Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
76s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe
Resource
win7-20240708-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
4 signatures
150 seconds
General
-
Target
40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe
-
Size
2KB
-
MD5
40ba1455487b1ae8b76c6e89bd20aa1d
-
SHA1
d76004bb31a5a7a00b950f7349861e346c46cd23
-
SHA256
2203945283b793cba3d79605d3ffb421b7b74c5d0604885e2797f80e62348eb4
-
SHA512
0e0142cd26e541dd2ecf2b3ea9612c00773153f2075933e754f84b69dcd84859755a6db81fe73bf67dfd810d6002da2eea8fe1de4cdef4db37aea31550412481
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2024 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2512 ffIGBWD1046.exe 2796 ffIGBWD1046.exe 2824 ffIGBWD1046.exe 2260 ffIGBWD1046.exe 2804 ffIGBWD1046.exe 2780 ffIGBWD1046.exe 2676 ffIGBWD1046.exe 2612 ffIGBWD1046.exe 2972 ffIGBWD1046.exe 1684 ffIGBWD1046.exe 752 ffIGBWD1046.exe 2424 ffIGBWD1046.exe 2504 ffIGBWD1046.exe 2192 ffIGBWD1046.exe 1536 ffIGBWD1046.exe 1808 ffIGBWD1046.exe 2864 ffIGBWD1046.exe 2992 ffIGBWD1046.exe 1004 ffIGBWD1046.exe 2984 ffIGBWD1046.exe 1656 ffIGBWD1046.exe 2152 ffIGBWD1046.exe 1244 ffIGBWD1046.exe 2376 ffIGBWD1046.exe 1524 ffIGBWD1046.exe 2208 ffIGBWD1046.exe 1592 ffIGBWD1046.exe 2244 ffIGBWD1046.exe 1044 ffIGBWD1046.exe 1932 ffIGBWD1046.exe 2916 ffIGBWD1046.exe 608 ffIGBWD1046.exe 2824 ffIGBWD1046.exe 496 ffIGBWD1046.exe 1488 ffIGBWD1046.exe 2968 ffIGBWD1046.exe 2116 ffIGBWD1046.exe 2980 ffIGBWD1046.exe 2504 ffIGBWD1046.exe 2132 ffIGBWD1046.exe 2340 ffIGBWD1046.exe 1384 ffIGBWD1046.exe 2520 ffIGBWD1046.exe 1276 ffIGBWD1046.exe 2216 ffIGBWD1046.exe 2624 ffIGBWD1046.exe 2368 ffIGBWD1046.exe 752 ffIGBWD1046.exe 1812 ffIGBWD1046.exe 1592 ffIGBWD1046.exe 2836 ffIGBWD1046.exe 1444 ffIGBWD1046.exe 2596 ffIGBWD1046.exe 856 ffIGBWD1046.exe 2132 ffIGBWD1046.exe 892 ffIGBWD1046.exe 1996 ffIGBWD1046.exe 1600 ffIGBWD1046.exe 3016 ffIGBWD1046.exe 1648 ffIGBWD1046.exe 1812 ffIGBWD1046.exe 1280 ffIGBWD1046.exe 2216 ffIGBWD1046.exe 2736 ffIGBWD1046.exe -
Loads dropped DLL 64 IoCs
pid Process 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 2512 ffIGBWD1046.exe 2512 ffIGBWD1046.exe 2796 ffIGBWD1046.exe 2796 ffIGBWD1046.exe 2824 ffIGBWD1046.exe 2824 ffIGBWD1046.exe 2260 ffIGBWD1046.exe 2260 ffIGBWD1046.exe 2804 ffIGBWD1046.exe 2804 ffIGBWD1046.exe 2780 ffIGBWD1046.exe 2780 ffIGBWD1046.exe 2676 ffIGBWD1046.exe 2676 ffIGBWD1046.exe 2612 ffIGBWD1046.exe 2612 ffIGBWD1046.exe 2972 ffIGBWD1046.exe 2972 ffIGBWD1046.exe 1684 ffIGBWD1046.exe 1684 ffIGBWD1046.exe 752 ffIGBWD1046.exe 752 ffIGBWD1046.exe 2424 ffIGBWD1046.exe 2424 ffIGBWD1046.exe 2504 ffIGBWD1046.exe 2504 ffIGBWD1046.exe 2192 ffIGBWD1046.exe 2192 ffIGBWD1046.exe 1536 ffIGBWD1046.exe 1536 ffIGBWD1046.exe 1808 ffIGBWD1046.exe 1808 ffIGBWD1046.exe 2864 ffIGBWD1046.exe 2864 ffIGBWD1046.exe 2992 ffIGBWD1046.exe 2992 ffIGBWD1046.exe 1004 ffIGBWD1046.exe 1004 ffIGBWD1046.exe 2984 ffIGBWD1046.exe 2984 ffIGBWD1046.exe 1656 ffIGBWD1046.exe 1656 ffIGBWD1046.exe 2152 ffIGBWD1046.exe 2152 ffIGBWD1046.exe 1244 ffIGBWD1046.exe 1244 ffIGBWD1046.exe 2376 ffIGBWD1046.exe 2376 ffIGBWD1046.exe 1524 ffIGBWD1046.exe 1524 ffIGBWD1046.exe 2208 ffIGBWD1046.exe 2208 ffIGBWD1046.exe 1592 ffIGBWD1046.exe 1592 ffIGBWD1046.exe 2244 ffIGBWD1046.exe 2244 ffIGBWD1046.exe 1044 ffIGBWD1046.exe 1044 ffIGBWD1046.exe 1932 ffIGBWD1046.exe 1932 ffIGBWD1046.exe 2916 ffIGBWD1046.exe 2916 ffIGBWD1046.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 2024 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 30 PID 1288 wrote to memory of 2024 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 30 PID 1288 wrote to memory of 2024 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 30 PID 1288 wrote to memory of 2024 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 30 PID 1288 wrote to memory of 2512 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 32 PID 1288 wrote to memory of 2512 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 32 PID 1288 wrote to memory of 2512 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 32 PID 1288 wrote to memory of 2512 1288 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 32 PID 2512 wrote to memory of 1284 2512 ffIGBWD1046.exe 33 PID 2512 wrote to memory of 1284 2512 ffIGBWD1046.exe 33 PID 2512 wrote to memory of 1284 2512 ffIGBWD1046.exe 33 PID 2512 wrote to memory of 1284 2512 ffIGBWD1046.exe 33 PID 2512 wrote to memory of 2796 2512 ffIGBWD1046.exe 34 PID 2512 wrote to memory of 2796 2512 ffIGBWD1046.exe 34 PID 2512 wrote to memory of 2796 2512 ffIGBWD1046.exe 34 PID 2512 wrote to memory of 2796 2512 ffIGBWD1046.exe 34 PID 2796 wrote to memory of 2760 2796 ffIGBWD1046.exe 36 PID 2796 wrote to memory of 2760 2796 ffIGBWD1046.exe 36 PID 2796 wrote to memory of 2760 2796 ffIGBWD1046.exe 36 PID 2796 wrote to memory of 2760 2796 ffIGBWD1046.exe 36 PID 2796 wrote to memory of 2824 2796 ffIGBWD1046.exe 37 PID 2796 wrote to memory of 2824 2796 ffIGBWD1046.exe 37 PID 2796 wrote to memory of 2824 2796 ffIGBWD1046.exe 37 PID 2796 wrote to memory of 2824 2796 ffIGBWD1046.exe 37 PID 2824 wrote to memory of 2876 2824 ffIGBWD1046.exe 38 PID 2824 wrote to memory of 2876 2824 ffIGBWD1046.exe 38 PID 2824 wrote to memory of 2876 2824 ffIGBWD1046.exe 38 PID 2824 wrote to memory of 2876 2824 ffIGBWD1046.exe 38 PID 2824 wrote to memory of 2260 2824 ffIGBWD1046.exe 39 PID 2824 wrote to memory of 2260 2824 ffIGBWD1046.exe 39 PID 2824 wrote to memory of 2260 2824 ffIGBWD1046.exe 39 PID 2824 wrote to memory of 2260 2824 ffIGBWD1046.exe 39 PID 2260 wrote to memory of 2728 2260 ffIGBWD1046.exe 42 PID 2260 wrote to memory