Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe
Resource
win7-20240708-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe
Resource
win10v2004-20240709-en
4 signatures
150 seconds
General
-
Target
40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe
-
Size
2KB
-
MD5
40ba1455487b1ae8b76c6e89bd20aa1d
-
SHA1
d76004bb31a5a7a00b950f7349861e346c46cd23
-
SHA256
2203945283b793cba3d79605d3ffb421b7b74c5d0604885e2797f80e62348eb4
-
SHA512
0e0142cd26e541dd2ecf2b3ea9612c00773153f2075933e754f84b69dcd84859755a6db81fe73bf67dfd810d6002da2eea8fe1de4cdef4db37aea31550412481
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1084 ffIGBWD1046.exe 5068 ffIGBWD1046.exe 976 ffIGBWD1046.exe 1644 ffIGBWD1046.exe 4804 ffIGBWD1046.exe 4404 ffIGBWD1046.exe 5072 ffIGBWD1046.exe 2116 ffIGBWD1046.exe 4124 ffIGBWD1046.exe 1584 ffIGBWD1046.exe 2512 ffIGBWD1046.exe 1476 ffIGBWD1046.exe 2292 ffIGBWD1046.exe 4900 ffIGBWD1046.exe 5060 ffIGBWD1046.exe 3312 ffIGBWD1046.exe 4652 ffIGBWD1046.exe 4732 ffIGBWD1046.exe 1608 ffIGBWD1046.exe 2656 ffIGBWD1046.exe 3360 ffIGBWD1046.exe 2400 ffIGBWD1046.exe 264 ffIGBWD1046.exe 64 ffIGBWD1046.exe 2712 ffIGBWD1046.exe 2760 ffIGBWD1046.exe 2664 ffIGBWD1046.exe 4380 ffIGBWD1046.exe 4296 ffIGBWD1046.exe 1064 ffIGBWD1046.exe 4448 ffIGBWD1046.exe 996 ffIGBWD1046.exe 552 ffIGBWD1046.exe 4968 ffIGBWD1046.exe 4260 ffIGBWD1046.exe 1644 ffIGBWD1046.exe 3536 ffIGBWD1046.exe 2620 ffIGBWD1046.exe 3324 ffIGBWD1046.exe 4944 ffIGBWD1046.exe 4296 ffIGBWD1046.exe 2632 ffIGBWD1046.exe 3244 ffIGBWD1046.exe 5132 ffIGBWD1046.exe 5196 ffIGBWD1046.exe 5272 ffIGBWD1046.exe 5364 ffIGBWD1046.exe 5464 ffIGBWD1046.exe 5564 ffIGBWD1046.exe 5656 ffIGBWD1046.exe 5808 ffIGBWD1046.exe 5940 ffIGBWD1046.exe 6040 ffIGBWD1046.exe 6088 ffIGBWD1046.exe 5136 ffIGBWD1046.exe 4460 ffIGBWD1046.exe 3256 ffIGBWD1046.exe 396 ffIGBWD1046.exe 5432 ffIGBWD1046.exe 5796 ffIGBWD1046.exe 5880 ffIGBWD1046.exe 6092 ffIGBWD1046.exe 5192 ffIGBWD1046.exe 5424 ffIGBWD1046.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe Process not Found File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File created C:\Windows\SysWOW64\ffIGBWD1046.exe ffIGBWD1046.exe File opened for modification C:\Windows\SysWOW64\ffIGBWD1046.exe attrib.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 3944 2488 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 83 PID 2488 wrote to memory of 3944 2488 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 83 PID 2488 wrote to memory of 3944 2488 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 83 PID 2488 wrote to memory of 1084 2488 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 84 PID 2488 wrote to memory of 1084 2488 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 84 PID 2488 wrote to memory of 1084 2488 40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe 84 PID 1084 wrote to memory of 4292 1084 ffIGBWD1046.exe 86 PID 1084 wrote to memory of 4292 1084 ffIGBWD1046.exe 86 PID 1084 wrote to memory of 4292 1084 ffIGBWD1046.exe 86 PID 1084 wrote to memory of 5068 1084 ffIGBWD1046.exe 87 PID 1084 wrote to memory of 5068 1084 ffIGBWD1046.exe 87 PID 1084 wrote to memory of 5068 1084 ffIGBWD1046.exe 87 PID 5068 wrote to memory of 2100 5068 ffIGBWD1046.exe 88 PID 5068 wrote to memory of 2100 5068 ffIGBWD1046.exe 88 PID 5068 wrote to memory of 2100 5068 ffIGBWD1046.exe 88 PID 5068 wrote to memory of 976 5068 ffIGBWD1046.exe 89 PID 5068 wrote to memory of 976 5068 ffIGBWD1046.exe 89 PID 5068 wrote to memory of 976 5068 ffIGBWD1046.exe 89 PID 976 wrote to memory of 1636 976 ffIGBWD1046.exe 91 PID 976 wrote to memory of 1636 976 ffIGBWD1046.exe 91 PID 976 wrote to memory of 1636 976 ffIGBWD1046.exe 91 PID 976 wrote to memory of 1644 976 ffIGBWD1046.exe 92 PID 976 wrote to memory of 1644 976 ffIGBWD1046.exe 92 PID 976 wrote to memory of 1644 976 ffIGBWD1046.exe 92 PID 1644 wrote to memory of 4672 1644 ffIGBWD1046.exe 95 PID 1644 wrote to memory of 4672 1644 ffIGBWD1046.exe 95 PID 1644 wrote to memory of 4672 1644 ffIGBWD1046.exe 95 PID 1644 wrote to memory of 4804 1644 ffIGBWD1046.exe 96 PID 1644 wrote to memory of 4804 1644 ffIGBWD1046.exe 96 PID 1644 wrote to memory of 4804 1644 ffIGBWD1046.exe 96 PID 4804 wrote to memory of 2552 4804 ffIGBWD1046.exe 98 PID 4804 wrote to memory of 2552 4804 ffIGBWD1046.exe 98 PID 4804 wrote to memory of 2552 4804 ffIGBWD1046.exe 98 PID 4804 wrote to memory of 4404 4804 ffIGBWD1046.exe 99 PID 4804 wrote to memory of 4404 4804 ffIGBWD1046.exe 99 PID 4804 wrote to memory of 4404 4804 ffIGBWD1046.exe 99 PID 3944 wrote to memory of 2588 3944 cmd.exe 101 PID 3944 wrote to memory of 2588 3944 cmd.exe 101 PID 3944 wrote to memory of 2588 3944 cmd.exe 101 PID 4404 wrote to memory of 2096 4404 ffIGBWD1046.exe 102 PID 4404 wrote to memory of 2096 4404 ffIGBWD1046.exe 102 PID 4404 wrote to memory of 2096 4404 ffIGBWD1046.exe 102 PID 4404 wrote to memory of 5072 4404 ffIGBWD1046.exe 103 PID 4404 wrote to memory of 5072 4404 ffIGBWD1046.exe 103 PID 4404 wrote to memory of 5072 4404 ffIGBWD1046.exe 103 PID 5072 wrote to memory of 4948 5072 ffIGBWD1046.exe 105 PID 5072 wrote to memory of 4948 5072 ffIGBWD1046.exe 105 PID 5072 wrote to memory of 4948 5072 ffIGBWD1046.exe 105 PID 5072 wrote to memory of 2116 5072 ffIGBWD1046.exe 106 PID 5072 wrote to memory of 2116 5072 ffIGBWD1046.exe 106 PID 5072 wrote to memory of 2116 5072 ffIGBWD1046.exe 106 PID 2116 wrote to memory of 3076 2116 ffIGBWD1046.exe 108 PID 2116 wrote to memory of 3076 2116 ffIGBWD1046.exe 108 PID 2116 wrote to memory of 3076 2116 ffIGBWD1046.exe 108 PID 2116 wrote to memory of 4124 2116 ffIGBWD1046.exe 109 PID 2116 wrote to memory of 4124 2116 ffIGBWD1046.exe 109 PID 2116 wrote to memory of 4124 2116 ffIGBWD1046.exe 109 PID 4124 wrote to memory of 2992 4124 ffIGBWD1046.exe 111 PID 4124 wrote to memory of 2992 4124 ffIGBWD1046.exe 111 PID 4124 wrote to memory of 2992 4124 ffIGBWD1046.exe 111 PID 4124 wrote to memory of 1584 4124 ffIGBWD1046.exe 112 PID 4124 wrote to memory of 1584 4124 ffIGBWD1046.exe 112 PID 4124 wrote to memory of 1584 4124 ffIGBWD1046.exe 112 PID 4672 wrote to memory of 4484 4672 cmd.exe 113 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 10000 attrib.exe 11884 attrib.exe 8592 attrib.exe 10392 attrib.exe 11472 Process not Found 10704 Process not Found 13780 Process not Found 5684 attrib.exe 6500 attrib.exe 11768 attrib.exe 11676 Process not Found 14160 Process not Found 6068 attrib.exe 10164 attrib.exe 11072 attrib.exe 10396 attrib.exe 10164 attrib.exe 12368 Process not Found 6280 attrib.exe 10860 Process not Found 11476 Process not Found 2876 attrib.exe 10960 attrib.exe 10312 Process not Found 12832 Process not Found 5952 attrib.exe 7900 attrib.exe 9248 attrib.exe 10532 attrib.exe 12460 Process not Found 5832 attrib.exe 4156 attrib.exe 6368 attrib.exe 8456 attrib.exe 8784 attrib.exe 10480 attrib.exe 9424 Process not Found 14024 Process not Found 12572 Process not Found 12136 attrib.exe 11700 Process not Found 10388 Process not Found 13352 Process not Found 7140 attrib.exe 7216 attrib.exe 9000 attrib.exe 9468 attrib.exe 13360 Process not Found 5416 attrib.exe 11028 Process not Found 12084 Process not Found 13560 Process not Found 11496 attrib.exe 14120 Process not Found 14040 Process not Found 6688 attrib.exe 13808 Process not Found 2588 attrib.exe 2324 attrib.exe 8436 attrib.exe 7004 attrib.exe 11668 Process not Found 10000 Process not Found 11744 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618500.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\40ba1455487b1ae8b76c6e89bd20aa1d_JaffaCakes118.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:2588
