Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
3df5a240490fdd11f45de6081ce700bd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3df5a240490fdd11f45de6081ce700bd.exe
Resource
win10v2004-20231215-en
General
-
Target
3df5a240490fdd11f45de6081ce700bd.exe
-
Size
5KB
-
MD5
3df5a240490fdd11f45de6081ce700bd
-
SHA1
f44938d2c08aca417bc40a95e9cb55a677121ff5
-
SHA256
b93acbe956e13cf3c2f1c00e5fbe98c5fbb75a53ea83e7da848c0a70e9d308d6
-
SHA512
07d49108f9e57ac6bd18c9c9da1698791b063bcadac899004e7a77fa016fe4be3b50577c7a5ad01aa6c84059e1860ef7d19cdb5336a46ad906479da67ed4a3de
-
SSDEEP
96:kexkFQsq9TDZ2jdzHUu0xV1aTas55555555555U:7E42dzHUuLap
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2212 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2772 igdjolee1.exe 2412 igdjolee1.exe 2604 igdjolee1.exe 2632 igdjolee1.exe 2624 igdjolee1.exe 2528 igdjolee1.exe 1900 igdjolee1.exe 1888 igdjolee1.exe 1312 attrib.exe 2804 igdjolee1.exe 2264 igdjolee1.exe 2276 igdjolee1.exe 716 igdjolee1.exe 2924 igdjolee1.exe 2108 igdjolee1.exe 2136 igdjolee1.exe 2556 attrib.exe 1544 attrib.exe 1728 attrib.exe 1812 cmd.exe 1724 igdjolee1.exe 2336 igdjolee1.exe 2896 attrib.exe 2144 conhost.exe 2764 cmd.exe 2108 cmd.exe 2452 attrib.exe 2640 attrib.exe 1604 attrib.exe 2540 igdjolee1.exe 944 igdjolee1.exe 2264 cmd.exe 240 cmd.exe 2252 attrib.exe 560 igdjolee1.exe 1936 attrib.exe 2128 conhost.exe 2540 igdjolee1.exe 988 igdjolee1.exe 2460 cmd.exe 820 igdjolee1.exe 2044 Process not Found 2368 conhost.exe 2744 conhost.exe 1888 cmd.exe 2760 igdjolee1.exe 3028 igdjolee1.exe 640 conhost.exe 1920 igdjolee1.exe 2500 igdjolee1.exe 592 igdjolee1.exe 2568 igdjolee1.exe 3028 igdjolee1.exe 2732 igdjolee1.exe 592 igdjolee1.exe 2696 igdjolee1.exe 3028 igdjolee1.exe 1560 igdjolee1.exe 788 Process not Found 400 igdjolee1.exe 788 Process not Found 3084 Process not Found 3144 Process not Found 3208 conhost.exe -
Loads dropped DLL 64 IoCs
pid Process 2356 3df5a240490fdd11f45de6081ce700bd.exe 2356 3df5a240490fdd11f45de6081ce700bd.exe 2772 igdjolee1.exe 2772 igdjolee1.exe 2412 igdjolee1.exe 2412 igdjolee1.exe 2604 igdjolee1.exe 2604 igdjolee1.exe 2632 igdjolee1.exe 2632 igdjolee1.exe 2624 igdjolee1.exe 2624 igdjolee1.exe 2528 igdjolee1.exe 2528 igdjolee1.exe 1900 igdjolee1.exe 1900 igdjolee1.exe 1888 igdjolee1.exe 1888 igdjolee1.exe 1312 attrib.exe 1312 attrib.exe 2804 attrib.exe 2804 attrib.exe 2264 igdjolee1.exe 2264 igdjolee1.exe 2276 igdjolee1.exe 2276 attrib.exe 716 igdjolee1.exe 716 igdjolee1.exe 2924 igdjolee1.exe 2924 igdjolee1.exe 2108 igdjolee1.exe 2108 igdjolee1.exe 2136 attrib.exe 2136 attrib.exe 2556 attrib.exe 2556 attrib.exe 1544 attrib.exe 1544 attrib.exe 1728 conhost.exe 1728 conhost.exe 1812 cmd.exe 1812 cmd.exe 1724 igdjolee1.exe 1724 igdjolee1.exe 2336 igdjolee1.exe 2336 igdjolee1.exe 2896 attrib.exe 2896 attrib.exe 2144 conhost.exe 2144 conhost.exe 2764 cmd.exe 2764 cmd.exe 2108 cmd.exe 2108 cmd.exe 2452 attrib.exe 2452 attrib.exe 2640 attrib.exe 2640 attrib.exe 1604 attrib.exe 1604 attrib.exe 2540 igdjolee1.exe 2540 igdjolee1.exe 944 igdjolee1.exe 944 igdjolee1.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File created C:\Windows\SysWOW64\igdjolee1.exe attrib.exe File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe attrib.exe File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe conhost.exe File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File created C:\Windows\SysWOW64\igdjolee1.exe igdjolee1.exe File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe attrib.exe File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found File opened for modification C:\Windows\SysWOW64\igdjolee1.exe Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2212 2356 3df5a240490fdd11f45de6081ce700bd.exe 30 PID 2356 wrote to memory of 2212 2356 3df5a240490fdd11f45de6081ce700bd.exe 30 PID 2356 wrote to memory of 2212 2356 3df5a240490fdd11f45de6081ce700bd.exe 30 PID 2356 wrote to memory of 2212 2356 3df5a240490fdd11f45de6081ce700bd.exe 30 PID 2356 wrote to memory of 2772 2356 3df5a240490fdd11f45de6081ce700bd.exe 28 PID 2356 wrote to memory of 2772 2356 3df5a240490fdd11f45de6081ce700bd.exe 28 PID 2356 wrote to memory of 2772 2356 3df5a240490fdd11f45de6081ce700bd.exe 28 PID 2356 wrote to memory of 2772 2356 3df5a240490fdd11f45de6081ce700bd.exe 28 PID 2772 wrote to memory of 2272 2772 igdjolee1.exe 42 PID 2772 wrote to memory of 2272 2772 igdjolee1.exe 42 PID 2772 wrote to memory of 2272 2772 igdjolee1.exe 42 PID 2772 wrote to memory of 2272 2772 igdjolee1.exe 42 PID 2772 wrote to memory of 2412 2772 igdjolee1.exe 41 PID 2772 wrote to memory of 2412 2772 igdjolee1.exe 41 PID 2772 wrote to memory of 2412 2772 igdjolee1.exe 41 PID 2772 wrote to memory of 2412 2772 igdjolee1.exe 41 PID 2412 wrote to memory of 2904 2412 igdjolee1.exe 39 PID 2412 wrote to memory of 2904 2412 igdjolee1.exe 39 PID 2412 wrote to memory of 2904 2412 igdjolee1.exe 39 PID 2412 wrote to memory of 2904 2412 igdjolee1.exe 39 PID 2412 wrote to memory of 2604 2412 igdjolee1.exe 38 PID 2412 wrote to memory of 2604 2412 igdjolee1.exe 38 PID 2412 wrote to memory of 2604 2412 igdjolee1.exe 38 PID 2412 wrote to memory of 2604 2412 igdjolee1.exe 38 PID 2212 wrote to memory of 2892 2212 cmd.exe 37 PID 2212 wrote to memory of 2892 2212 cmd.exe 37 PID 2212 wrote to memory of 2892 2212 cmd.exe 37 PID 2212 wrote to memory of 2892 2212 cmd.exe 37 PID 2604 wrote to memory of 2100 2604 igdjolee1.exe 35 PID 2604 wrote to memory of 2100 2604 igdjolee1.exe 35 PID 2604 wrote to memory of 2100 2604 igdjolee1.exe 35 PID 2604 wrote to memory of 2100 2604 igdjolee1.exe 35 PID 2604 wrote to memory of 2632 2604 igdjolee1.exe 34 PID 2604 wrote to memory of 2632 2604 igdjolee1.exe 34 PID 2604 wrote to memory of 2632 2604 igdjolee1.exe 34 PID 2604 wrote to memory of 2632 2604 igdjolee1.exe 34 PID 2632 wrote to memory of 1576 2632 igdjolee1.exe 32 PID 2632 wrote to memory of 1576 2632 igdjolee1.exe 32 PID 2632 wrote to memory of 1576 2632 igdjolee1.exe 32 PID 2632 wrote to memory of 1576 2632 igdjolee1.exe 32 PID 2632 wrote to memory of 2624 2632 igdjolee1.exe 31 PID 2632 wrote to memory of 2624 2632 igdjolee1.exe 31 PID 2632 wrote to memory of 2624 2632 igdjolee1.exe 31 PID 2632 wrote to memory of 2624 2632 igdjolee1.exe 31 PID 2624 wrote to memory of 2512 2624 igdjolee1.exe 44 PID 2624 wrote to memory of 2512 2624 igdjolee1.exe 44 PID 2624 wrote to memory of 2512 2624 igdjolee1.exe 44 PID 2624 wrote to memory of 2512 2624 igdjolee1.exe 44 PID 2624 wrote to memory of 2528 2624 igdjolee1.exe 46 PID 2624 wrote to memory of 2528 2624 igdjolee1.exe 46 PID 2624 wrote to memory of 2528 2624 igdjolee1.exe 46 PID 2624 wrote to memory of 2528 2624 igdjolee1.exe 46 PID 2272 wrote to memory of 2968 2272 cmd.exe 45 PID 2272 wrote to memory of 2968 2272 cmd.exe 45 PID 2272 wrote to memory of 2968 2272 cmd.exe 45 PID 2272 wrote to memory of 2968 2272 cmd.exe 45 PID 2528 wrote to memory of 1960 2528 igdjolee1.exe 49 PID 2528 wrote to memory of 1960 2528 igdjolee1.exe 49 PID 2528 wrote to memory of 1960 2528 igdjolee1.exe 49 PID 2528 wrote to memory of 1960 2528 igdjolee1.exe 49 PID 2528 wrote to memory of 1900 2528 igdjolee1.exe 48 PID 2528 wrote to memory of 1900 2528 igdjolee1.exe 48 PID 2528 wrote to memory of 1900 2528 igdjolee1.exe 48 PID 2528 wrote to memory of 1900 2528 igdjolee1.exe 48 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 5424 Process not Found 6172 Process not Found 7236 Process not Found 5620 attrib.exe 4320 Process not Found 6328 Process not Found 7772 Process not Found 6168 Process not Found 5640 Process not Found 5988 Process not Found 5304 Process not Found 5520 Process not Found 4980 Process not Found 7808 Process not Found 6040 Process not Found 1972 Process not Found 4208 Process not Found 6724 Process not Found 6808 Process not Found 3944 Process not Found 4912 Process not Found 7136 Process not Found 6028 Process not Found 6740 Process not Found 6344 Process not Found 6192 Process not Found 4916 Process not Found 6108 Process not Found 3944 Process not Found 5464 Process not Found 5168 Process not Found 6556 Process not Found 1816 Process not Found 5372 Process not Found 6088 Process not Found 6792 Process not Found 6920 Process not Found 7228 Process not Found 1816 Process not Found 5528 Process not Found 5448 Process not Found 5164 Process not Found 6036 Process not Found 6660 Process not Found 1816 Process not Found 4236 Process not Found 892 attrib.exe 5188 Process not Found 1472 Process not Found 5944 Process not Found 6428 Process not Found 5648 attrib.exe 5464 Process not Found 6408 Process not Found 4580 Process not Found 5780 Process not Found 5888 Process not Found 6188 Process not Found 4888 Process not Found 4580 Process not Found 5944 Process not Found 5432 Process not Found 3680 Process not Found 6740 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\3df5a240490fdd11f45de6081ce700bd.exe"C:\Users\Admin\AppData\Local\Temp\3df5a240490fdd11f45de6081ce700bd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397198.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:5296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:4100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:5592
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397152.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\3df5a240490fdd11f45de6081ce700bd.exe" -r -a -s -h3⤵PID:2892
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397261.bat2⤵PID:2512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:3056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:5280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:3112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:5604
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe5⤵PID:1312
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397339.bat5⤵PID:1524
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:1660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:1732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵
- Loads dropped DLL
PID:2276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:2580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:1692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:1560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:5448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:5652
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397308.bat4⤵PID:1656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵
- Views/modifies file attributes
PID:892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:1488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:1056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:1736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:5312
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397276.bat3⤵PID:1960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵
- Executes dropped EXE
PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:5116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:6044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1936
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397261.bat1⤵PID:1576
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5776
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397245.bat1⤵PID:2100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5460
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397230.bat1⤵PID:2904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵
- Drops file in System32 directory
PID:2060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5412
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397776.bat3⤵PID:1624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:1692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:5400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:3436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵
- Views/modifies file attributes
PID:5620
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe3⤵PID:2108
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe4⤵
- Executes dropped EXE
PID:2136 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe5⤵PID:2556
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398041.bat6⤵PID:772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:2520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:1768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:2164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:2712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:5344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:3388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:5536
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe6⤵PID:1544
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe7⤵PID:1728
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe8⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398462.bat9⤵PID:580
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:1560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵
- Loads dropped DLL
PID:2556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:5264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:3276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:5436
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398478.bat10⤵PID:2940
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:1468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:1696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:1144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:3228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:5464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:2276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:5728
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398509.bat11⤵PID:108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:2288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:2744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:1668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:4428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:5844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:4008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:5928
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe11⤵PID:2896
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe12⤵PID:2144
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398540.bat13⤵PID:2736
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:1144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:2712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:1060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵
- Executes dropped EXE
PID:2252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:3440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:5524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:4768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:5744
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe13⤵PID:2764
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398571.bat14⤵PID:2668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:1612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:2728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:2420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:3236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:5552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:4296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:5796
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398587.bat15⤵PID:2224
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:2264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:2288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:3944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:5600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:5024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:5960
