Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 10:59
Static task
static1
Behavioral task
behavioral1
Sample
3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe
Resource
win10v2004-20220812-en
General
-
Target
3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe
-
Size
24KB
-
MD5
a076d0b6a8754d4b7f5910fa14d58fe0
-
SHA1
3cb2e37d1d4f67088184a47cc7929d065db85e2d
-
SHA256
3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
-
SHA512
aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
SSDEEP
768:veXiw5y5je+8QnUci38ISUu/ghw63/yQZdMuMzf:vve+1IXTuY1/y6Mz
Malware Config
Signatures
-
Executes dropped EXE 13 IoCs
pid Process 4856 swrcfac.exe 3244 swrcfac.exe 1748 swrcfac.exe 980 swrcfac.exe 4804 swrcfac.exe 3848 swrcfac.exe 1448 swrcfac.exe 2872 swrcfac.exe 2152 swrcfac.exe 4292 swrcfac.exe 2440 Process not Found 4752 swrcfac.exe 4748 Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\swrcfac.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\swrcfzc.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Conhost.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe cmd.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\swrcfzc.dll 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Conhost.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\swrcfzc.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File created C:\Windows\SysWOW64\swrcfzc.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\swrcfac.exe swrcfac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\swrcfac.exe swrcfac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\swrcfac.exe swrcfac.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe cmd.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe -
Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\Fonts\swrcfcsb.dll Process not Found File opened for modification C:\Windows\Fonts\swrcfcsb.dll 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\Fonts\wirebfw.fon 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\SysWOW64 swrcfac.exe File opened for modification C:\Windows\Fonts\swrcfcsb.dll swrcfac.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 7504 2760 Process not Found 7732 6268 13208 Process not Found 7789 -
Modifies registry class 42 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ThreadingModel = "Apartment" swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7} 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32 swrcfac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{778A7521-FA87-34AB-34C2-4893F3AD34C7}\InprocServer32\ = "C:\\Windows\\SysWow64\\swrcfzc.dll" swrcfac.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 4856 swrcfac.exe 4856 swrcfac.exe 3244 swrcfac.exe 3244 swrcfac.exe 1748 swrcfac.exe 1748 swrcfac.exe 980 swrcfac.exe 980 swrcfac.exe 4804 swrcfac.exe 4804 swrcfac.exe 3848 swrcfac.exe 3848 swrcfac.exe 1448 swrcfac.exe 1448 swrcfac.exe 2872 swrcfac.exe 2872 swrcfac.exe 2152 swrcfac.exe 2152 swrcfac.exe 4292 Process not Found 4292 Process not Found 4752 swrcfac.exe 4752 swrcfac.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4988 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 80 PID 4648 wrote to memory of 4988 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 80 PID 4648 wrote to memory of 4988 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 80 PID 4648 wrote to memory of 4856 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 82 PID 4648 wrote to memory of 4856 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 82 PID 4648 wrote to memory of 4856 4648 3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe 82 PID 4988 wrote to memory of 4960 4988 cmd.exe 83 PID 4988 wrote to memory of 4960 4988 cmd.exe 83 PID 4988 wrote to memory of 4960 4988 cmd.exe 83 PID 4856 wrote to memory of 4712 4856 swrcfac.exe 84 PID 4856 wrote to memory of 4712 4856 swrcfac.exe 84 PID 4856 wrote to memory of 4712 4856 swrcfac.exe 84 PID 4712 wrote to memory of 4520 4712 cmd.exe 86 PID 4712 wrote to memory of 4520 4712 cmd.exe 86 PID 4712 wrote to memory of 4520 4712 cmd.exe 86 PID 4988 wrote to memory of 2764 4988 cmd.exe 87 PID 4988 wrote to memory of 2764 4988 cmd.exe 87 PID 4988 wrote to memory of 2764 4988 cmd.exe 87 PID 4712 wrote to memory of 4380 4712 cmd.exe 88 PID 4712 wrote to memory of 4380 4712 cmd.exe 88 PID 4712 wrote to memory of 4380 4712 cmd.exe 88 PID 4988 wrote to memory of 1132 4988 cmd.exe 89 PID 4988 wrote to memory of 1132 4988 cmd.exe 89 PID 4988 wrote to memory of 1132 4988 cmd.exe 89 PID 4712 wrote to memory of 3556 4712 cmd.exe 90 PID 4712 wrote to memory of 3556 4712 cmd.exe 90 PID 4712 wrote to memory of 3556 4712 cmd.exe 90 PID 4988 wrote to memory of 5040 4988 cmd.exe 91 PID 4988 wrote to memory of 5040 4988 cmd.exe 91 PID 4988 wrote to memory of 5040 4988 cmd.exe 91 PID 4712 wrote to memory of 2372 4712 cmd.exe 92 PID 4712 wrote to memory of 2372 4712 cmd.exe 92 PID 4712 wrote to memory of 2372 4712 cmd.exe 92 PID 4988 wrote to memory of 4820 4988 cmd.exe 93 PID 4988 wrote to memory of 4820 4988 cmd.exe 93 PID 4988 wrote to memory of 4820 4988 cmd.exe 93 PID 4712 wrote to memory of 5004 4712 cmd.exe 94 PID 4712 wrote to memory of 5004 4712 cmd.exe 94 PID 4712 wrote to memory of 5004 4712 cmd.exe 94 PID 4988 wrote to memory of 2928 4988 cmd.exe 95 PID 4988 wrote to memory of 2928 4988 cmd.exe 95 PID 4988 wrote to memory of 2928 4988 cmd.exe 95 PID 4856 wrote to memory of 3244 4856 