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618531.bat3⤵PID:4292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:4772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵
- Views/modifies file attributes
PID:2324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:5588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:7072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:8940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:9904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h4⤵PID:6300
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618531.bat4⤵PID:2100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:3744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:2988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:6592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:8412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:9064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:10356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h5⤵PID:11844
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618562.bat5⤵PID:1636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:2232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:1064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:6416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:7272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:9176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h6⤵PID:10736
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618593.bat6⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:4484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:4796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:5480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:5884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:3688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵
- Views/modifies file attributes
PID:6688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:6388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:8504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:9672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h7⤵PID:12032
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618609.bat7⤵PID:2552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:1476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:5472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵
- Views/modifies file attributes
PID:5952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:6320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:9276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h8⤵PID:11864
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618640.bat8⤵PID:2096
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:3536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:5396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:5284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:9084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:8980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h9⤵PID:10448
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618671.bat9⤵PID:4948
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:4724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:1996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:6584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:7952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:9432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h10⤵PID:9884
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618703.bat10⤵PID:3076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:5068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:5572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:5472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:7648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:10156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h11⤵PID:9624
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618734.bat11⤵PID:2992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:4740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:5596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:5484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵
- Drops file in System32 directory
PID:7340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:7672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:10480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h12⤵PID:11736
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe11⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618812.bat12⤵PID:1988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:3696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:5696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:5208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:7092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:7764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:8380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h13⤵PID:11756
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe12⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618843.bat13⤵PID:5028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:2824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:5580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:6836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:9044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:7492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h14⤵PID:11912
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618890.bat14⤵PID:400
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:7256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:7760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:10568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h15⤵PID:12244
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe14⤵
- Executes dropped EXE
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618921.bat15⤵PID:1836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:2444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:6608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:8544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:9724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h16⤵PID:12172
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe15⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618968.bat16⤵PID:2480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:2632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:5132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:7232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:8880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h17⤵PID:10892
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe16⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240618984.bat17⤵PID:3572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:3688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵
- Drops file in System32 directory
PID:6488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:7996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:8308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:8260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h18⤵PID:10072
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe17⤵
- Executes dropped EXE
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619015.bat18⤵PID:4288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h19⤵PID:752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h19⤵PID:6468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h19⤵PID:8292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h19⤵PID:9852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h19⤵PID:12060
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe18⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619078.bat19⤵PID:4060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:3200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:5684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵
- Drops file in System32 directory
PID:5836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵
- Drops file in System32 directory
PID:6336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:6408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:6772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:8244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:7376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵PID:9396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h20⤵
- Views/modifies file attributes
PID:11744
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe19⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619109.bat20⤵PID:4316
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h21⤵PID:396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h21⤵
- Drops file in System32 directory
PID:6432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h21⤵PID:7492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h21⤵PID:8444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h21⤵PID:10052
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe20⤵
- Executes dropped EXE
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619140.bat21⤵PID:2904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h22⤵PID:4900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h22⤵PID:6600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h22⤵PID:8704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h22⤵PID:7528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h22⤵PID:12236
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe21⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619156.bat22⤵PID:3592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵PID:6524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵
- Drops file in System32 directory
PID:7960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵PID:6660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵PID:10444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h23⤵PID:10140
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe22⤵
- Executes dropped EXE
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619187.bat23⤵PID:4936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h24⤵PID:5152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h24⤵PID:6672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h24⤵PID:8368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h24⤵PID:9308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h24⤵PID:10872
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe23⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619218.bat24⤵PID:3000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:5388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:5492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:7120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:6528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:7968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵PID:8960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h25⤵
- Drops file in System32 directory
PID:10996
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe24⤵
- Executes dropped EXE
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619265.bat25⤵PID:4556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h26⤵
- Views/modifies file attributes
PID:5416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h26⤵PID:5792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h26⤵PID:7228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h26⤵PID:9592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h26⤵
- Views/modifies file attributes
PID:10396
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe25⤵
- Executes dropped EXE
PID:64 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619281.bat26⤵PID:4496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h27⤵PID:3288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h27⤵PID:5908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h27⤵PID:7636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h27⤵PID:7708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h27⤵PID:10800
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619343.bat27⤵PID:2880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h28⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h28⤵PID:6516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h28⤵PID:8404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h28⤵PID:6300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h28⤵PID:7272
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe27⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619406.bat28⤵PID:1076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h29⤵PID:5380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h29⤵PID:6068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h29⤵PID:7652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h29⤵PID:8788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h29⤵PID:9008
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619437.bat29⤵PID:636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:5424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:4796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:8136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:9580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:8408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h30⤵PID:10932
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe29⤵
- Executes dropped EXE
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619484.bat30⤵PID:1032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h31⤵PID:1644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h31⤵PID:5604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h31⤵PID:7616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h31⤵PID:8252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h31⤵PID:9372
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe30⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619515.bat31⤵PID:2492
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h32⤵PID:5496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h32⤵PID:6264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h32⤵PID:8420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h32⤵PID:5824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h32⤵PID:12020