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe15⤵PID:2452
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398602.bat16⤵PID:2752
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:3036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:3640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:5568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:4888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:6080
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe16⤵PID:2640
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe17⤵PID:1604
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398618.bat18⤵PID:2212
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:2952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵
- Loads dropped DLL
PID:2136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:1912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:3572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:5592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:4428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:5792
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe18⤵PID:2540
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398649.bat20⤵PID:1100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:1652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:3376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:5640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:5116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:5992
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe20⤵PID:2264
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398680.bat21⤵PID:1992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:2644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:2276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:4564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:5956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:5132
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe21⤵PID:240
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe22⤵PID:2252
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398696.bat23⤵PID:1980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:3036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:1488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:2908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:5216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:5276
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe23⤵
- Executes dropped EXE
PID:560 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe24⤵PID:1936
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398821.bat25⤵PID:1760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:2304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:1736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:1652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:3188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:5480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:4584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:5556
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe25⤵PID:2128
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259399086.bat26⤵PID:2584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:1572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:2884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:5232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:3228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:5420
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2540 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe27⤵
- Executes dropped EXE
PID:988 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259399726.bat28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:2304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:5248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:5588
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe28⤵PID:2460
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400116.bat29⤵PID:1696
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:4964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:5796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:5108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:5944
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe29⤵
- Executes dropped EXE
PID:820 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400490.bat30⤵PID:2180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:1476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:5352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:3684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:5524
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe30⤵PID:2044
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe31⤵PID:2368
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe32⤵PID:2744
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe33⤵PID:1888
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400568.bat34⤵PID:3016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:3492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:5432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:3948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:5608
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe34⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe35⤵PID:3028
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe36⤵PID:640
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe37⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400630.bat38⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:3992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:5456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:3880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:5572
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe38⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400630.bat39⤵PID:3052
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:3108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:5312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:3332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:5440
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe39⤵PID:592
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400646.bat40⤵PID:3036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:3224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:5500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:4076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:6016
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe40⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe41⤵PID:3028
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400677.bat42⤵PID:2572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:3448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:5616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:4884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:6040
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe42⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe43⤵
- Executes dropped EXE
PID:592 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe44⤵
- Executes dropped EXE
PID:2696
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400708.bat44⤵PID:2876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:3564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:5544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:4796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:5872
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400693.bat43⤵PID:1652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:3392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:5584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:4856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:5904
