3beb594697f6b3b933436f318fb998484f6c0ea8f14e1d57cfd3fa720b614648

Analysis

max time kernel
90s
max time network
17s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

453155d693c6842c17d85d53707c6b16.exe
Size

4KB
MD5

453155d693c6842c17d85d53707c6b16
SHA1

b3ce31e2d195055950b4beba26777028f0581d42
SHA256

3beb594697f6b3b933436f318fb998484f6c0ea8f14e1d57cfd3fa720b614648
SHA512

e154f526b69843a64b0ef2fbf32bc6706fcaf7b63580444cd936a39ba02647938640189f47d48e1c664e15e55a53abc818da7eacfd599571cea83fe1af6f1fb6
SSDEEP

48:kCsPwYV/q73bOrHGpNYa13ftGBrolZ1gbM1aTayiGNGNGNGNGNGNGNGx:kJ3pqjb4HGpPvtGBeV1aTaM0000000x

Score

1^/10

Malware Config

Signatures

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
8892	attrib.exe
11072	attrib.exe
13692	attrib.exe
6996	attrib.exe
3352	attrib.exe
7332	attrib.exe
9140	attrib.exe
8444	attrib.exe
1676	attrib.exe
6764	attrib.exe
4108	attrib.exe
7596	attrib.exe
7124	attrib.exe
14656	attrib.exe
11620	attrib.exe
14768	attrib.exe
6988	attrib.exe
8728	attrib.exe
13980	attrib.exe
1584	attrib.exe
6956	attrib.exe
1064	attrib.exe
6340	attrib.exe
6188	attrib.exe
7524	attrib.exe
2376	attrib.exe
13348	attrib.exe
4108	attrib.exe
8732	attrib.exe
3892	attrib.exe
5668	attrib.exe
14596	attrib.exe
5776	attrib.exe
8220	attrib.exe
7152	attrib.exe
336	attrib.exe
1632	attrib.exe
6704	attrib.exe
5072	attrib.exe
15184	attrib.exe
14416	attrib.exe
5396	attrib.exe
7044	attrib.exe
13468	attrib.exe
3884	attrib.exe
6424	attrib.exe
5152	attrib.exe
8488	attrib.exe
3824	attrib.exe
7848	attrib.exe
8712	attrib.exe
5404	attrib.exe
3352	attrib.exe
9372	attrib.exe
14480	attrib.exe
6336	attrib.exe
12048	attrib.exe
1792	attrib.exe
12192	attrib.exe
13536	attrib.exe
3372	attrib.exe
3832	attrib.exe
10676	attrib.exe
7088	attrib.exe

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:2588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1752

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:2836

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:336

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1040

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:1584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259399180.bat
1⤵
PID:3188
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:3560
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7012
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:7136
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3864

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:4224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3848

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259399554.bat
1⤵
PID:4648
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:4924
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5280

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:4324
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\CBAN259457727.bat
  2⤵
  PID:6340

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:1700
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5168
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:336
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:6220
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:7832
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:7936
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:7972
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:8000
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5348
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5736

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259400162.bat
1⤵
PID:5576
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5544
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7996
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:14080

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6004
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:6288
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5152
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    - Views/modifies file attributes
    PID:9140
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:6996
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:10496
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7856
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:4852
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:2376

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6044

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:5572

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6352

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6460
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:6684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6868

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3600
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8388
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7220
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:9176
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:12444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4100
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6568

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7064
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:9164
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7948
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:13912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:1676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5020

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6580

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6668
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:3812
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6988
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:6604
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:1584
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5460
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:4064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7116
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:1724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6428

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7036
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:6308
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:14788
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:8896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6744
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:14036
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3368

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3140
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5508
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7676
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7660
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:14920
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:1008
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:9252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6616

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6648
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5504
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:6952
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:3284
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10860
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3888

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6868

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7004

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7052
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:3808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3932
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4440

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5992
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:6208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:1064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2764
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:9124
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:9992
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:4324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6196
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7404
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:11872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6868

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6368

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4616

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6328

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6644

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:552

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4924

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5220
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8348
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8636
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7352
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:12616

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\CBAN259459396.bat
  2⤵
  PID:15108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5860
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7336
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:6252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1040
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:15148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5636

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259420739.bat
1⤵
PID:7952

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:7416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6120

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8144

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:6188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7440

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7220

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:7848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\CBAN259426823.bat
  2⤵
  PID:6688
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:7496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:3352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6844
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:14364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5504
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:1792
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:8712

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6908
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:7292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7332

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:7596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6280

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8580

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9180
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:11084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:5668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:1584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8300

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8464
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8796
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9208

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259437213.bat
1⤵
PID:3408
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:8832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8940

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9204

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8552

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8400

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8720

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5356
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:5496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5772
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8140

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:7380

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259441253.bat
1⤵
PID:6828
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  - Views/modifies file attributes
  PID:14596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8216

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1584
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:11848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5216

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9076
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:8376
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
    3⤵
    PID:12396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7228

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6860

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8512

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:2376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1564

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7228
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:8892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3232
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10848
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:13652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4444

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259450629.bat
1⤵
PID:8260
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:10632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:15100

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259450754.bat
1⤵
PID:7452
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:11936
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:13428

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:9344

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:6208

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259451409.bat
1⤵
PID:10128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8512

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:10960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:10676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:11620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:12048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\CBAN259456104.bat
  2⤵
  PID:12168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6568

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10256

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8732

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:11296

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:10252

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:12968

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259455184.bat
1⤵
PID:12408

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:13024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12864

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259455839.bat
1⤵
PID:13832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13688

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259456011.bat
1⤵
PID:12184
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:13760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14108

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259456260.bat
1⤵
PID:14448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:13348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12032

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259456510.bat
1⤵
PID:14800
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
  2⤵
  PID:14372

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259456588.bat
1⤵
PID:14928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14352

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:15028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14892

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259457056.bat
1⤵
PID:15132

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259457165.bat
1⤵
PID:15200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:14416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14576

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:12192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:4444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7712

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259459287.bat
1⤵
PID:6276

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259459536.bat
1⤵
PID:10172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:3544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:13536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:14656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14828

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10612

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7864

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11120

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13888

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1248

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:14464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12916

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:15184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8564

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:9372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2012

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:14464
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:13472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13924

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5020

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12616

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:864

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10568

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13368

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14428

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:14768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:13692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13512

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:13980

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8888

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:14480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:13468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:13796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14168

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259481377.bat
1⤵
PID:13520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:1800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:11956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6248

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:9528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:12068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14092

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:16332

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259484762.bat
1⤵
PID:16072

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:16316

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:15860

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:16372

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:17080

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259485713.bat
1⤵
PID:16608

C:\Windows\SysWOW64\IGB_ZX_1015.exe
C:\Windows\system32\IGB_ZX_1015.exe
1⤵
PID:16840
- C:\Windows\SysWOW64\IGB_ZX_1015.exe
  C:\Windows\system32\IGB_ZX_1015.exe
  2⤵
  PID:16800

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\CBAN259485745.bat
1⤵
PID:16820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:5700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:2008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:10640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:8996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:11072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:6364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:7164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14940

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14568

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\IGB_ZX_1015.exe" -r -a -s -h
1⤵
PID:14252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads