbfjkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amcldf32.exe	File created: C:\Windows\SysWOW64\Ndkkoc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgojanmn.exe	File created: C:\Windows\SysWOW64\Fjpdni32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jfenda32.exe	File created: C:\Windows\SysWOW64\Jopbhd32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	File created: C:\Windows\SysWOW64\Baphfiel.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhocdp32.exe	File created: C:\Windows\SysWOW64\Imdckjjd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kjfplj32.exe	File created: C:\Windows\SysWOW64\Ljimbj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	File created: C:\Windows\SysWOW64\Gllhcm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	File created: C:\Windows\SysWOW64\Ofdbeobd.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	File created: C:\Windows\SysWOW64\Kiojlk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kefjql32.exe	File created: C:\Windows\SysWOW64\Hppahlmk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	File created: C:\Windows\SysWOW64\Imjmel32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	File created: C:\Windows\SysWOW64\Bpkkfq32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iejbnp32.exe	File created: C:\Windows\SysWOW64\Iflknc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bajhpc32.exe	File created: C:\Windows\SysWOW64\Ikdhblhl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amkiol32.exe	File created: C:\Windows\SysWOW64\Pdlope32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gekobloj.exe	File created: C:\Windows\SysWOW64\Hglhdg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	File created: C:\Windows\SysWOW64\Hdnaik32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajojhp32.exe	File created: C:\Windows\SysWOW64\Bombon32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gibahklh.exe	File created: C:\Windows\SysWOW64\Gidnmk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnohck32.exe	File created: C:\Windows\SysWOW64\Kiolqecl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pijdbj32.exe	File created: C:\Windows\SysWOW64\Hfknhcaf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hloapk32.exe	File created: C:\Windows\SysWOW64\Iejbnp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njplifll.exe	File created: C:\Windows\SysWOW64\Ajjjec32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	File created: C:\Windows\SysWOW64\Chjnlmda.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fopjig32.exe	File created: C:\Windows\SysWOW64\Fbacjbjc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kejmae32.exe	File created: C:\Windows\SysWOW64\Lpbndndh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hpfcejof.exe	File created: C:\Windows\SysWOW64\Hphpkjlc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	File created: C:\Windows\SysWOW64\Jlclga32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hedahkgo.exe	File created: C:\Windows\SysWOW64\Gjhongok.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cppnhn32.exe	File created: C:\Windows\SysWOW64\Dbagjiik.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mohkfn32.exe	File created: C:\Windows\SysWOW64\Mnikde32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jphbga32.exe	File created: C:\Windows\SysWOW64\Mhoflbja.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjgichdg.exe	File created: C:\Windows\SysWOW64\Mjieig32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dafpcpme.exe	File created: C:\Windows\SysWOW64\Hjfniidf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgaffm32.exe	File created: C:\Windows\SysWOW64\Llnood32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lpbndndh.exe	File created: C:\Windows\SysWOW64\Lcbgfi32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfeafc32.exe	File created: C:\Windows\SysWOW64\Qappag32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhibdn32.exe	File created: C:\Windows\SysWOW64\Mhkojn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Apbpjhji.exe	File created: C:\Windows\SysWOW64\Ekifajpc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmgikj32.exe	File created: C:\Windows\SysWOW64\Galjgp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	File created: C:\Windows\SysWOW64\Omoalp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	File created: C:\Windows\SysWOW64\Febcfckp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmldphm.exe	File created: C:\Windows\SysWOW64\Ojkdkonc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfikpo32.exe	File created: C:\Windows\SysWOW64\Lpgaep32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bajhpc32.exe	File created: C:\Windows\SysWOW64\Bdkabo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhjiianf.exe	File created: C:\Windows\SysWOW64\Dhmfoq32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lceckh32.exe	File created: C:\Windows\SysWOW64\Lcgpahmc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hglhdg32.exe	File created: C:\Windows\SysWOW64\Hkjqjeba.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iejbnp32.exe	File created: C:\Windows\SysWOW64\Gchqcf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nchpbl32.exe	File created: C:\Windows\SysWOW64\Nooagm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njoeophq.exe	File created: C:\Windows\SysWOW64\Nbkicbfk.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\Lgaffm32.exe	File created: C:\Windows\SysWOW64\Njmgoh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbbclf32.exe	File created: C:\Windows\SysWOW64\Dddgooib.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Inaplpij.exe	File created: C:\Windows\SysWOW64\Phhqek32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	File created: C:\Windows\SysWOW64\Gdkolaoq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbfcph32.exe	File created: C:\Windows\SysWOW64\Kfkiao32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	File created: C:\Windows\SysWOW64\Hikbigjf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	File created: C:\Windows\SysWOW64\Akcokgql.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dkoele32.exe	File created: C:\Windows\SysWOW64\Dcjjpgaa.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjieig32.exe	File created: C:\Windows\SysWOW64\Impfdpln.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	File created: C:\Windows\SysWOW64\Qjndnbei.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	File created: C:\Windows\SysWOW64\Fbjmjcpl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mlihpl32.exe	File created: C:\Windows\SysWOW64\Njoeophq.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nooagm32.exe	File created: C:\Windows\SysWOW64\Nqomappc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cokoplnm.exe	File created: C:\Windows\SysWOW64\Lhhhfbih.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mpkajllm.exe	File created: C:\Windows\SysWOW64\Mhibdn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	File created: C:\Windows\SysWOW64\Pfqhkdkc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mlihpl32.exe	File created: C:\Windows\SysWOW64\Dqamkq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cohbjm32.exe	File created: C:\Windows\SysWOW64\Cokoplnm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ifcanaen.exe	File created: C:\Windows\SysWOW64\Jfenda32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmmhacal.exe	File created: C:\Windows\SysWOW64\Ggjbcdlg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jomohnom.exe	File created: C:\Windows\SysWOW64\Jpmlbqfp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	File created: C:\Windows\SysWOW64\Oqhpgogi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlclga32.exe	File created: C:\Windows\SysWOW64\Ecjgjl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ibkogn32.exe	File created: C:\Windows\SysWOW64\Nlfalpdi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	File created: C:\Windows\SysWOW64\Fbjocj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	File created: C:\Windows\SysWOW64\Qoejampk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	File created: C:\Windows\SysWOW64\Bhiabhja.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Konhokaj.exe	File created: C:\Windows\SysWOW64\Kejmae32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dondlj32.exe	File created: C:\Windows\SysWOW64\Encamf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jomohnom.exe	File created: C:\Windows\SysWOW64\Kaigjjqk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kiojlk32.exe	File created: C:\Windows\SysWOW64\Dgibhggn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Imjmel32.exe	File created: C:\Windows\SysWOW64\Ifcanaen.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ckdljm32.exe	File created: C:\Windows\SysWOW64\Chhmdaph.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	File created: C:\Windows\SysWOW64\Hedahkgo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	File created: C:\Windows\SysWOW64\Bajhpc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Apgieg32.exe	File created: C:\Windows\SysWOW64\Amkiol32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljimbj32.exe	File created: C:\Windows\SysWOW64\Leomgk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	File created: C:\Windows\SysWOW64\Cpdhdolk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	File created: C:\Windows\SysWOW64\Fplfki32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Onnmfb32.exe	File created: C:\Windows\SysWOW64\Jmclho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Leomgk32.exe	File created: C:\Windows\SysWOW64\Iciglbko.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jacaehhi.exe	File created: C:\Windows\SysWOW64\Khofgbnc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	File created: C:\Windows\SysWOW64\Jeoqiq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	File created: C:\Windows\SysWOW64\Gqfpko32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Offokopb.exe	File created: C:\Windows\SysWOW64\Pfikpo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	File created: C:\Windows\SysWOW64\Baanabom.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	File created: C:\Windows\SysWOW64\Geiigbeh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hedahkgo.exe	File created: C:\Windows\SysWOW64\Hbhbbofi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Baanabom.exe	File created: C:\Windows\SysWOW64\Bmhofc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njoeophq.exe	File created: C:\Windows\SysWOW64\Kgamdcln.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmihma32.exe	File created: C:\Windows\SysWOW64\Dafpcpme.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	File created: C:\Windows\SysWOW64\Cemjaq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Llnood32.exe	File created: C:\Windows\SysWOW64\Ljbphh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gqfpko32.exe	File created: C:\Windows\SysWOW64\Ggbenh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjieig32.exe	File created: C:\Windows\SysWOW64\Mgmfbl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	File created: C:\Windows\SysWOW64\Ipfeaa32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Baphfiel.exe	File created: C:\Windows\SysWOW64\Oogkej32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amcldf32.exe	File created: C:\Windows\SysWOW64\Ameiifeg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Baphfiel.exe	File created: C:\Windows\SysWOW64\Bmgikj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	File created: C:\Windows\SysWOW64\Kdjdhipm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	File created: C:\Windows\SysWOW64\Pbdepo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmoefb32.exe	File created: C:\Windows\SysWOW64\Epnhmj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	File created: C:\Windows\SysWOW64\Pfceac32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	File created: C:\Windows\SysWOW64\Okbebenm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbipeg32.exe	File created: C:\Windows\SysWOW64\Gpmqolfa.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgojanmn.exe	File created: C:\Windows\SysWOW64\Lgaffm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljbphh32.exe	File created: C:\Windows\SysWOW64\Aelink32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	File created: C:\Windows\SysWOW64\Ckdljm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	File created: C:\Windows\SysWOW64\Lmaaqi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	File created: C:\Windows\SysWOW64\Ibkogn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nooagm32.exe	File created: C:\Windows\SysWOW64\Chbmaj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqomappc.exe	File created: C:\Windows\SysWOW64\Nmenfa32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	File created: C:\Windows\SysWOW64\Mjgichdg.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ggbenh32.exe	File created: C:\Windows\SysWOW64\Ejjjedcj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	File created: C:\Windows\SysWOW64\Qmocigko.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmhofc32.exe	File created: C:\Windows\SysWOW64\Pmqiii32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpajjk32.exe	File created: C:\Windows\SysWOW64\Genbbb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	File created: C:\Windows\SysWOW64\Gljedo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ecmfegon.exe	File created: C:\Windows\SysWOW64\Igiglfjj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pbdepo32.exe	File created: C:\Windows\SysWOW64\Pqhbdf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ednpeidn.exe	File created: C:\Windows\SysWOW64\Edqlki32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlclga32.exe	File created: C:\Windows\SysWOW64\Jhjmlb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmihma32.exe	File created: C:\Windows\SysWOW64\Pihcgoep.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ailjng32.exe	File created: C:\Windows\SysWOW64\Ajlfhjbn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Eniqcohl.exe	File created: C:\Windows\SysWOW64\Fifbonoq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Omoalp32.exe	File created: C:\Windows\SysWOW64\Onnmfb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqcglo32.exe	File created: C:\Windows\SysWOW64\Ophcmlpf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnanodfp.exe	File created: C:\Windows\SysWOW64\Fopjig32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmgikj32.exe	File created: C:\Windows\SysWOW64\Badaah32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Eddpko32.exe	File created: C:\Windows\SysWOW64\Fqjqpp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cafglb32.exe	File created: C:\Windows\SysWOW64\Cmmhacal.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cppnhn32.exe	File created: C:\Windows\SysWOW64\Foqfph32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Apgieg32.exe	File created: C:\Windows\SysWOW64\Mmgiocda.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iflknc32.exe	File created: C:\Windows\SysWOW64\Ipdpfhbf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqomappc.exe	File created: C:\Windows\SysWOW64\Mfpeda32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baanabom.exe	File created: C:\Windows\SysWOW64\Beqfpgmi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Genbbb32.exe	File created: C:\Windows\SysWOW64\Hbbclf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dondlj32.exe	File created: C:\Windows\SysWOW64\Clakkf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ecmfegon.exe	File created: C:\Windows\SysWOW64\Edlcpjfa.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	File created: C:\Windows\SysWOW64\Nqnfgjlh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	File created: C:\Windows\SysWOW64\Fnanodfp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bombon32.exe	File created: C:\Windows\SysWOW64\Cccfolfa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	File created: C:\Windows\SysWOW64\Jlnoca32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qhgkff32.exe	File created: C:\Windows\SysWOW64\Inbgmhop.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	File created: C:\Windows\SysWOW64\Magfho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbfcph32.exe	File created: C:\Windows\SysWOW64\Gbipeg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gidnmk32.exe	File created: C:\Windows\SysWOW64\Gmakid32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjgkac32.exe	File created: C:\Windows\SysWOW64\Pfnkfdne.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Engkhenj.exe	File created: C:\Windows\SysWOW64\Eddpko32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	File created: C:\Windows\SysWOW64\Mpahpi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	File created: C:\Windows\SysWOW64\Golngj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Geiigbeh.exe	File created: C:\Windows\SysWOW64\Dnjcfdoi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jppobf32.exe	File created: C:\Windows\SysWOW64\Knggaeba.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cohbjm32.exe	File created: C:\Windows\SysWOW64\Iodlcfjb.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fekmfd32.exe	File created: C:\Windows\SysWOW64\Foaacm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Omoalp32.exe	File created: C:\Windows\SysWOW64\Nnclcm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhkojn32.exe	File created: C:\Windows\SysWOW64\Cbjkoi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Febcfckp.exe	File created: C:\Windows\SysWOW64\Alghniec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	File created: C:\Windows\SysWOW64\Mbpekpdk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	File created: C:\Windows\SysWOW64\Pdhionab.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmoefb32.exe	File created: C:\Windows\SysWOW64\Cppnhn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iflknc32.exe	File created: C:\Windows\SysWOW64\Lpdccbgf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kejmae32.exe	File created: C:\Windows\SysWOW64\Hqcomlbp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	File created: C:\Windows\SysWOW64\Lceckh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	File created: C:\Windows\SysWOW64\Oollcpnc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	File created: C:\Windows\SysWOW64\Mohkfn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ckdljm32.exe	File created: C:\Windows\SysWOW64\Hiolkefh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	File created: C:\Windows\SysWOW64\Efcana32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ameiifeg.exe	File created: C:\Windows\SysWOW64\Knjaiq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljimbj32.exe	File created: C:\Windows\SysWOW64\Jiipjfip.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfikpo32.exe	File created: C:\Windows\SysWOW64\Pijdbj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlimmg32.exe	File created: C:\Windows\SysWOW64\Kmhigjcm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mpkajllm.exe	File created: C:\Windows\SysWOW64\Afkgdh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	File created: C:\Windows\SysWOW64\Eeapjigc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaacm32.exe	File created: C:\Windows\SysWOW64\Njlgcl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jopbhd32.exe	File created: C:\Windows\SysWOW64\Hcddga32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjgichdg.exe	File created: C:\Windows\SysWOW64\Haiooqfk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajojhp32.exe	File created: C:\Windows\SysWOW64\Hmnmcf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	File created: C:\Windows\SysWOW64\Hloapk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lceckh32.exe	File created: C:\Windows\SysWOW64\Aidobh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nmenfa32.exe	File created: C:\Windows\SysWOW64\Glgklpcj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	File created: C:\Windows\SysWOW64\Jphbga32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	File created: C:\Windows\SysWOW64\Ecmfegon.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Geiigbeh.exe	File created: C:\Windows\SysWOW64\Gnbnph32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	File created: C:\Windows\SysWOW64\Hgqaofhe.