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400662.bat41⤵
- Executes dropped EXE
PID:2460 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:3144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:5472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:3800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:5760
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400615.bat37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:3860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:5424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:3368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:5636
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400599.bat36⤵PID:2952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:3848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:5392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:3568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:5660
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400584.bat35⤵PID:2508
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:3772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:5416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:3120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:5628
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400537.bat33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:3412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:5240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:3084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:5352
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400521.bat32⤵PID:1924
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:5440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:3292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:5512
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400506.bat31⤵PID:2384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:3700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:5408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:5736
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259399382.bat27⤵PID:1536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵
- Executes dropped EXE
PID:1936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:1084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:3680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:5624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:4964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:6056
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398712.bat24⤵PID:2020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:2792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:2520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:3400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:5548
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398680.bat22⤵PID:2064
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:2788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:2568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:1928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:4688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:6012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:5140
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398634.bat19⤵PID:1140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:1468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:2052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:3428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:5608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:4448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:5800
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398602.bat17⤵PID:2652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:2952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:2732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:3088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:5320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:3952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:5656
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398524.bat12⤵PID:900
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:2908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:2000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:3340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:5508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵
- Drops file in System32 directory
PID:4472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:5824
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398306.bat8⤵PID:2072
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:2180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:2712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:2304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:5336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:3564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:5516
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259398197.bat7⤵PID:1876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:1888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:1128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:1168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:3364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:5576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:3596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:5752
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397932.bat5⤵PID:2068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:1980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:2640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:2388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:3044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:5376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:3440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:5528
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397822.bat4⤵PID:2608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵
- Loads dropped DLL
PID:2804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:1556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:1692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:5368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:3448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:5520
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397588.bat2⤵PID:1904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:1612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:5160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:3044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:5232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397448.bat1⤵PID:1072
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1548
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5356
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397401.bat1⤵PID:588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h1⤵PID:576
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397370.bat1⤵PID:2028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5580
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
PID:2804
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259397339.bat1⤵PID:2636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2920
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:2580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:1976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5504
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "13577466720269174569350781031131984161-339436455-2072470999321542198-1252965556"1⤵PID:1460
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "17360019361866444938277486446104869462469991157-19949201314356370031922502885"1⤵PID:2324