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe31⤵
- Executes dropped EXE
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619562.bat32⤵PID:2244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h33⤵PID:5504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h33⤵
- Drops file in System32 directory
PID:3688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h33⤵PID:8892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h33⤵
- Views/modifies file attributes
PID:10392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h33⤵PID:11704
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619593.bat33⤵PID:4724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h34⤵
- Views/modifies file attributes
PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h34⤵PID:6440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h34⤵PID:8352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h34⤵PID:7612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h34⤵PID:9832
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe33⤵
- Executes dropped EXE
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619625.bat34⤵PID:2464
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h35⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h35⤵PID:5824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h35⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h35⤵PID:9040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h35⤵PID:10856
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe34⤵
- Executes dropped EXE
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619656.bat35⤵PID:1012
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h36⤵PID:2304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h36⤵
- Views/modifies file attributes
PID:6068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h36⤵PID:8640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h36⤵PID:8876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h36⤵PID:9624
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe35⤵
- Executes dropped EXE
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619687.bat36⤵PID:1692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h37⤵PID:5544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h37⤵PID:6152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h37⤵PID:8012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h37⤵PID:10888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h37⤵PID:9692
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe36⤵
- Executes dropped EXE
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619703.bat37⤵PID:4696
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV138⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:5604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:6136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:6048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:7140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:10040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h38⤵PID:11552
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe37⤵
- Executes dropped EXE
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619765.bat38⤵PID:4252
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵PID:5488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵PID:5952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵PID:6604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵
- Views/modifies file attributes
PID:7900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵PID:9008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h39⤵PID:9500
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe38⤵
- Executes dropped EXE
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619859.bat39⤵PID:4264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h40⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h40⤵PID:7780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h40⤵PID:6624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h40⤵PID:9832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h40⤵PID:11676
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe39⤵
- Executes dropped EXE
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619921.bat40⤵PID:4972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h41⤵PID:4176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h41⤵PID:7488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h41⤵PID:9040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h41⤵
- Drops file in System32 directory
PID:10104
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe40⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619953.bat41⤵PID:1336
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV142⤵PID:2712
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h42⤵PID:5444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h42⤵PID:7768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h42⤵
- Views/modifies file attributes
PID:7004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h42⤵
- Views/modifies file attributes
PID:9468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h42⤵
- Views/modifies file attributes
PID:10532
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe41⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240619984.bat42⤵PID:888
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:5876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:3756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:6868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:7084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:8220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h43⤵PID:8876
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe42⤵
- Executes dropped EXE
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620015.bat43⤵PID:4812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h44⤵PID:6168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h44⤵PID:7660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h44⤵PID:7652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h44⤵PID:10512
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620046.bat44⤵PID:884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h45⤵PID:4908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h45⤵
- Drops file in System32 directory
PID:6152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h45⤵
- Drops file in System32 directory
PID:9932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h45⤵
- Views/modifies file attributes
PID:10480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h45⤵PID:10796
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe44⤵
- Executes dropped EXE
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620062.bat45⤵PID:5124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h46⤵PID:6076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h46⤵PID:7908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h46⤵PID:9324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h46⤵
- Views/modifies file attributes
PID:10960
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe45⤵
- Executes dropped EXE
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620093.bat46⤵PID:5180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h47⤵
- Views/modifies file attributes
PID:5832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h47⤵PID:6660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h47⤵PID:9104