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kefjql32.exe	File created: C:\Windows\SysWOW64\Kgegkoeh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	File created: C:\Windows\SysWOW64\Hcliif32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaacm32.exe	File created: C:\Windows\SysWOW64\Fmeamaph.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dokhgj32.exe	File created: C:\Windows\SysWOW64\Dondlj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	File created: C:\Windows\SysWOW64\Ipdpiheo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfceac32.exe	File created: C:\Windows\SysWOW64\Pfeafc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hglhdg32.exe	File created: C:\Windows\SysWOW64\Ebgacgaj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbipeg32.exe	File created: C:\Windows\SysWOW64\Cjojjp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onqjlb32.exe	File created: C:\Windows\SysWOW64\Eqacmgol.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hpfcejof.exe	File created: C:\Windows\SysWOW64\Ncafmodl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Febcfckp.exe	File created: C:\Windows\SysWOW64\Gbfcph32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ednpeidn.exe	File created: C:\Windows\SysWOW64\Nggkimpl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fekmfd32.exe	File created: C:\Windows\SysWOW64\Fkoqiobi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Chhmdaph.exe	File created: C:\Windows\SysWOW64\Dhjiianf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhjiianf.exe	File created: C:\Windows\SysWOW64\Fcbfja32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnanodfp.exe	File created: C:\Windows\SysWOW64\Nlfojgba.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	File created: C:\Windows\SysWOW64\Ecllamlh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Badaah32.exe	File created: C:\Windows\SysWOW64\Cohbjm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gekobloj.exe	File created: C:\Windows\SysWOW64\Llbhhh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	File created: C:\Windows\SysWOW64\Ofmldphm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Chhmdaph.exe	File created: C:\Windows\SysWOW64\Bhfgjioo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fmeamaph.exe	File created: C:\Windows\SysWOW64\Iamocmjl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khofgbnc.exe	File created: C:\Windows\SysWOW64\Khacmalp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Inaplpij.exe	File created: C:\Windows\SysWOW64\Iiiqoh32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhkojn32.exe	File created: C:\Windows\SysWOW64\Mlihpl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qiecnhac.exe	File created: C:\Windows\SysWOW64\Cmkokg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	File created: C:\Windows\SysWOW64\Lpkigf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojkdkonc.exe	File created: C:\Windows\SysWOW64\Ojmapnlq.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	File created: C:\Windows\SysWOW64\Jlimmg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qhgkff32.exe	File created: C:\Windows\SysWOW64\Apbpjhji.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dbagjiik.exe	File created: C:\Windows\SysWOW64\Dmihma32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Badaah32.exe	File created: C:\Windows\SysWOW64\Kpnojmgp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	File created: C:\Windows\SysWOW64\Ohblco32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnohck32.exe	File created: C:\Windows\SysWOW64\Fkchmojh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nmenfa32.exe	File created: C:\Windows\SysWOW64\Oqcglo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljbphh32.exe	File created: C:\Windows\SysWOW64\Mjdlnhfi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhibdn32.exe	File created: C:\Windows\SysWOW64\Heblggpd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gnbnph32.exe	File created: C:\Windows\SysWOW64\Gpajjk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	File created: C:\Windows\SysWOW64\Hgpoon32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Offokopb.exe	File created: C:\Windows\SysWOW64\Lgbpdadc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eddpko32.exe	File created: C:\Windows\SysWOW64\Giommjni.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdkabo32.exe	File created: C:\Windows\SysWOW64\Bdnngnpc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mnikde32.exe	File created: C:\Windows\SysWOW64\Njplifll.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	File created: C:\Windows\SysWOW64\Oqkkln32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gqfpko32.exe	File created: C:\Windows\SysWOW64\Majppnhp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpajjk32.exe	File created: C:\Windows\SysWOW64\Domiglci.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onqjlb32.exe	File created: C:\Windows\SysWOW64\Pjgkac32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	File created: C:\Windows\SysWOW64\Ibphfofn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qjcjma32.exe	File created: C:\Windows\SysWOW64\Qhgkff32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bombon32.exe	File created: C:\Windows\SysWOW64\Bmbppkoe.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkchmojh.exe	File created: C:\Windows\SysWOW64\Kjkggl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eniqcohl.exe	File created: C:\Windows\SysWOW64\Fnkmiofi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Aabldk32.exe	File created: C:\Windows\SysWOW64\Ajjqmqgl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gidnmk32.exe	File created: C:\Windows\SysWOW64\Gekobloj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qmocigko.exe	File created: C:\Windows\SysWOW64\Qiecnhac.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cafglb32.exe	File created: C:\Windows\SysWOW64\Ppcqpc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	File created: C:\Windows\SysWOW64\Ddnmejkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jphbga32.exe	File created: C:\Windows\SysWOW64\Jomohnom.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmhofc32.exe	File created: C:\Windows\SysWOW64\Cafglb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Onnmfb32.exe	File created: C:\Windows\SysWOW64\Onqjlb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	File created: C:\Windows\SysWOW64\Apgieg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ibkogn32.exe	File created: C:\Windows\SysWOW64\Inaplpij.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jacaehhi.exe	File created: C:\Windows\SysWOW64\Mafkbeoj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	File created: C:\Windows\SysWOW64\Fdldjhaq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Enmknk32.exe	File created: C:\Windows\SysWOW64\Fnohck32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjgkac32.exe	File created: C:\Windows\SysWOW64\Dodmipcd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khacmalp.exe	File created: C:\Windows\SysWOW64\Konhokaj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dkoele32.exe	File created: C:\Windows\SysWOW64\Fflljpnc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqcglo32.exe	File created: C:\Windows\SysWOW64\Dbhphf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	File created: C:\Windows\SysWOW64\Jacaehhi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Khacmalp.exe	File created: C:\Windows\SysWOW64\Mdfpjg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pbdepo32.exe	File created: C:\Windows\SysWOW64\Obgbhn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qiecnhac.exe	File created: C:\Windows\SysWOW64\Amcldf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kiojlk32.exe	File created: C:\Windows\SysWOW64\Kefjql32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pijdbj32.exe	File created: C:\Windows\SysWOW64\Pjiqlm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	File created: C:\Windows\SysWOW64\Ecglja32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Konhokaj.exe	File created: C:\Windows\SysWOW64\Iibphp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Genbbb32.exe	File created: C:\Windows\SysWOW64\Mejcahjf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qmocigko.exe	File created: C:\Windows\SysWOW64\Hchcho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cokoplnm.exe	File created: C:\Windows\SysWOW64\Cgfcdokh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Encamf32.exe	File created: C:\Windows\SysWOW64\Aefbqf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amkiol32.exe	File created: C:\Windows\SysWOW64\Ajojhp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njplifll.exe	File created: C:\Windows\SysWOW64\Nchpbl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	File created: C:\Windows\SysWOW64\Dhocdp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	File created: C:\Windows\SysWOW64\Ednpeidn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Imjmel32.exe	File created: C:\Windows\SysWOW64\Nnpajnal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fopjig32.exe	File created: C:\Windows\SysWOW64\Ffchlo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qjcjma32.exe	File created: C:\Windows\SysWOW64\Fnjcoo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdkabo32.exe	File created: C:\Windows\SysWOW64\Cgbcokgg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	File created: C:\Windows\SysWOW64\Offokopb.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkchmojh.exe	File created: C:\Windows\SysWOW64\Fekmfd32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ifcanaen.exe	File created: C:\Windows\SysWOW64\Docmmc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gibahklh.exe	File created: C:\Windows\SysWOW64\Khmhlo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jppobf32.exe	File created: C:\Windows\SysWOW64\Jlfpghnm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	File created: C:\Windows\SysWOW64\Jfebge32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	File created: C:\Windows\SysWOW64\Lecjmhnq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	File created: C:\Windows\SysWOW64\Hkkoqdmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	File created: C:\Windows\SysWOW64\Ilkpkihj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ggbenh32.exe	File created: C:\Windows\SysWOW64\Gibahklh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlimmg32.exe	File created: C:\Windows\SysWOW64\Ieiomg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gnbnph32.exe	File created: C:\Windows\SysWOW64\Giamobql.