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "3788164461404999121877214970158213616617996144578992948111873029892-513502113"1⤵PID:908
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2060501122-7882337921083944398-773777730642326072453071411-1462990451-1919896256"1⤵PID:2360
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "703386446-303745038-18660692771890070209-549275309-1415081964-4007267021683262328"1⤵PID:2680
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-346378361-357505318-145605046419505823712086775982-8526519671536127207-2094443980"1⤵
- Drops file in System32 directory
PID:776
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1928284810-9587392-327762648-12670073051250839077-110520129-1515157056465802592"1⤵PID:2468
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1926507185-1478986980-1107205303621439031453286269-401595584560406592-1103914540"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1017622677-8104494351313104359-1400295151-3608574883893144661144866224-610767043"1⤵PID:1344
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-18867729126761235681551972372933655549407660665-4554119031371110396334827680"1⤵PID:1468
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1695487208-1111308510422773507212486113-905259404498354801295286380-5754034"1⤵PID:2592
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "140608002213359578521326671502-2062537773-1658946830-615556511964486421-222301092"1⤵
- Executes dropped EXE
PID:2128
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "12118545446448876745888170316786322-1482671185-52259657-1448674434-327669392"1⤵PID:1616
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1145780752-1106322354-1819426562-2525467601417122830-11483340501857053919-1347372822"1⤵
- Executes dropped EXE
PID:2744
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-214650518683524921-521985883513586959320519641929544893-1724891721-1848234062"1⤵PID:2520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "565203361576706019670450760-103761107619442172991935718816284635261090032290"1⤵PID:2504
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2500094181842019215-10470513421677580775-27702326543766917411102248961310164529"1⤵
- Executes dropped EXE
PID:2368
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1362587061917654186-1290251548-121854181218787676862613693401665873266-2035411209"1⤵PID:576
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1098396201-14637835822017115491-1417096337-119245057725941257099434780243120219"1⤵
- Executes dropped EXE
PID:640
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400724.bat1⤵
- Executes dropped EXE
PID:240 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:3352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h2⤵PID:5984
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-32494467-16041321361983702220195364341617871066525414095605140080821198565993"1⤵PID:2000
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe1⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe2⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe3⤵PID:788
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400755.bat4⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:5632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:5068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h5⤵PID:5840
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe4⤵
- Executes dropped EXE
PID:400 -
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe5⤵PID:788
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe6⤵PID:3084
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe7⤵PID:3144
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400818.bat8⤵PID:3200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:3876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:5664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:4688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h9⤵PID:5860
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe8⤵PID:3208
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe9⤵PID:3264
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400849.bat10⤵PID:3320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:3596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:5812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:4260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h11⤵PID:6060
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe10⤵PID:3328
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe11⤵PID:3388
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe12⤵PID:3460
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe13⤵PID:3536
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400911.bat14⤵PID:3584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:4588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:5740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:4144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h15⤵PID:5896
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe14⤵PID:3592
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe15⤵PID:3656
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400942.bat16⤵PID:3692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:4664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:5748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:5092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h17⤵PID:5888
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe16⤵PID:3716
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe17⤵PID:3756
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400974.bat18⤵PID:3812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:4884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:5804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:4564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h19⤵PID:5952
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe18⤵PID:3820
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400989.bat19⤵PID:3892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:4980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:5820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h20⤵PID:5920
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe19⤵PID:3900
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe20⤵PID:3968
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401020.bat21⤵PID:4028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:5048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:1692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h22⤵PID:5236
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe21⤵PID:4036
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe22⤵PID:2132
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401052.bat23⤵PID:3180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:5108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:5972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h24⤵PID:5680
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe23⤵PID:3196
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe24⤵PID:3328
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe25⤵PID:3460
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401098.bat26⤵PID:3632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:4472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:5860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:5048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h27⤵PID:5916
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe26⤵PID:3596
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401114.bat27⤵PID:3784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:4612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:6076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h28⤵PID:5204
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe27⤵PID:3796
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe28⤵PID:3824