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h47⤵PID:448
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe46⤵
- Executes dropped EXE
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620140.bat47⤵PID:5264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h48⤵PID:816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h48⤵PID:7852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h48⤵PID:9316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h48⤵PID:9720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h48⤵PID:10220
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe47⤵
- Executes dropped EXE
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620359.bat48⤵PID:5348
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h49⤵PID:6576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h49⤵PID:8360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h49⤵PID:9820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h49⤵
- Views/modifies file attributes
PID:10164
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe48⤵
- Executes dropped EXE
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620421.bat49⤵PID:5456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h50⤵PID:6200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h50⤵PID:7244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h50⤵PID:9036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h50⤵PID:9060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h50⤵PID:12056
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe49⤵
- Executes dropped EXE
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620484.bat50⤵PID:5556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h51⤵PID:6236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h51⤵PID:8244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h51⤵PID:9060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h51⤵PID:10380
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe50⤵
- Executes dropped EXE
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620515.bat51⤵PID:5648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h52⤵PID:6408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h52⤵PID:8324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h52⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h52⤵PID:12284
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe51⤵
- Executes dropped EXE
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620593.bat52⤵PID:5800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h53⤵PID:5192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h53⤵PID:7996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h53⤵
- Drops file in System32 directory
PID:9064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h53⤵PID:7840
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe52⤵
- Executes dropped EXE
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620640.bat53⤵PID:5928
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h54⤵PID:6924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h54⤵PID:6300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h54⤵PID:9660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h54⤵PID:11348
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe53⤵
- Executes dropped EXE
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620687.bat54⤵PID:6032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵
- Views/modifies file attributes
PID:6500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:7704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:9020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:9380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:7760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:11132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h55⤵PID:12104
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620734.bat55⤵PID:6080
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV156⤵PID:3696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h56⤵PID:7128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h56⤵
- Drops file in System32 directory
PID:8972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h56⤵PID:9760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h56⤵PID:10704
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe55⤵
- Executes dropped EXE
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620796.bat56⤵PID:5172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h57⤵PID:6680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h57⤵PID:7204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h57⤵PID:8788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h57⤵PID:9952
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe56⤵
- Executes dropped EXE
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620843.bat57⤵PID:5340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h58⤵
- Views/modifies file attributes
PID:6368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h58⤵PID:9148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h58⤵PID:10488
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe57⤵
- Executes dropped EXE
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620875.bat58⤵PID:3116
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h59⤵
- Views/modifies file attributes
PID:4156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h59⤵PID:7668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h59⤵PID:8820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h59⤵PID:9840
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe58⤵
- Executes dropped EXE
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240620921.bat59⤵PID:4436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h60⤵PID:6232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h60⤵PID:6200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h60⤵PID:9984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h60⤵
- Views/modifies file attributes
PID:11496
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe59⤵
- Executes dropped EXE
PID:396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621015.bat60⤵PID:5564
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV161⤵PID:5152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h61⤵
- Drops file in System32 directory
PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h61⤵
- Views/modifies file attributes
PID:8456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h61⤵PID:10960
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe60⤵
- Executes dropped EXE
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621031.bat61⤵PID:5852
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV162⤵PID:5588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h62⤵PID:5500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h62⤵PID:8564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h62⤵PID:10688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h62⤵PID:12152
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe61⤵
- Executes dropped EXE
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621062.bat62⤵PID:5844