of 2728 2260 ffIGBWD1046.exe 42 PID 2260 wrote to memory of 2728 2260 ffIGBWD1046.exe 42 PID 2260 wrote to memory of 2728 2260 ffIGBWD1046.exe 42 PID 2024 wrote to memory of 2864 2024 cmd.exe 41 PID 2024 wrote to memory of 2864 2024 cmd.exe 41 PID 2024 wrote to memory of 2864 2024 cmd.exe 41 PID 2024 wrote to memory of 2864 2024 cmd.exe 41 PID 2260 wrote to memory of 2804 2260 ffIGBWD1046.exe 43 PID 2260 wrote to memory of 2804 2260 ffIGBWD1046.exe 43 PID 2260 wrote to memory of 2804 2260 ffIGBWD1046.exe 43 PID 2260 wrote to memory of 2804 2260 ffIGBWD1046.exe 43 PID 2804 wrote to memory of 2784 2804 ffIGBWD1046.exe 44 PID 2804 wrote to memory of 2784 2804 ffIGBWD1046.exe 44 PID 2804 wrote to memory of 2784 2804 ffIGBWD1046.exe 44 PID 2804 wrote to memory of 2784 2804 ffIGBWD1046.exe 44 PID 2804 wrote to memory of 2780 2804 ffIGBWD1046.exe 45 PID 2804 wrote to memory of 2780 2804 ffIGBWD1046.exe 45 PID 2804 wrote to memory of 2780 2804 ffIGBWD1046.exe 45 PID 2804 wrote to memory of 2780 2804 ffIGBWD1046.exe 45 PID 2780 wrote to memory of 2640 2780 ffIGBWD1046.exe 46 PID 2780 wrote to memory of 2640 2780 ffIGBWD1046.exe 46 PID 2780 wrote to memory of 2640 2780 ffIGBWD1046.exe 46 PID 2780 wrote to memory of 2640 2780 ffIGBWD1046.exe 46 PID 2780 wrote to memory of 2676 2780 ffIGBWD1046.exe 47 PID 2780 wrote to memory of 2676 2780 ffIGBWD1046.exe 47 PID 2780 wrote to memory of 2676 2780 ffIGBWD1046.exe 47 PID 2780 wrote to memory of 2676 2780 ffIGBWD1046.exe 47 PID 1284 wrote to memory of 1488 1284 cmd.exe 48 PID 1284 wrote to memory of 1488 1284 cmd.exe 48 PID 1284 wrote to memory of 1488 1284 cmd.exe 48 PID 1284 wrote to memory of 1488 1284 cmd.exe 48 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 2124 Process not Found 10860 Process not Found 11072 Process not Found 11316 Process not Found 10604 Process not Found 10968 Process not Found 11568 Process not Found 11448 Process not Found 11380 Process not Found 10768 Process not Found 3428 Process not Found 11732 Process not Found 3300 Process not Found 7416 attrib.exe 5216 Process not Found 11668 Process not Found 11824 Process not Found 7904 Process not Found 3632 Process not Found 7360 Process not Found 3064 Process not Found 4536 Process not Found 8232 Process not Found 11708 Process not Found 12180 Process not Found 9368 Process not Found 940 Process not Found 11720 Process not Found 12216 Process not Found 6008 Process not Found 10704 Process not Found 2096 Process not Found 6500 attrib.exe 3464 Process not Found 10448 Process not Found 11256 Process not Found 3644 Process not Found 5016 Process not Found 11000 Process not Found 10256 Process not Found 3596 attrib.exe 7960 Process not Found 9404 Process not Found 10904 Process not Found 10956 Process not Found 11596 Process not Found 11088 Process not Found 10552 Process not Found 11668 Process not Found 10868 Process not Found 10492 Process not Found 9864 Process not Found 6004 Process not Found 11392 Process not Found 10752 Process not Found 10952 Process not Found 9340 Process not Found 11600 Process not Found 10704 Process not Found 11404 Process not Found 5840 attrib.exe 10736 Process not Found 11388 Process not Found 9576 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443671.bat2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe" -r -a -s -h3⤵PID:2864
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443687.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:1488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:2508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:1028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:1976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:7328
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443749.bat4⤵PID:2760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:2908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:1500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:2344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:2524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:1988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:1004
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443749.bat5⤵PID:2876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:2148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:1044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:1728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:1448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:1144
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443765.bat6⤵PID:2728
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:2984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:2140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:1668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:2244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:7428
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443780.bat7⤵PID:2784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:1672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:2780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:7408
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443796.bat8⤵PID:2640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:2164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:2532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:2820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:9004
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443811.bat9⤵PID:688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:2376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:2836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:2748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:5952
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443843.bat10⤵PID:2956
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:1160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:1824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:2448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:5092
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443843.bat11⤵PID:2976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:1972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:1984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:8832
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443874.bat12⤵PID:616
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:1252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:2260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:2676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:8744
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443905.bat13⤵PID:2212
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:3632
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259443952.bat14⤵PID:2272
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:1096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:2804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:9436
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444030.bat15⤵PID:2240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:2060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:6792
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444045.bat16⤵PID:2200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:2872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:1992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:10276
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444123.bat17⤵PID:2428
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:7468
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444373.bat18⤵PID:2652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h19⤵PID:3300
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444420.bat19⤵PID:2004
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:5012
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444435.bat20⤵PID:2664
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h21⤵PID:3144
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444451.bat21⤵PID:1964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h22⤵PID:3644
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444467.bat22⤵PID:1328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵PID:3432
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444482.bat23⤵PID:2576
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h24⤵PID:3960
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444498.bat24⤵PID:408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:3624
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444498.bat25⤵PID:2492
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h26⤵PID:3660
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444513.bat26⤵PID:2324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h27⤵PID:3692
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444529.bat27⤵PID:1336
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h28⤵PID:3844
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444545.bat28⤵PID:952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h29⤵PID:3908
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444560.bat29⤵PID:1764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:3776
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444560.bat30⤵PID:1744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h31⤵PID:3732
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444576.bat31⤵PID:1788
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h32⤵PID:3424
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444607.bat32⤵PID:2536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h33⤵PID:3980
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444623.bat33⤵PID:1704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h34⤵
- Views/modifies file attributes
PID:3596
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe33⤵
- Executes dropped EXE
PID:608 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444638.bat34⤵PID:2684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h35⤵PID:3520
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe34⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444669.bat35⤵PID:1808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h36⤵PID:3440
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe35⤵
- Executes dropped EXE
PID:496 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444701.bat36⤵PID:2724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h37⤵PID:3460
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe36⤵
- Executes dropped EXE
PID:1488 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444716.bat37⤵PID:1632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:3468
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe37⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444732.bat38⤵PID:2152
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵PID:3836
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe38⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444747.bat39⤵PID:2376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h40⤵PID:3408
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe39⤵
- Executes dropped EXE
PID:2980 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444779.bat40⤵PID:824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h41⤵PID:4036