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe29⤵PID:4020
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe30⤵PID:3260
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401176.bat31⤵PID:3432
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:4844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:5892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:4420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h32⤵PID:6088
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe31⤵PID:3480
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe32⤵PID:3712
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe33⤵PID:3880
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401208.bat34⤵PID:1740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:5072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:6028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h35⤵PID:2200
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe34⤵PID:3980
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe35⤵PID:3104
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401239.bat36⤵PID:3560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:5076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:6004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h37⤵PID:2280
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe36⤵PID:3548
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe37⤵PID:3716
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401270.bat38⤵PID:3980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:5908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:2356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h39⤵PID:6096
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe38⤵PID:3260
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe39⤵PID:1816
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401301.bat40⤵PID:4024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:4252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:6068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h41⤵PID:5228
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe40⤵PID:3352
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe41⤵PID:3716
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe42⤵PID:4160
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe43⤵PID:4220
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe44⤵PID:4284
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401379.bat45⤵PID:4336
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h46⤵PID:5032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h46⤵PID:6020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h46⤵PID:2388
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe45⤵PID:4344
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401395.bat46⤵PID:4392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h47⤵PID:4536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h47⤵PID:6108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h47⤵PID:5224
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe46⤵PID:4400
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe47⤵PID:4472
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401426.bat48⤵PID:4528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h49⤵PID:4296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h49⤵PID:5852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h49⤵PID:2884
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe48⤵PID:4536
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe49⤵PID:4612
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401457.bat50⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h51⤵PID:4992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h51⤵PID:6132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h51⤵PID:5196
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe50⤵PID:4684
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401473.bat51⤵PID:4736
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h52⤵PID:5000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h52⤵PID:5940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h52⤵PID:5672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h52⤵PID:6112
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe51⤵PID:4744
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401488.bat52⤵PID:4808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h53⤵PID:5008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h53⤵PID:5900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h53⤵PID:4376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h53⤵PID:6104
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe52⤵PID:4816
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe53⤵PID:4876
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401520.bat54⤵PID:4936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h55⤵PID:4360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h55⤵PID:6140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h55⤵PID:5188
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe54⤵PID:4944
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401535.bat55⤵PID:5012
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h56⤵PID:4368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h56⤵PID:2304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h56⤵PID:5260
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe55⤵PID:5020
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe56⤵PID:5088
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401582.bat57⤵PID:3328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h58⤵PID:2884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h58⤵PID:1452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h58⤵PID:5308
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe57⤵PID:4120
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401598.bat58⤵PID:4188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h59⤵PID:1976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h59⤵PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h59⤵PID:5444
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe58⤵PID:4180
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401613.bat59⤵PID:4224
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h60⤵PID:2908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h60⤵PID:3496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h60⤵PID:5428
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe59⤵PID:4296
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401629.bat60⤵PID:4380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h61⤵PID:1056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h61⤵PID:3704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h61⤵PID:5396
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe60⤵PID:4348
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe61⤵PID:4500
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401660.bat62⤵PID:4644
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h63⤵PID:444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h63⤵PID:3416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h63⤵PID:5364
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe62⤵PID:4648
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401676.bat63⤵PID:4784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h64⤵PID:844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h64⤵PID:3996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h64⤵PID:5484
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe63⤵PID:4800
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe64⤵PID:4928
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401722.bat65⤵PID:4948
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h66⤵PID:2356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h66⤵PID:6116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h66⤵PID:5244