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Enmknk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mohkfn32.exe	File created: C:\Windows\SysWOW64\Ingcjaio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ameiifeg.exe	File created: C:\Windows\SysWOW64\Ailjng32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kjfplj32.exe	File created: C:\Windows\SysWOW64\Heaepkaj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhocdp32.exe	File created: C:\Windows\SysWOW64\Dokhgj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	File created: C:\Windows\SysWOW64\Lmolop32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jfenda32.exe	File created: C:\Windows\SysWOW64\Ipoden32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Llnood32.exe	File created: C:\Windows\SysWOW64\Aljbfgpf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmmhacal.exe	File created: C:\Windows\SysWOW64\Cmoefb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ailjng32.exe	File created: C:\Windows\SysWOW64\Cbaabn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	File created: C:\Windows\SysWOW64\Engkhenj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbbclf32.exe	File created: C:\Windows\SysWOW64\Hpfcejof.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mnikde32.exe	File created: C:\Windows\SysWOW64\Nhljaibo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edqlki32.exe	File created: C:\Windows\SysWOW64\Cqeolm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hloapk32.exe	File created: C:\Windows\SysWOW64\Kcamoc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dafpcpme.exe	File created: C:\Windows\SysWOW64\Dkoele32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfeafc32.exe	File created: C:\Windows\SysWOW64\Qjcjma32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfceac32.exe	File created: C:\Windows\SysWOW64\Jmcpkl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	File created: C:\Windows\SysWOW64\Kpnkcdli.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	File created: C:\Windows\SysWOW64\Glgafh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	File created: C:\Windows\SysWOW64\Hoeiflna.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	File created: C:\Windows\SysWOW64\Kilkncaa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Encamf32.exe	File created: C:\Windows\SysWOW64\Eaqjcdhf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Aabldk32.exe	File created: C:\Windows\SysWOW64\Hfplhlei.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khofgbnc.exe	File created: C:\Windows\SysWOW64\Lbjkckae.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	File created: C:\Windows\SysWOW64\Gopkbc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Leomgk32.exe	File created: C:\Windows\SysWOW64\Lgojanmn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	File created: C:\Windows\SysWOW64\Mpkajllm.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	File created: C:\Windows\SysWOW64\Kjfplj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lpbndndh.exe	File created: C:\Windows\SysWOW64\Dkbmhf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jopbhd32.exe	File created: C:\Windows\SysWOW64\Jppobf32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nchpbl32.exe	File created: C:\Windows\SysWOW64\Homjaafk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fmeamaph.exe	File created: C:\Windows\SysWOW64\Ffmfeg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Apbpjhji.exe	File created: C:\Windows\SysWOW64\Aabldk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dokhgj32.exe	File created: C:\Windows\SysWOW64\Jiceolni.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Engkhenj.exe	File created: C:\Windows\SysWOW64\Jofjci32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmldphm.exe	File created: C:\Windows\SysWOW64\Pidiop32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Enmknk32.exe	File created: C:\Windows\SysWOW64\Jjhmem32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edqlki32.exe	File created: C:\Windows\SysWOW64\Eniqcohl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	File created: C:\Windows\SysWOW64\Nfghhi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dbagjiik.exe	File created: C:\Windows\SysWOW64\Bccbfjkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amcldf32.exe	File created: C:\Windows\SysWOW64\Ndkkoc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgojanmn.exe	File created: C:\Windows\SysWOW64\Fjpdni32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jfenda32.exe	File created: C:\Windows\SysWOW64\Jopbhd32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	File created: C:\Windows\SysWOW64\Baphfiel.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhocdp32.exe	File created: C:\Windows\SysWOW64\Imdckjjd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kjfplj32.exe	File created: C:\Windows\SysWOW64\Ljimbj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	File created: C:\Windows\SysWOW64\Gllhcm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	File created: C:\Windows\SysWOW64\Ofdbeobd.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	File created: C:\Windows\SysWOW64\Kiojlk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kefjql32.exe	File created: C:\Windows\SysWOW64\Hppahlmk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	File created: C:\Windows\SysWOW64\Imjmel32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	File created: C:\Windows\SysWOW64\Bpkkfq32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iejbnp32.exe	File created: C:\Windows\SysWOW64\Iflknc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bajhpc32.exe	File created: C:\Windows\SysWOW64\Ikdhblhl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amkiol32.exe	File created: C:\Windows\SysWOW64\Pdlope32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gekobloj.exe	File created: C:\Windows\SysWOW64\Hglhdg32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	File created: C:\Windows\SysWOW64\Hdnaik32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajojhp32.exe	File created: C:\Windows\SysWOW64\Bombon32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Gibahklh.exe	File created: C:\Windows\SysWOW64\Gidnmk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnohck32.exe	File created: C:\Windows\SysWOW64\Kiolqecl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pijdbj32.exe	File created: C:\Windows\SysWOW64\Hfknhcaf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hloapk32.exe	File created: C:\Windows\SysWOW64\Iejbnp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njplifll.exe	File created: C:\Windows\SysWOW64\Ajjjec32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	File created: C:\Windows\SysWOW64\Chjnlmda.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fopjig32.exe	File created: C:\Windows\SysWOW64\Fbacjbjc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Kejmae32.exe	File created: C:\Windows\SysWOW64\Lpbndndh.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hpfcejof.exe	File created: C:\Windows\SysWOW64\Hphpkjlc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	File created: C:\Windows\SysWOW64\Jlclga32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hedahkgo.exe	File created: C:\Windows\SysWOW64\Gjhongok.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cppnhn32.exe	File created: C:\Windows\SysWOW64\Dbagjiik.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Mohkfn32.exe	File created: C:\Windows\SysWOW64\Mnikde32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Jphbga32.exe	File created: C:\Windows\SysWOW64\Mhoflbja.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjgichdg.exe	File created: C:\Windows\SysWOW64\Mjieig32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dafpcpme.exe	File created: C:\Windows\SysWOW64\Hjfniidf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgaffm32.exe	File created: C:\Windows\SysWOW64\Llnood32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lpbndndh.exe	File created: C:\Windows\SysWOW64\Lcbgfi32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfeafc32.exe	File created: C:\Windows\SysWOW64\Qappag32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhibdn32.exe	File created: C:\Windows\SysWOW64\Mhkojn32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Apbpjhji.exe	File created: C:\Windows\SysWOW64\Ekifajpc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmgikj32.exe	File created: C:\Windows\SysWOW64\Galjgp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	File created: C:\Windows\SysWOW64\Omoalp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	File created: C:\Windows\SysWOW64\Febcfckp.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmldphm.exe	File created: C:\Windows\SysWOW64\Ojkdkonc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfikpo32.exe	File created: C:\Windows\SysWOW64\Lpgaep32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bajhpc32.exe	File created: C:\Windows\SysWOW64\Bdkabo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhjiianf.exe	File created: C:\Windows\SysWOW64\Dhmfoq32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Lceckh32.exe	File created: C:\Windows\SysWOW64\Lcgpahmc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Hglhdg32.exe	File created: C:\Windows\SysWOW64\Hkjqjeba.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Iejbnp32.exe	File created: C:\Windows\SysWOW64\Gchqcf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nchpbl32.exe	File created: C:\Windows\SysWOW64\Nooagm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Njoeophq.exe	File created: C:\Windows\SysWOW64\Nbkicbfk.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Web Event Logger			Jump to behavior
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Web Event Logger			Jump to behavior

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-2594

Source: C:\Windows\SysWOW64\Ojkdkonc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ecllamlh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgaffm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Njmgoh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gekobloj.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Llbhhh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Inaplpij.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Phhqek32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbbclf32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dddgooib.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Chhmdaph.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Bhfgjioo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fmeamaph.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Iamocmjl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnkmiofi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gdkolaoq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qiecnhac.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cmkokg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ophcmlpf.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lpkigf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbfcph32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kfkiao32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hgqaofhe.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hikbigjf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Badaah32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kpnojmgp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipdpfhbf.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ohblco32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlfpghnm.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Akcokgql.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cgfcdokh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Qjndnbei.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjieig32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Impfdpln.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhibdn32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Heblggpd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cokoplnm.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lhhhfbih.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ipfeaa32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hgpoon32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Offokopb.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lgbpdadc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mlihpl32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dqamkq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eddpko32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Giommjni.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mgmfbl32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Oqkkln32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gqfpko32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Majppnhp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmmhacal.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ggjbcdlg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlclga32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ecjgjl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jhjmlb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fbjocj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpajjk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Domiglci.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqnfgjlh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Qoejampk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ibkogn32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nlfalpdi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iiiqoh32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Bhiabhja.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dcjjpgaa.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ibphfofn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jomohnom.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kaigjjqk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkchmojh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kjkggl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kiojlk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dgibhggn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cafglb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ppcqpc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bpkkfq32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ddnmejkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kgegkoeh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cpdhdolk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jacaehhi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mafkbeoj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onnmfb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jmclho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Leomgk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Iciglbko.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcgpahmc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fdldjhaq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gpmqolfa.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jeoqiq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjgkac32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dodmipcd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Njoeophq.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kgamdcln.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dkoele32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fflljpnc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqcglo32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dbhphf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjdlnhfi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cemjaq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khacmalp.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mdfpjg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pbdepo32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Obgbhn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baphfiel.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Oogkej32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hbhbbofi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kdjdhipm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cmoefb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Epnhmj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edlcpjfa.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ecglja32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ilkpkihj.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Okbebenm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Konhokaj.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Iibphp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljbphh32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Aelink32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qmocigko.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hchcho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Genbbb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mejcahjf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Encamf32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Aefbqf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfqhkdkc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lmaaqi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nooagm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Chbmaj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Imjmel32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nnpajnal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ggbenh32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ejjjedcj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fopjig32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ffchlo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qjcjma32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fnjcoo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmhofc32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pmqiii32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhmfoq32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gljedo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ecmfegon.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Igiglfjj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdkabo32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cgbcokgg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ifcanaen.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Docmmc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gibahklh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Khmhlo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmihma32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pihcgoep.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eniqcohl.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fifbonoq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hkjqjeba.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jfebge32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cppnhn32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Foqfph32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hphpkjlc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lecjmhnq.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nbkicbfk.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hkkoqdmp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Apgieg32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mmgiocda.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nqomappc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mfpeda32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jlimmg32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ieiomg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baanabom.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Beqfpgmi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gnbnph32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Giamobql.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mohkfn32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ingcjaio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kjfplj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Heaepkaj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fqjqpp32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lmolop32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dondlj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Clakkf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Llnood32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Aljbfgpf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jfenda32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ipoden32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ailjng32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cbaabn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mnikde32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nhljaibo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edqlki32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cqeolm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bombon32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cccfolfa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hloapk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kcamoc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfceac32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jmcpkl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbacjbjc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jlnoca32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oqhpgogi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Glgafh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bdnngnpc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kilkncaa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eaqjcdhf.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hoeiflna.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qhgkff32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Inbgmhop.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajjqmqgl.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Magfho32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Aabldk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hfplhlei.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Khofgbnc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lbjkckae.dll	Jump to dropped file
Source: C:\Users\user\Desktop\jQ3NFDayJm.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gopkbc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gidnmk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gmakid32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lpbndndh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dkbmhf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fbjmjcpl.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mpahpi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nchpbl32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Homjaafk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqhbdf32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Golngj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Geiigbeh.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Dnjcfdoi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dokhgj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jiceolni.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Engkhenj.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jofjci32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofmldphm.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pidiop32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jppobf32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Knggaeba.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Enmknk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jjhmem32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cohbjm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Iodlcfjb.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jpmlbqfp.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nfghhi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dbagjiik.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Bccbfjkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Omoalp32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nnclcm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mhkojn32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cbjkoi32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amcldf32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ndkkoc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pjiqlm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pdhionab.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lgojanmn.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fjpdni32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfnkfdne.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mbpekpdk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Febcfckp.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Alghniec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhocdp32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Imdckjjd.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iflknc32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lpdccbgf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kejmae32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hqcomlbp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ffmfeg32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gllhcm32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ofdbeobd.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Oollcpnc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lcbgfi32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Efcana32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ckdljm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hiolkefh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ameiifeg.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Knjaiq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kefjql32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hppahlmk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ljimbj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jiipjfip.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bajhpc32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ikdhblhl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Amkiol32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pdlope32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojmapnlq.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hdnaik32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mpkajllm.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Afkgdh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kmhigjcm.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Eeapjigc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaacm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Njlgcl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnohck32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kiolqecl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jopbhd32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hcddga32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pijdbj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hfknhcaf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Mjgichdg.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Haiooqfk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajojhp32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hmnmcf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Lceckh32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Aidobh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Njplifll.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ajjjec32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nmenfa32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Glgklpcj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Kpnkcdli.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Chjnlmda.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hedahkgo.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gjhongok.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Jphbga32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mhoflbja.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmbppkoe.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hcliif32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dafpcpme.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hjfniidf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajlfhjbn.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ipdpiheo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hglhdg32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ebgacgaj.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfeafc32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Qappag32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Gbipeg32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Cjojjp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Apbpjhji.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ekifajpc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmgikj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Galjgp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onqjlb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Eqacmgol.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pfikpo32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lpgaep32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Hpfcejof.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ncafmodl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Iejbnp32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gchqcf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ednpeidn.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nggkimpl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fekmfd32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fkoqiobi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dhjiianf.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fcbfja32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fnanodfp.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Nlfojgba.dll	Jump to dropped file