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe40⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444779.bat41⤵PID:2148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h42⤵PID:4088
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe41⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444794.bat42⤵PID:1816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:3832
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe42⤵
- Executes dropped EXE
PID:2340 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444810.bat43⤵PID:1844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h44⤵PID:3988
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe43⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444825.bat44⤵PID:2052
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h45⤵PID:2732
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe44⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444825.bat45⤵PID:1932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h46⤵PID:4736
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe45⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444841.bat46⤵PID:1804
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h47⤵PID:4768
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe46⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444857.bat47⤵PID:3008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h48⤵PID:3324
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe47⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444872.bat48⤵PID:496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h49⤵PID:5216
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe48⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444888.bat49⤵PID:1684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h50⤵PID:5032
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe49⤵
- Executes dropped EXE
PID:752 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444919.bat50⤵PID:2616
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h51⤵PID:4116
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe50⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444935.bat51⤵PID:1516
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h52⤵PID:2988
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe51⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444950.bat52⤵PID:1976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h53⤵PID:4416
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe52⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444966.bat53⤵PID:2624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h54⤵PID:5968
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1444 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259444981.bat54⤵PID:2368
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:4872
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe54⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445044.bat55⤵PID:1680
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h56⤵PID:5892
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe55⤵
- Executes dropped EXE
PID:856 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445059.bat56⤵PID:2592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h57⤵PID:6512
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe56⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445075.bat57⤵PID:2340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h58⤵PID:4672
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe57⤵
- Executes dropped EXE
PID:892 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445091.bat58⤵PID:1548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h59⤵
- Views/modifies file attributes
PID:6500
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe58⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445091.bat59⤵PID:3004
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h60⤵PID:6000
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe59⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445106.bat60⤵PID:1536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h61⤵PID:6132
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe60⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445122.bat61⤵PID:812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h62⤵PID:5984
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe61⤵
- Executes dropped EXE
PID:1648 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445153.bat62⤵PID:1740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h63⤵PID:7368
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe62⤵
- Executes dropped EXE
PID:1812 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445184.bat63⤵PID:1592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h64⤵PID:5768
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe63⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445184.bat64⤵PID:2208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h65⤵PID:5236
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe64⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445200.bat65⤵PID:2520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h66⤵PID:7360
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe65⤵
- Executes dropped EXE
PID:2736 -
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445215.bat66⤵PID:3016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h67⤵PID:7380
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe66⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445231.bat67⤵PID:1252
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h68⤵PID:7392
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe67⤵PID:3076
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445247.bat68⤵PID:3128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h69⤵PID:5776
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe68⤵PID:3140
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445262.bat69⤵PID:3248
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h70⤵PID:5696
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe69⤵PID:3256
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445278.bat70⤵PID:3292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h71⤵PID:5848
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe70⤵PID:3308
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445293.bat71⤵PID:3352
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h72⤵PID:5184
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe71⤵PID:3360
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445309.bat72⤵PID:3396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h73⤵PID:4304
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe72⤵PID:3412
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445325.bat73⤵PID:3500
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h74⤵PID:4412
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe73⤵PID:3508
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445356.bat74⤵PID:3552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h75⤵PID:4976
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe74⤵PID:3560
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445371.bat75⤵PID:3704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h76⤵PID:5444
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe75⤵PID:3712
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445387.bat76⤵PID:3768
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h77⤵PID:5560
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe76⤵PID:3784
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445403.bat77⤵PID:3820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h78⤵PID:5452
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe77⤵PID:3828
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445418.bat78⤵PID:3884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h79⤵PID:5208
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe78⤵PID:3892
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445434.bat79⤵PID:3944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h80⤵PID:5132
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe79⤵PID:3952
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445449.bat80⤵PID:4024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h81⤵PID:5228
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe80⤵PID:4072
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445481.bat81⤵PID:3112
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h82⤵PID:5504
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe81⤵PID:3116
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445496.bat82⤵PID:3260
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h83⤵PID:5496
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe82⤵PID:3264
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445527.bat83⤵PID:3328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h84⤵PID:5460
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe83⤵PID:3336
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445527.bat84⤵PID:3344
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h85⤵PID:5512
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe84⤵PID:3312
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445543.bat85⤵PID:3388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h86⤵PID:5960
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe85⤵PID:3416
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445559.bat86⤵PID:3672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h87⤵PID:5860
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe86⤵PID:3684
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445605.bat87⤵PID:3792
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h88⤵PID:4544
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe87⤵PID:3784
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445652.bat88⤵PID:3896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h89⤵
- Views/modifies file attributes
PID:5840
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe88⤵PID:3920
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445668.bat89⤵PID:4068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h90⤵
- Views/modifies file attributes
PID:7416
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe89⤵PID:4052
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445699.bat90⤵PID:3104
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h91⤵PID:5936
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe90⤵PID:4072
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445715.bat91⤵PID:3276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h92⤵PID:7400
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe91⤵PID:3284
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445730.bat92⤵PID:3652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h93⤵PID:7312
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe92⤵PID:3380
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445746.bat93⤵PID:3560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h94⤵PID:6528
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe93⤵PID:3832
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445777.bat94⤵PID:4008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h95⤵PID:7320
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe94⤵PID:4020