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV163⤵PID:5656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h63⤵PID:5504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h63⤵PID:6660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h63⤵PID:9008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h63⤵PID:7376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h63⤵PID:10668
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe62⤵
- Executes dropped EXE
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621093.bat63⤵PID:1436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h64⤵PID:6652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h64⤵PID:8512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h64⤵
- Drops file in System32 directory
PID:9620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h64⤵PID:12084
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe63⤵
- Executes dropped EXE
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621140.bat64⤵PID:3184
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV165⤵PID:2304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h65⤵PID:5484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h65⤵PID:8964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h65⤵PID:2440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h65⤵PID:10204
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe64⤵
- Executes dropped EXE
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621203.bat65⤵PID:5536
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV166⤵PID:5696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h66⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h66⤵PID:5276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h66⤵PID:11024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h66⤵PID:7652
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe65⤵
- Executes dropped EXE
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621265.bat66⤵PID:5820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h67⤵
- Views/modifies file attributes
PID:6280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h67⤵PID:9160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h67⤵PID:9988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h67⤵PID:11604
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe66⤵PID:5824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621312.bat67⤵PID:6004
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV168⤵PID:5684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h68⤵
- Views/modifies file attributes
PID:7140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h68⤵PID:7852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h68⤵PID:8012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h68⤵PID:12164
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe67⤵PID:5596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621359.bat68⤵PID:5968
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV169⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h69⤵PID:6228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h69⤵PID:8252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h69⤵PID:10160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h69⤵PID:10044
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe68⤵PID:4944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621390.bat69⤵PID:5132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h70⤵
- Views/modifies file attributes
PID:7216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h70⤵PID:6724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h70⤵
- Views/modifies file attributes
PID:11072
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe69⤵PID:5496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621421.bat70⤵PID:2188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h71⤵PID:7644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h71⤵
- Views/modifies file attributes
PID:9000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h71⤵PID:10028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h71⤵PID:10544
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe70⤵PID:6152
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621484.bat71⤵PID:6220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h72⤵PID:7684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h72⤵PID:8504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h72⤵PID:10348
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe71⤵PID:6228
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621500.bat72⤵PID:6308
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h73⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h73⤵
- Drops file in System32 directory
PID:7856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h73⤵PID:7648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h73⤵PID:12184
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe72⤵PID:6320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621515.bat73⤵PID:6380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h74⤵PID:7972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h74⤵
- Views/modifies file attributes
PID:9248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h74⤵PID:11036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h74⤵PID:11728
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe73⤵PID:6388
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621546.bat74⤵PID:6460
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h75⤵PID:8096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h75⤵PID:6720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h75⤵PID:7516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h75⤵PID:11672
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe74⤵PID:6476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621593.bat75⤵PID:6560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h76⤵PID:8008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h76⤵PID:9336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h76⤵PID:10820
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe75⤵PID:6568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621656.bat76⤵PID:6760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h77⤵PID:7756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h77⤵PID:7272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h77⤵PID:7652
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe76⤵PID:6768
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621687.bat77⤵PID:6840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h78⤵PID:7836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h78⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h78⤵PID:11208
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe77⤵PID:6848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621781.bat78⤵PID:7012
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h79⤵
- Drops file in System32 directory
PID:8120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h79⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h79⤵PID:9676
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe78⤵PID:7028
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621828.bat79⤵PID:7148
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV180⤵PID:752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h80⤵PID:6720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h80⤵PID:9720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h80⤵
- Drops file in System32 directory
PID:11000