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe

API coverage: 6.8 %

Source: C:\Users\user\Desktop\jQ3NFDayJm.exe

Code function: 0_2_00406C29 CloseHandle,GetVersionExA,GetSystemDirectoryA,GetTickCount,GetModuleFileNameA,CopyFileA,WinExec,ExitProcess,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,GetMessageA,

Source: Yara match	File source: 0.2.jQ3NFDayJm.exe.42aa84.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jQ3NFDayJm.exe PID: 2972, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	12 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Software Packing	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
jQ3NFDayJm	89%	Virustotal		Browse
jQ3NFDayJm	100%	Avira	TR/Spy.Qukart.NB
jQ3NFDayJm	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
C:\Windows\SysWOW64\Beqfpgmi.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Bmgikj32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ameiifeg.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ajojhp32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Baanabom.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ajjqmqgl.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Aefbqf32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Amcldf32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Akcokgql.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Aabldk32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Aljbfgpf.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Bhiabhja.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Ajlfhjbn.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bdnngnpc.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bmbppkoe.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bmhofc32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Alghniec.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Apbpjhji.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ajjjec32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Afkgdh32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Ailjng32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bccbfjkm.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Apgieg32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Aidobh32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Bhfgjioo.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Bdkabo32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bajhpc32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Amkiol32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Baphfiel.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Aelink32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Badaah32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Beqfpgmi.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bmgikj32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ameiifeg.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ajojhp32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Baanabom.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ajjqmqgl.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Aefbqf32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Amcldf32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Akcokgql.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Aabldk32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Aljbfgpf.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bhiabhja.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ajlfhjbn.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bdnngnpc.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bmbppkoe.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bmhofc32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Alghniec.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Apbpjhji.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ajjjec32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Afkgdh32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ailjng32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bccbfjkm.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Apgieg32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Aidobh32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bhfgjioo.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bdkabo32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bajhpc32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Amkiol32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Baphfiel.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Aelink32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Badaah32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Aefbqf32.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Aelink32.dll	96%	ReversingLabs	Win32.Backdoor.Padodor
C:\Windows\SysWOW64\Aelink32.dll	82%	Virustotal		Browse
C:\Windows\SysWOW64\Afkgdh32.dll	90%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Aidobh32.dll	96%	ReversingLabs	Win32.Backdoor.Padodor
C:\Windows\SysWOW64\Aidobh32.dll	84%	Virustotal		Browse
C:\Windows\SysWOW64\Ajjjec32.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Akcokgql.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Akcokgql.dll	83%	Virustotal		Browse
C:\Windows\SysWOW64\Alghniec.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Alghniec.dll	84%	Virustotal		Browse
C:\Windows\SysWOW64\Aljbfgpf.dll	100%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Aljbfgpf.dll	82%	Virustotal		Browse
C:\Windows\SysWOW64\Bccbfjkm.dll	91%	ReversingLabs	Win32.Backdoor.Berbew

Name	Source	Malicious
http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware	jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp	false
http://tat-neftbank.ru/wcmd.htm	jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp	false
http://tat-neftbank.ru/kkq.php	jQ3NFDayJm.exe, 00000000.00000002.1470739378.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Enmknk32.exe, 00000001.00000002.1471644690.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Fnohck32.exe, 00000002.00000002.1472452269.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Fkchmojh.exe, 00000003.00000002.1473368979.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Fekmfd32.exe, 00000005.00000002.1474183172.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Foaacm32.exe, 00000006.00000002.1474948269.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Fmeamaph.exe, 00000007.00000002.1476045755.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Ffmfeg32.exe, 00000008.00000002.1477156948.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Febcfckp.exe, 00000009.00000002.1478417107.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Gbfcph32.exe, 0000000A.00000002.1479423300.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Gbipeg32.exe, 0000000B.00000002.1480045068.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Gpmqolfa.exe, 0000000C.00000002.1480873068.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Geiigbeh.exe, 0000000D.00000002.1481733667.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Gnbnph32.exe, 0000000E.00000002.1482343235.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Gpajjk32.exe, 0000000F.00000002.1483379730.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Genbbb32.exe, 00000010.00000002.1484294341.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Hbbclf32.exe, 00000011.00000002.1485425782.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Hpfcejof.exe, 00000012.00000002.1486750331.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Hphpkjlc.exe, 00000013.00000002.1488083524.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Hloapk32.exe, 00000014.00000002.1490631205.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Iejbnp32.exe, 00000015.00000002.1492067196.000000000042A000.00000004.00000001.01000000.00000017.sdmp	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592456
Start date and time:	2025-01-16 07:14:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	200
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jQ3NFDayJm renamed because original name is a hash value
Original Sample Name:	a74ddcc99ea8382cf4f6cf0105546bf50fa27db19402206754c6301cd4aa510b
Detection:	MAL
Classification:	mal100.troj.evad.win@362/339@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 9 Number of non-executed functions: 19