swrcfac.exe 96 PID 4856 wrote to memory of 3244 4856 swrcfac.exe 96 PID 4856 wrote to memory of 3244 4856 swrcfac.exe 96 PID 4712 wrote to memory of 320 4712 cmd.exe 98 PID 4712 wrote to memory of 320 4712 cmd.exe 98 PID 4712 wrote to memory of 320 4712 cmd.exe 98 PID 4988 wrote to memory of 4500 4988 cmd.exe 97 PID 4988 wrote to memory of 4500 4988 cmd.exe 97 PID 4988 wrote to memory of 4500 4988 cmd.exe 97 PID 4712 wrote to memory of 4424 4712 cmd.exe 99 PID 4712 wrote to memory of 4424 4712 cmd.exe 99 PID 4712 wrote to memory of 4424 4712 cmd.exe 99 PID 4988 wrote to memory of 460 4988 cmd.exe 100 PID 4988 wrote to memory of 460 4988 cmd.exe 100 PID 4988 wrote to memory of 460 4988 cmd.exe 100 PID 4712 wrote to memory of 2152 4712 cmd.exe 102 PID 4712 wrote to memory of 2152 4712 cmd.exe 102 PID 4712 wrote to memory of 2152 4712 cmd.exe 102 PID 4988 wrote to memory of 3696 4988 cmd.exe 101 PID 4988 wrote to memory of 3696 4988 cmd.exe 101 PID 4988 wrote to memory of 3696 4988 cmd.exe 101 PID 4988 wrote to memory of 4300 4988 cmd.exe 104 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 5016 Process not Found 5480 Process not Found 4180 Process not Found 7312 Process not Found 11072 Process not Found 11392 Process not Found 5712 Process not Found 7896 Process not Found 9976 Process not Found 8348 Process not Found 6628 Process not Found 3268 attrib.exe 6956 Process not Found 3032 Process not Found 10136 Process not Found 2308 attrib.exe 4344 attrib.exe 4632 attrib.exe 4492 Process not Found 5488 Process not Found 5324 Process not Found 8132 Process not Found 6996 Process not Found 8888 Process not Found 11888 Process not Found 12924 Process not Found 13232 Process not Found 4508 attrib.exe 8128 Process not Found 7188 Process not Found 5536 Process not Found 1956 Process not Found 10416 Process not Found 5896 Process not Found 3628 Process not Found 6032 Process not Found 7984 Process not Found 7492 Process not Found 7256 Process not Found 11048 Process not Found 3076 Process not Found 3936 attrib.exe 5412 Process not Found 9144 Process not Found 3304 Process not Found 1268 attrib.exe 5488 Process not Found 4372 Process not Found 8648 Process not Found 9104 Process not Found 6428 Process not Found 9632 Process not Found 13120 Process not Found 9920 Process not Found 14224 Process not Found 7284 Process not Found 7968 Process not Found 12636 Process not Found 3076 attrib.exe 6088 Process not Found 9808 Process not Found 9944 Process not Found 10264 Process not Found 6628 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe"C:\Users\Admin\AppData\Local\Temp\3ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240585031.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:64
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:1600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:1680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:4344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:208
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240586515.bat3⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:3848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:3472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:4556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1444
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240587375.bat4⤵PID:916
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵
- Drops file in System32 directory
PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵
- Drops file in System32 directory
PID:3252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵
- Drops file in System32 directory
PID:3512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵
- Drops file in System32 directory
PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵
- Drops file in System32 directory
PID:3436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4728
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240588312.bat5⤵PID:1404
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵
- Drops file in System32 directory
PID:5116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4252
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240589171.bat6⤵PID:3844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵
- Drops file in System32 directory
PID:3808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:260
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵
- Drops file in System32 directory
PID:2256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2428
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵
- Drops file in System32 directory
PID:5096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵
- Drops file in System32 directory
PID:2052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵
- Views/modifies file attributes
PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4252
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240589890.bat7⤵PID:4380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:5008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Drops file in System32 directory
PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4480
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Drops file in System32 directory
PID:4596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:5040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Drops file in System32 directory
PID:3776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Drops file in System32 directory
PID:2056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Drops file in System32 directory
PID:492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:4492
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240590578.bat8⤵PID:716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵
- Drops file in System32 directory
PID:3636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:5012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:3124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:4288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2680
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240591312.bat9⤵PID:2136
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵
- Drops file in System32 directory
PID:1592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:1760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:1780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:5024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4104
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵
- Drops file in System32 directory
PID:2128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:4864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:208
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240592062.bat10⤵PID:3740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵
- Drops file in System32 directory
PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:5040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:5024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵
- Drops file in System32 directory
PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵
- Drops file in System32 directory
PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1264
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240592765.bat11⤵PID:4392
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵PID:4404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:5012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵
- Drops file in System32 directory
PID:4476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:4700
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe11⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240593468.bat12⤵
- Drops file in System32 directory
PID:5008 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵
- Drops file in System32 directory
PID:4848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵
- Views/modifies file attributes
PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:1272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:1860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:1860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:3748
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe12⤵PID:2440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240594125.bat13⤵PID:1648
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵
- Drops file in System32 directory
PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:5096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:4288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:448
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240594828.bat14⤵PID:1508
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:64
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵
- Views/modifies file attributes
PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:4440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3032
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe14⤵PID:4748
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240595500.bat15⤵PID:3356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2028
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵
- Views/modifies file attributes
PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:4964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵
- Drops file in System32 directory
PID:2112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:4124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:3296
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe15⤵PID:3196
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240596171.bat16⤵PID:2428
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵PID:1764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵
- Drops file in System32 directory
PID:3472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:2296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:2400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1132
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe16⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240596875.bat17⤵PID:4496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:4700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:1344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:3296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:4632
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe17⤵PID:4600
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240597625.bat18⤵PID:3252
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵
- Drops file in System32 directory
PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:2364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:1844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵
- Views/modifies file attributes
PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵
- Drops file in System32 directory