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe65⤵PID:2176
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401738.bat66⤵PID:4196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h67⤵PID:2432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h67⤵PID:4928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h67⤵PID:5348
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe66⤵PID:4124
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe67⤵PID:4296
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401769.bat68⤵PID:4504
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h69⤵PID:5144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h69⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h69⤵PID:5388
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe68⤵PID:4632
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401800.bat69⤵PID:4804
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h70⤵PID:5136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h70⤵PID:2228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h70⤵PID:5300
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe69⤵PID:4800
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe70⤵PID:3760
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401832.bat71⤵PID:4120
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h72⤵PID:5184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h72⤵PID:4088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h72⤵PID:5404
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe71⤵PID:4248
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401847.bat72⤵PID:4724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h73⤵PID:5192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h73⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h73⤵PID:5468
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe72⤵PID:4732
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401863.bat73⤵PID:5004
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h74⤵PID:5200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h74⤵PID:3488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h74⤵PID:5324
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe73⤵PID:4800
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401894.bat74⤵PID:600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h75⤵PID:5208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h75⤵PID:3772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h75⤵PID:5372
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe74⤵PID:4248
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259403095.bat75⤵PID:5700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h76⤵PID:5732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h76⤵PID:3716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h76⤵PID:5852
-
-
-
C:\Windows\SysWOW64\igdjolee1.exeC:\Windows\system32\igdjolee1.exe75⤵PID:6124
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401816.bat70⤵PID:5056
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h71⤵PID:5152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h71⤵PID:1972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h71⤵PID:5292
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401754.bat67⤵PID:4372
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h68⤵PID:5128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h68⤵PID:3420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h68⤵PID:5456
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401707.bat64⤵PID:4920
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h65⤵PID:1828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h65⤵PID:5168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h65⤵PID:5316
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401644.bat61⤵PID:4460
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h62⤵PID:2280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h62⤵PID:1476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h62⤵PID:5332
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401551.bat56⤵PID:5080
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h57⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h57⤵PID:2712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h57⤵PID:5240
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401504.bat53⤵PID:4868
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h54⤵PID:4176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h54⤵PID:6052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h54⤵PID:5384
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401442.bat49⤵PID:4604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h50⤵PID:2336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h50⤵PID:5924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h50⤵PID:1060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h50⤵PID:6064
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401410.bat47⤵PID:4464
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h48⤵PID:2944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h48⤵PID:6084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h48⤵PID:1128
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401364.bat44⤵PID:4276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:4908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:6100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h45⤵PID:5212
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401348.bat43⤵PID:4212
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:4576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:5828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:4320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h44⤵PID:6000
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401332.bat42⤵PID:4152
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:5996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h43⤵PID:5128
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401317.bat41⤵PID:4040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:4448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:5836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:4308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h42⤵PID:5976
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401286.bat39⤵PID:3460
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:4260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:6092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h40⤵PID:5148
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401254.bat37⤵PID:3832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:5092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:5932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h38⤵PID:2136
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401223.bat35⤵PID:4036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:4008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:5948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:2328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h36⤵PID:1824
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401208.bat33⤵PID:3808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:4072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:6060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h34⤵PID:5152
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401192.bat32⤵PID:3664
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:5068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:5884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:4912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h33⤵PID:1748
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401161.bat30⤵PID:3132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:4856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:5980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:5688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h31⤵PID:2824