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Process:	C:\Windows\SysWOW64\Apbpjhji.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.350015264291986
Encrypted:	false
SSDEEP:	6144:gqXakUr+QP+5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:3XakUpm5tQcUL5tzhSb55tQcUL5tF
MD5:	85BF2D125BE326DD02E3FC33432D637E
SHA1:	730413524920D07112B6AE973A09A4637D72F104
SHA-256:	28D5BF5B1A3C561336FFBF0087121277D5132255F76C37DFCF83F9B940037EB1
SHA-512:	918F3143BEFECE249E614B7C6223145E9957AE551FC952BAC3BEFDC89DBC377C5FC8B1EA8236FEC9D9150361677D19B09C40C1DFDFC3401D2E1229990C09CFAA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Encamf32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8860062483775004
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU107XB+BDq9J5SV3DY:CSVVEPozmB7FXB+FqX5S1D
MD5:	C391E388268F09E049599311B92D4C2C
SHA1:	A269E62914A4434FA76B7C7C4FFF2BD97D91F309
SHA-256:	063EB33BC21913B84A1976554B661A7E0B347A7B189041FDC044B8F55E0DF499
SHA-512:	79E9EE7C3A76A4066EC327C4528A1909F4C315AB99C6029FED86688CA260BA18D4A0B830454FA6CFD2CBB91D2E09717AFF0B73504DC1287B59314942895FA03E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Ljbphh32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885318826375556
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10PB+BDq9J5SV3DY:CSVVEPozmB7FB+FqX5S1D
MD5:	40C6ABEEB3B8BC3E59DE939D91F5E714
SHA1:	54513D6B39DCFB7042B3610DED7893F7E3AF300C
SHA-256:	A75D45432296C1461304D98BF56BF526C07642162660E09A3C499747AE4EF4D7
SHA-512:	EF229CC65185E95DA906E15F059C9E2D9C6507064F234B3D054DEF2B3DA8863BFA6F0A3C2ED469F5A4D0D4A7C19914BD7BF6CAFB65D7F1691B6D0E5BF2DC2E98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Mpkajllm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8857662585525876
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10yB+BDq9J5SV3DY:CSVVEPozmB7sB+FqX5S1D
MD5:	CDBD6CCF382B63AC0AA4C48032797D18
SHA1:	C93EE5790D5A31C606C6EDE64F0759F95D75F7C0
SHA-256:	EC9256A8D108C86A337520C87E25EF3750AE758475A5BD2D362B1AF3E3B7F90D
SHA-512:	B39C8F286EF9401424C60E0E0281482F68B1C8E93B3B71D70A13C4AD3E447410B70FA1BCB18D6A448E1520675FA0DE5037506685D1EF1CB0E20A9E91331202A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 90%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Lceckh32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8857358493279137
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10UB+BDq9J5SV3DY:CSVVEPozmB7yB+FqX5S1D
MD5:	9D659C8304C7D161CAC64F100E03B7C1
SHA1:	081A463908B50230EE5C3875728A45E0EACFA0AA
SHA-256:	4F18DEC01B2569F233188403FBE3023BB57B4FD1653D6B24CF2AE5CF48971300
SHA-512:	4F3C3E71571A3FABD200C59B04FCEAB65EFECE7A059DE57C4D0F1AB3DD52F6CE751F85E0A1C05EE499A0B1CF87E3B697EF67F66FAD455588DC2F525FC179901D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 84%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Njplifll.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8861574173582456
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU103B+BDq9J5SV3DY:CSVVEPozmB71B+FqX5S1D
MD5:	155BF0831BCE73402A3A609AC4C9E8C0
SHA1:	BC55954A3D5E035A5BABB4A6D230EC301C638941
SHA-256:	453CD8B461F0A9464F3520E6871A5E04999DDED81AD09C18686E47784345F90F
SHA-512:	3CD5F53BAA1E294625A20F26884B6F3FF246A383E4D95B65CB9164310D1804D1AAE5D194C82F30F0FEBC36902AB062230CA79C7838C927E6FC8DA78BB772117B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Jlfpghnm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8863522620373296
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10qB+BDq9J5SV3DY:CSVVEPozmB7EB+FqX5S1D
MD5:	800E85A27D81C8AE8DD84AB93D9A5A3E
SHA1:	2CA563D431C213D357C6035D065969389B14EDD1
SHA-256:	08E5B7EC626F72889D1589D7ADC0B3DE00C7B1C655B37C12C675AD0DDF7184D2
SHA-512:	E390600D8BDA91AB501D1146CDB1EB12AE50412FB33066EC6262CB0DB61B3AE881CD349086C277F2AA12E08320CD2AB21BAE7B278C7246829B1B0FC39F4ED130
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 83%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Febcfckp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886068802429216
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10cB+BDq9J5SV3DY:CSVVEPozmB7OB+FqX5S1D
MD5:	0C82088E7E11B239CC5ADAE24BA4F971
SHA1:	AE7CF8CD1BDF47E65FD447A3F298038AC07089A7
SHA-256:	D8009B07465C08BE6CD6AE595223C7BD044FA2B0DA3EA01E2AD96E02FED05825
SHA-512:	BA31C54906AECB7A8B047C1D777C0B502CD915F39EA98C33446E423CE16F829DDB9D849A4A8015C276937C36820A73C46B41FE0EEA4CAD55F1777496E9791C4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 84%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Llnood32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8856716184061293
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10qB+BDq9J5SV3DY:CSVVEPozmB7kB+FqX5S1D
MD5:	33C1DA1DAD022225B3FDDA857034BB6B
SHA1:	5DE02D1F1C9ECF8DA6BE43198224BE1376D61BE4
SHA-256:	FE257FAC3EB5A705A651DDB51955B71A1F8BE364BC02B4119038190BAAF0AB54
SHA-512:	F7A08D2D14444BB4F85F9E18076360A8E9FC8A61627E1F480E61221B0E4480683DD36509D0FC1FCFBB32BFD27731E4FA6270CEABF54A9772EBDF71447E5AEC13
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Qiecnhac.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.337076854949595
Encrypted:	false
SSDEEP:	6144:riolpjji5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:rHjjW5tQcUL5tzhSb55tQcUL5tF
MD5:	98BB300687B86FC31658C994F7FD98DD
SHA1:	3119AD482008CB40AF4011465BBEF5318921ADB2
SHA-256:	CF306E61D9FC76F2E4335C9D1E57E498B2D3F98F51FF2C54EB4EB16B7C94160F
SHA-512:	97309B3213858E7BF803A2F98F5C6A7F5C3FFBF3F417608DA095D62CEC5FF8BD382A6D4FD1D8BD17B52A191C64DE0AF48588AE79EB6F2C1F574D354D938F8569
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Qhgkff32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.354673237981467
Encrypted:	false
SSDEEP:	6144:2t+5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:d5tQcUL5tzhSb55tQcUL5tF
MD5:	C1B46682F213E9376A0214037817B663
SHA1:	028094DF4E45154258B94CC166A3B26348922788
SHA-256:	2374046565D8EB0E18F2D51B15EEEAC7A9A87AE3B152DE0374AD6CC664B7CA3C
SHA-512:	467B971A21C1CEDC2DBFAE68534EA40E8368CAC75AFE87AA7E6289D93527C91F88FBEDC0EAAC874E8446DE84807FB6B839A845DF83E04914872831CDF67D92A2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Bpkkfq32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.344897866960388
Encrypted:	false
SSDEEP:	6144:fJ/pw5I5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:xpT5tQcUL5tzhSb55tQcUL5tF
MD5:	F8117561FA40405AA09AE3326E252543
SHA1:	ED3C520948B7AA62380F74CDB6F9433B3270AD2E
SHA-256:	47E53EC736E4B49D150FA77FD2D7A70FF14A0911D1C2BF940F82E9792A227747
SHA-512:	C0542D2BFE584C7C5D80141769A6AB09EB33460C829C681C3900096FFBF8D391AC6ACEEF8240BB8621571EE9DFEF611C81ABDF13EA9BD50335E53A1AE20ACEBF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Dbagjiik.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8856724939124954
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10yB+BDq9J5SV3DY:CSVVEPozmB7EB+FqX5S1D
MD5:	66859ECAE1F522E76429DDFC66CBD601
SHA1:	8F0476117346DD7DBFD271F7989567541205FB54
SHA-256:	279F09A6D89C3D249A1158927E791F545974B442DACC21F35786AE8F4BAD5C0F
SHA-512:	5A6A59C6E8A3E903E98C5A6B3977A8033BA1CA046CB0BF3C3452D5D2562641B0BFA5D09E2ED9EF1571E8EF75815848C64E78B3A0B383C41E69C8B9AF745C35EC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jQ3NFDayJm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SysWOW64\Aabldk32.exe