PID:3840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:1948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h19⤵PID:4084
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe18⤵PID:3464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240598328.bat19⤵PID:4424
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:2772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:1996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:4848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:4288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:64
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:3600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:3600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h20⤵PID:4948
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe19⤵PID:2240
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240599031.bat20⤵PID:2820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:1268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:2204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:2036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:3584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵
- Drops file in System32 directory
PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:3304
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h21⤵PID:4964
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe20⤵PID:1456
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240599718.bat21⤵PID:1968
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV122⤵PID:1664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:2312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:3892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:4948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:3840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:4964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:3864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h22⤵PID:3928
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe21⤵PID:3216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240600421.bat22⤵PID:3784
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
- Drops file in System32 directory
PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:4440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:2168
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵PID:1544
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:1788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:1788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:2340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h23⤵PID:2916
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe22⤵PID:4100
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240601109.bat23⤵PID:4324
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV124⤵PID:2252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:4212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:2392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:5024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:4288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:4792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:1264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵
- Views/modifies file attributes
PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:2900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h24⤵PID:4108
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe23⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240601890.bat24⤵
- Drops file in System32 directory
PID:4300 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV125⤵
- Drops file in System32 directory
PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:1740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:4492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:3120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:3748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h25⤵PID:3864
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe24⤵PID:1624
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240603046.bat25⤵PID:2168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:2044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:4644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:4036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:1444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:4548
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h26⤵PID:4548
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe25⤵PID:4072
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240603734.bat26⤵PID:2576
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV127⤵PID:3100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h27⤵PID:1924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h27⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h27⤵PID:3176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h27⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h27⤵PID:4840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h27⤵PID:1132
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe26⤵PID:4860
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240604421.bat27⤵PID:4264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h28⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h28⤵PID:3232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h28⤵PID:448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h28⤵PID:3076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h28⤵PID:32