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401145.bat29⤵PID:4012
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:4828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:5876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:4708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h30⤵PID:6048
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401130.bat28⤵PID:3856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:5868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:2176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h29⤵PID:6020
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401083.bat25⤵PID:3508
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:4516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:5988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h26⤵PID:5696
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401067.bat24⤵PID:3268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:4308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:5964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:5216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h25⤵PID:6120
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401036.bat22⤵PID:2728
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:3768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:6036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h23⤵PID:5156
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259401005.bat20⤵PID:3960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:4144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:5916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:4368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h21⤵PID:6140
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400942.bat17⤵PID:3744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:4768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:5780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h18⤵PID:960
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400927.bat15⤵PID:3648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:4620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:5756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:4236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h16⤵PID:5912
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400896.bat13⤵PID:3528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:5788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:5000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h14⤵PID:5968
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400880.bat12⤵PID:3452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:5772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h13⤵PID:5880
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400864.bat11⤵PID:3380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:3884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:5724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:5076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h12⤵PID:5784
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400833.bat9⤵PID:3248
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:2276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:5764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:2336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h10⤵PID:5876
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400802.bat7⤵PID:3136
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:5492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:4588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h8⤵PID:5768
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400786.bat6⤵PID:3076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵
- Views/modifies file attributes
PID:5648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:4576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h7⤵PID:5820
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400771.bat5⤵PID:1084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:5532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:4288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h6⤵PID:6024
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400755.bat3⤵PID:2420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:5516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:4256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h4⤵PID:6008
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\CBAN259400740.bat2⤵PID:2412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:5656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:4828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\igdjolee1.exe" -r -a -s -h3⤵PID:5856
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-906069665-168763382-1829176706-1834181939184740689608840981047416117-669395197"1⤵
- Loads dropped DLL
PID:1728
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "9418432402112474265450460285-206257630962280846-512049066924043992-241040610"1⤵PID:1488
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "240372262-794449522-1319520596686085112-89687163-13062626171636375544-1810051313"1⤵PID:1204
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "813030600129884465162621747337316441437733785-1584165705991050874-538842596"1⤵
- Executes dropped EXE
PID:3208
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-9090923881427393323-199855735490464999-335818877-1058216160-1027090118-863259913"1⤵PID:1668
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2039614279-1246736275-1160141914-11667763171686472528-1464347391-2018547543-1046072275"1⤵PID:3656
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "685763676667229285-1252360395-2121905669-210202238213793324731458651221556969380"1⤵PID:3796
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-81619865813969192261414231105-812858844-36350544-2056238907-1333658308-740910936"1⤵PID:4020
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "209156714-741273293-1392327031-1750590451-863044232-1671420446-2109343921-914626856"1⤵PID:3196
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "403292267257534858-19330020946894249126391350447558577131719640262-1123072368"1⤵PID:3712
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1926702271331801208-1400960194329005574-333012283-86906088416899602582005842144"1⤵PID:3260
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1169726786543600016-2023321703-16402913041734599352-1901510924-9333993262113700407"1⤵PID:4160
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-262489711-1509077317183003093410663959087316929731911483126-1771045139-1824476689"1⤵PID:4744
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-124844681716077666-1095273604-71623253716127413832078283633-16352125401414185857"1⤵PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
290B
MD5c87f11a89e5a9b8a5746b629ed9d6a61
SHA14dbe43c942cbcfe05ec8bf007fd8899a994356ca
SHA2567651827b1f8f77d1be0940bc374f9e14a3658e0d11445bee80d0115a7646ae6c
SHA51287b9316517c1f7936aafc6144498ca528dddc9f78e1feff4d08df2412eb7a534b60334ea5fef1d2e787615367fe841a035e9f48e4d0a9877dc3f2f02c66fb019
-
Filesize
179B
MD5d13e086dde121cd045153f2e3b875d35
SHA100f41117bb979db4f12fe4bed38296fc4f06e7da
SHA256c4f680ec51b63cf3022ba0962713df1cb69dd96e1490032a5292a63bf5844e46
SHA512ea64fb0ffdd9bb7b9b62a4d518550606fa5aed96da7a849ea65564c25ba09dc17867ac62e5b9ca05f04dbde3c9258b0a9269903e3d34df0ae5a405ce58d2bd2a
-
Filesize
5KB
MD53df5a240490fdd11f45de6081ce700bd
SHA1f44938d2c08aca417bc40a95e9cb55a677121ff5
SHA256b93acbe956e13cf3c2f1c00e5fbe98c5fbb75a53ea83e7da848c0a70e9d308d6
SHA51207d49108f9e57ac6bd18c9c9da1698791b063bcadac899004e7a77fa016fe4be3b50577c7a5ad01aa6c84059e1860ef7d19cdb5336a46ad906479da67ed4a3de