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445793.bat95⤵PID:3264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h96⤵PID:7336
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe95⤵PID:3212
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445824.bat96⤵PID:3416
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h97⤵PID:7436
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe96⤵PID:3364
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445839.bat97⤵PID:3548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h98⤵PID:7904
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe97⤵PID:3196
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445871.bat98⤵PID:4060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h99⤵PID:7196
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe98⤵PID:3220
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445886.bat99⤵PID:3368
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h100⤵PID:6372
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe99⤵PID:3244
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445886.bat100⤵PID:2884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h101⤵PID:7712
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe100⤵PID:3364
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445902.bat101⤵PID:3484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h102⤵PID:8172
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe101⤵PID:2852
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445917.bat102⤵PID:3920
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h103⤵PID:7188
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe102⤵PID:3220
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445933.bat103⤵PID:3244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h104⤵PID:8072
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe103⤵PID:2924
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445949.bat104⤵PID:3220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h105⤵PID:8008
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe104⤵PID:4104
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259445964.bat105⤵PID:4172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h106⤵PID:8052
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe105⤵PID:4180
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446011.bat106⤵PID:4264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h107⤵PID:8228
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe106⤵PID:4272
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446027.bat107⤵PID:4308
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h108⤵PID:7224
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe107⤵PID:4316
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446042.bat108⤵PID:4376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h109⤵PID:8736
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe108⤵PID:4384
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446058.bat109⤵PID:4428
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h110⤵PID:8752
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe109⤵PID:4436
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446073.bat110⤵PID:4480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h111⤵PID:6628
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe110⤵PID:4488
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446105.bat111⤵PID:4556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h112⤵PID:7888
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe111⤵PID:4564
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446136.bat112⤵PID:4632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h113⤵PID:8660
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe112⤵PID:4640
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446136.bat113⤵PID:4648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h114⤵PID:8840
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe113⤵PID:4656
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446151.bat114⤵PID:4716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h115⤵PID:7996
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe114⤵PID:4728
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446183.bat115⤵PID:4780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h116⤵PID:9132
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe115⤵PID:4788
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446198.bat116⤵PID:4836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h117⤵PID:7924
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe116⤵PID:4844
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446229.bat117⤵PID:4908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h118⤵PID:8620
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe117⤵PID:4916
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446245.bat118⤵PID:4952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h119⤵PID:8920
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe118⤵PID:4960
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446261.bat119⤵PID:4996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h120⤵PID:9100
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe119⤵PID:5004
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446276.bat120⤵PID:5076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h121⤵PID:7884
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe120⤵PID:5084
-
C:\Windows\SysWOW64\cmd.execmd /c c:\d8008d8e164c259446307.bat121⤵PID:4072
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h122⤵PID:9248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-