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe79⤵PID:7156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240621921.bat80⤵PID:6148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h81⤵PID:7700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h81⤵PID:10056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h81⤵
- Drops file in System32 directory
PID:11664
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe80⤵PID:6216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622000.bat81⤵PID:6552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h82⤵PID:7200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h82⤵PID:7964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h82⤵PID:11012
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe81⤵PID:1348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622015.bat82⤵PID:6168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h83⤵PID:5296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h83⤵PID:10032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h83⤵PID:448
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe82⤵PID:6588
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622046.bat83⤵PID:6756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h84⤵PID:8156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h84⤵PID:9164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h84⤵
- Drops file in System32 directory
PID:10496
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe83⤵PID:6724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622062.bat84⤵PID:6712
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h85⤵PID:7068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h85⤵PID:8720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h85⤵PID:10464
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe84⤵PID:6944
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622093.bat85⤵PID:3224
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV186⤵PID:7156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h86⤵PID:7412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h86⤵PID:8824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h86⤵PID:10472
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe85⤵PID:6928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622140.bat86⤵PID:7080
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV187⤵PID:4176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h87⤵PID:7984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h87⤵PID:9348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h87⤵PID:11064
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe86⤵
- Drops file in System32 directory
PID:6184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622203.bat87⤵PID:5876
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV188⤵PID:4460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h88⤵PID:8300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h88⤵PID:7984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h88⤵PID:10828
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe87⤵PID:1348
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622234.bat88⤵PID:7060
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV189⤵PID:5192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h89⤵PID:8788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h89⤵PID:9804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h89⤵PID:10848
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe88⤵PID:6852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622281.bat89⤵PID:6180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h90⤵PID:7128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h90⤵PID:8280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h90⤵PID:9760
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe89⤵
- Drops file in System32 directory
PID:6428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622312.bat90⤵PID:4908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h91⤵PID:6680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h91⤵PID:9480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h91⤵
- Drops file in System32 directory
PID:10576
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe90⤵PID:6696
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622375.bat91⤵PID:6412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h92⤵
- Views/modifies file attributes
PID:8592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h92⤵PID:9152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h92⤵
- Drops file in System32 directory
PID:11772
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe91⤵PID:6468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622406.bat92⤵PID:6420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h93⤵PID:9060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h93⤵PID:10376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h93⤵PID:11064
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe92⤵PID:6592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622453.bat93⤵PID:6612
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV194⤵PID:6264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h94⤵PID:7652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h94⤵PID:10316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h94⤵PID:10356
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe93⤵PID:7024
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622515.bat94⤵PID:6596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h95⤵PID:8444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h95⤵PID:10844
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe94⤵PID:6592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622562.bat95⤵PID:7180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h96⤵PID:9068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h96⤵PID:9248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h96⤵PID:11404
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe95⤵PID:7188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622640.bat96⤵PID:7324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h97⤵PID:6432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h97⤵PID:9176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h97⤵
- Drops file in System32 directory
PID:11476
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe96⤵PID:7332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622671.bat97⤵PID:7384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h98⤵PID:8472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h98⤵PID:10704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h98⤵PID:9332
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe97⤵PID:7396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622703.bat98⤵PID:7444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h99⤵
- Views/modifies file attributes
PID:8436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h99⤵PID:10780
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe98⤵PID:7452
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622734.bat99⤵PID:7544
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h100⤵PID:8820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h100⤵PID:9744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h100⤵PID:8592
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe99⤵PID:7556