C:\Windows\SysWOW64\Aefbqf32.dll

C:\Windows\SysWOW64\Aelink32.dll

C:\Windows\SysWOW64\Afkgdh32.dll

C:\Windows\SysWOW64\Aidobh32.dll

C:\Windows\SysWOW64\Ailjng32.exe

C:\Windows\SysWOW64\Ajjjec32.dll

C:\Windows\SysWOW64\Ajjqmqgl.exe

C:\Windows\SysWOW64\Ajlfhjbn.exe

C:\Windows\SysWOW64\Ajojhp32.exe

C:\Windows\SysWOW64\Akcokgql.dll

C:\Windows\SysWOW64\Alghniec.dll

C:\Windows\SysWOW64\Aljbfgpf.dll

C:\Windows\SysWOW64\Amcldf32.exe

C:\Windows\SysWOW64\Ameiifeg.exe

C:\Windows\SysWOW64\Amkiol32.exe

C:\Windows\SysWOW64\Apbpjhji.exe

C:\Windows\SysWOW64\Apgieg32.exe

C:\Windows\SysWOW64\Baanabom.exe

Windows Analysis Report
jQ3NFDayJm

Process:	C:\Windows\SysWOW64\Chhmdaph.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885192026752473
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10AB+BDq9J5SV3DY:CSVVEPozmB7uB+FqX5S1D
MD5:	E03A8F0B22FC7C863DCA3FDBFC0E5867
SHA1:	9B1FA23D5E73ACAF347FCCFB149AC76E1D740931
SHA-256:	E09F0EC277B9C66748561ABF787145D701CA0D9CBEF52D4683A5DCC9DFD98093
SHA-512:	414450A6417E23708775CC6F1D9092FA00DBDBFA9BA3B2C1893FBDCE25FAF33E0CEAD706380E9A7BF325A2B6A300ADC962A2E21FB6FA292DC45EF3DFBE8CC26B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Iiiqoh32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8859060016463047
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10yrB+BDq9J5SV3DY:CSVVEPozmB76B+FqX5S1D
MD5:	E1696CE4714DD4DF14B2E7C861EE64E2
SHA1:	CD5737AB5E5ADFD0BE4910557650D948DC37D455
SHA-256:	458434CAE2781BC3987186E68CE05FB87058424D3DDBE92123F27AF3E7B858B5
SHA-512:	2F1550B3E566DA8417B0A42DC5C1DFC6D430902A9C5D7B8D650E3C8B30CACFE2E47881864F112BE4DE751C7A15004A8121BE67BAAF480496BE00B7B8EF309BEB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Bombon32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.341820709131245
Encrypted:	false
SSDEEP:	6144:WKzue5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:FD5tQcUL5tzhSb55tQcUL5tF
MD5:	7FF302FD9D1D02852FF902CAF7293067
SHA1:	87403C456EFBCBEAE4E9699031E3972DEE335CC0
SHA-256:	EAE53FA6955B437B2EFBC54ACD071B5FA81BC1D0FC6A3788E459A39FBF6A2BC4
SHA-512:	7510AAF969C523F2AEE2BDEEDBD78B78378CA3DE6399CDD8FFBD827ED639A1C005536C611D9FE21DA8913CFA751BEDD8BE7AF04526F5F82975825491E995A494
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Mhkojn32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8856425715850786
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10aB+BDq9J5SV3DY:CSVVEPozmB78B+FqX5S1D
MD5:	33FABFC01D7F962F7860A8AAE65EB36C
SHA1:	4B07F165D52096704291C02C4CA87F498682FC29
SHA-256:	83EB97911077620EF646E6D6291E0B407F1328542786A0CE019CC831ABC87E1B
SHA-512:	093B9271707C210516C087B4C204070D0171C62D3686B15DB7DB5BABA8598375BF96E2EE6A5C827BB75DE32E09AA6E121A57F66FDA657DC33E232D45981C909F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Mjdlnhfi.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8859064067685587
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10iB+BDq9J5SV3DY:CSVVEPozmB78B+FqX5S1D
MD5:	C9E4148DB2CC94D6914AB840AECCE14A
SHA1:	DE56DE071D78C086917D14B9CA9D19B13B3CCAA4
SHA-256:	489C2540AFBE9C59066F476AD4EEF0C95AC6A49AE52EDB7E025F3FC49013F935
SHA-512:	A3B040E6173300152BECD44DA984578AD59B7D1214B198A5FE5B5E68F08A5358128A9DCE12302F1C9AC75295FBF31FC0411DE447F609961A81D318A2DAC853EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Cokoplnm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.356791000205325
Encrypted:	false
SSDEEP:	6144:Qy+x5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:s5tQcUL5tzhSb55tQcUL5tF
MD5:	EE751852438F944CF208CB0E26829F0E
SHA1:	10EF6E344A09BB79408CC6067525C426CD8B6CC3
SHA-256:	E8B81EE18F900B02895E8B76ED1BB5F70DB64A0BB63FB2C6B1CEB5452A5A2882
SHA-512:	CFA85D974E823BED807AB7055C245AEF344D096DBDE8B910366C70F2F8A6468546EFCB79B8920F8EA88CBDD84C8293D5B9F15295270504E3695C381E1BE60E25
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Nooagm32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886549703636014
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10CB+BDq9J5SV3DY:CSVVEPozmB7wB+FqX5S1D
MD5:	561842DC852BC6D3F21210A3317977BB
SHA1:	1AF54DB6C5D0EDD5CE051977EE99FA8E5712EA97
SHA-256:	77636EDBA2253C30EC9FBD1AB8487A846D6280AA6CAA0806CE954A7BE15E5D1D
SHA-512:	17FAB749A5C424EFA8B7CD6D98A1B9F18BDAFC045525BF5283FD1DDBCE9372EE67EC7AECFF8AAF5702FBE63B919E7792E9BB99A30C62801A293950F12F806DB7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Ckdljm32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	371310
Entropy (8bit):	7.333553392641765
Encrypted:	false
SSDEEP:	6144:SGMaiREP5tTM0nJWlp5tT/hSbK3rJk5tTM0nJWlp5tTZ:hDWc5tQcUL5tzhSb55tQcUL5tF
MD5:	D30DD4CB909C0DCDF8B969B3CAFCEC75
SHA1:	928AEF2C7D0DED68540089C79F8E375C9A704CC2
SHA-256:	CEED1CCFB2A28B5843BD44A13822ACC5C26DD6F806F4AC8FA48BBCAB79CADC8B
SHA-512:	5F7703362FD531AAA810416D6341B49061841FCE9ED827B00382C43248F52AE01F0EFF555945E8EAC368DF8EC67DA0DC414F6443B204507F2E72046B158FC566
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z.d...............7.p...>....................@.............................................................................h....................................................................................................................text....n.......n.................. ....bss.....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Kpnkcdli.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8859668897336705
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10XB+BDq9J5SV3DY:CSVVEPozmB7JB+FqX5S1D
MD5:	226456A56656AE91B93D83875757C1E9
SHA1:	65362234DCCA8DD9B1256B9C04AFC5D007D183D3
SHA-256:	FA4F9395DD2EF05C85C3BCCFAA36023EA101CB0E59F1F9DF45264356179A864B
SHA-512:	B03CC8B93E1999AE7ADD47959B097151418B98ED5F3B20CC18307AC4D566C6F494D391E05690CA271800F38D286ACAEB76F36509C4AB76E737DF6DEB09166DAA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\SysWOW64\Gbipeg32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886297872829916
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10l6B+BDq9J5SV3DY:CSVVEPozmB7qB+FqX5S1D
MD5:	719F33AB4E598E8A84F28F4BEB175F4C
SHA1:	AB7D36D0D077B80C56C6B9812712B2BF300706FC
SHA-256:	0227A0A801EEBF411CD30098B7BE16FFC5B83BA1C0A3C0673AC317A27F1DCF93
SHA-512:	66936E176A12D696EA7AA8184883EDB90A8885AEE8A06178E1D40D3F3A250162BC9C1FC636D31B5505CBF09C9CE799033A17D60DFEE97F3C2BCAC0512977470B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................