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622750.bat100⤵PID:7600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h101⤵PID:8956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h101⤵PID:10324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h101⤵
- Drops file in System32 directory
PID:10444
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe100⤵PID:7608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622812.bat101⤵PID:7712
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h102⤵PID:8980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h102⤵
- Drops file in System32 directory
PID:10044
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe101⤵PID:7720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240622890.bat102⤵PID:7884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h103⤵PID:7708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h103⤵PID:9608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h103⤵PID:10764
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe102⤵
- Drops file in System32 directory
PID:7892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623000.bat103⤵PID:8048
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h104⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h104⤵PID:10732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h104⤵PID:12260
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe103⤵PID:8056
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623062.bat104⤵PID:8168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h105⤵PID:9180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h105⤵PID:9176
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe104⤵PID:8176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623109.bat105⤵PID:7320
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1106⤵PID:6848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h106⤵PID:8988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h106⤵PID:10220
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe105⤵PID:7316
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623140.bat106⤵PID:6388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h107⤵
- Views/modifies file attributes
PID:8784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h107⤵PID:10300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h107⤵PID:10896
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe106⤵PID:7332
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623171.bat107⤵PID:6684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h108⤵
- Drops file in System32 directory
PID:8724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h108⤵PID:8788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h108⤵PID:9248
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe107⤵PID:7464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623203.bat108⤵PID:7588
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1109⤵PID:5604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h109⤵PID:8328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h109⤵PID:10308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h109⤵PID:11416
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe108⤵PID:7612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623328.bat109⤵PID:7880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h110⤵PID:9104
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h110⤵
- Views/modifies file attributes
PID:10000
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe109⤵PID:6852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623359.bat110⤵PID:8032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h111⤵PID:6772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h111⤵PID:9260
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe110⤵PID:7892
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623390.bat111⤵PID:6280
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h112⤵PID:8300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h112⤵PID:9316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h112⤵PID:10424
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe111⤵PID:8060
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623453.bat112⤵PID:6452
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1113⤵PID:6852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h113⤵PID:7840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h113⤵PID:10988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h113⤵PID:11988
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe112⤵PID:7472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623531.bat113⤵PID:7892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h114⤵PID:448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h114⤵PID:10316
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe113⤵PID:7084
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623562.bat114⤵PID:8204
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h115⤵PID:9240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h115⤵PID:9068
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe114⤵PID:8212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623609.bat115⤵PID:8272
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h116⤵PID:8816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h116⤵PID:10356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h116⤵PID:10864
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe115⤵
- Drops file in System32 directory
PID:8280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623656.bat116⤵PID:8460
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h117⤵PID:7760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h117⤵PID:11232
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe116⤵PID:8468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623703.bat117⤵PID:8568
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h118⤵PID:9388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h118⤵PID:9752
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe117⤵
- Drops file in System32 directory
PID:8576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623734.bat118⤵PID:8632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h119⤵PID:9508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h119⤵PID:10544
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe118⤵
- Drops file in System32 directory
PID:8640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623812.bat119⤵PID:8748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h120⤵PID:6720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h120⤵PID:9344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h120⤵PID:10968
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe119⤵PID:8756
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623859.bat120⤵PID:8896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h121⤵PID:9620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h121⤵
- Drops file in System32 directory
PID:10436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h121⤵PID:10644
-
-
-
C:\Windows\SysWOW64\ffIGBWD1046.exeC:\Windows\system32\ffIGBWD1046.exe120⤵PID:8904
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\d8008d8e164c240623921.bat121⤵PID:8992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\ffIGBWD1046.exe" -r -a -s -h122⤵PID:9896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-