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h28⤵
- Drops file in System32 directory
PID:3748
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe27⤵PID:2364
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240605109.bat28⤵PID:64
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h29⤵PID:4728
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h29⤵PID:1076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h29⤵PID:212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h29⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h29⤵PID:448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h29⤵PID:3304
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe28⤵PID:4668
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240605812.bat29⤵PID:1952
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV130⤵PID:5052
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h30⤵PID:4084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h30⤵PID:2916
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe29⤵PID:4468
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240606484.bat30⤵PID:876
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV131⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h31⤵PID:4840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h31⤵PID:32
-
-
-
C:\Windows\SysWOW64\swrcfac.exeC:\Windows\system32\swrcfac.exe30⤵PID:2900
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240607421.bat31⤵PID:2720
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
271B
MD500095097a2f07167471600dc07d9c882
SHA1f008cbaf5c7a2a9feda77472713c365a45048ff9
SHA256c07fa9fb751fde559c4b95352aa6c02143213329e43bf9fcdd1184456e77097f
SHA51232a094c9aaf95a825bd8d709957291d6c255d1f213898e3b5861ddd88bd854daabde12c77b11efb33ee9b79d468a32ac95174a4ef00ec9a86f4c53343376c5e1
-
Filesize
529B
MD51b60f1eb49918f0066b971e0661c5848
SHA1c6b48692f489a8631aa1a226bf992b6869ecab94
SHA256f2d63772b6df37e0782886b7c531614c1a213a0693ee977dc5299092a4a39a6a
SHA51223f4fca8a0a32fc55f52cc8c612a87650275c17f9e5d74da646485b470ee4e175fb68cb9dfa3c5cadc2b078a71db6da803df5a29548530e448b4f9868578118a
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
24KB
MD5a076d0b6a8754d4b7f5910fa14d58fe0
SHA13cb2e37d1d4f67088184a47cc7929d065db85e2d
SHA2563ce7b24fe0a8d8561fbe3d1eb2d7c898a21ef619bb71da7bf26463234bfa5770
SHA512aaf68bae55bccb35d750fe525dc414289d5f7a14435c4c3fe9214df953ce670c0aafaf0fa6f71fc7a3c397793cdafce94faa55ef21a7fa786739ac21b3ebebf2
-
Filesize
513KB
MD5e0d78ecbe9c0ed0963fb93b686f333b6
SHA146fd1a873f79f30033721168dc05e9813f953bc1
SHA25625f3c468e942b8a8fca938676bdaaf8767c118829cedb50fe6045e3abd8a5159
SHA5124602841d79a1efb4cdcb051e1bfc8109ceecae8fb0edd26eecc501cc20017195d53e678cb16aa01b90d10dcfd50f7a20787770e642eead32cb80319234e737cf
-
Filesize
513KB
MD5b06e33ec531407743076f126a5e78027
SHA1610eff9e15acae11878b1dd04b78c00da1f2d284
SHA25656746c9610d12a53be84bf9ccf27d78fcafce70c98c3e4583a1465f5d86509f2
SHA5121f9393e5adf8c6c047c223386a6386c663feca88dec1edfe5dd32a7cb0d3a35b05cdddb8ec7cf0c86cee6fc3a24c9cf233cb9e568837e42317b6251f19bfc7d6
-
Filesize
513KB
MD5e68f29c129cc01e913cbf0ed82ec4420
SHA168c9195a7ef3fddfd43b27d3548256fdb1135e92
SHA2565b02acabccfbfa039f0f4d81626f7035154a2f466014195e1cae171e8444f8ea
SHA512c10b7015932cc0e10deba6ee094a7e51f41b0dfb667fc5c0406ad32c69bb00e574e47533722bd13946ccd74f0f038cb2123fc079ad4e12e440e24d11142ea208
-
Filesize
513KB
MD5f0289cbeb2fce5c5474791f4e8e93ee0
SHA1486d570615410864408b67014eeee96e41311613
SHA25672af974965609f8971de59c3dae53d618a14d19f6efe3645d59a2681c293739b
SHA512f5fdc95aa66a34781c62bab6045c46018429a06324178f8cf22334b75acc1144d4367cb7873954379ff9fd5ba1058daad19240d830fed1bc6a1eef9901571829
-
Filesize
513KB
MD5b3eb8da5709ee9d3cf1cc88e5f6ce62f
SHA125d4717dcbb4f628267aad3208a6948c9609e57b
SHA25663102fd9a08cf9ac31dab13803048381d7f8c695c0770d6f603bdd911cf43cbd
SHA5125820a38cb30f32b612f35aeafdd5eb732415288e407b102422dd1d46bc2a421b39b2e3679ef09ed511b246341429786d5003aef2862d2686f5c8df807c94ca90
-
Filesize
513KB
MD575e77e1b04a762487581fa907db0cd93
SHA141c01d99840150c649f74ebe32376f5c66c42e79
SHA256c0743e0511f35edb0a3797d8f45f823f8cbb190783439b2e8f8ed7952f06e6cc
SHA512d18087e4fd662e196e6aa5c8fefd42bdaccc0507834d1e94d49fcd87c3d42295f81d39cf616ea861f80c35a22d2617e17c63a50725e79c238f1dc5e275f13d54
-
Filesize
513KB
MD516c02d3afbf935864ec6f6e339610381
SHA1cec83b804a0686955e8cfb6a32008ebe640ed6ef
SHA2561d01538a112de850acfa590add5ad8ed1c3b05a099b1dcb3784a2b3bc4eadeea
SHA512832eafe39fa74918efa9b646672f3cc029fbc71aba0d821f76fed958c6853aea4b6bb2f4c38a217dc43778cb5c48995d7aa6a417395b0c214d4ac56882f513f6
-
Filesize
513KB
MD5a894a9c23ca5fb69e9f005f4106eff37
SHA1bf212dc1558c4f272e31028aa8655468d986c047
SHA256dcd5ec2c7838a1dae0d96bc32f9965935586a891b3958b49a737c54678ff774f
SHA512b22d9051007d45c5df6cfd847b4ba1afd8e22098d47aa4c7e66de21972e37108d1e422b931febfea16dffef9f2d1b24808b2fdc81791ad760608f8c57db053b0
-
Filesize
513KB
MD5001d127b402e6fc41c8e338d83b22a42
SHA100e13b992e0d246dc39a1497f9225880e81e16ae
SHA2563df6a512057617d335339e28e3eb7be572805eb885859a4febb48ed3a69f7cba
SHA51236afeaa5ba01aaee6dd4e49d9a3fc692194b375442b1906b92f7633e91ad6cea264d56acadd29bed0aaa2907b338c0a23ebf153f60484f138074cf73df481244
-
Filesize
513KB
MD55f585d080f7f9b0f9205ac86d2d64616
SHA1429ec8513fe0f811b1e6d3ff49df2800101c3df9
SHA256558dc7caba2210e7af056d9864ef2b2e0b9470fc81b1708576ea37119cbd7150
SHA51298250c4f2308a8a5fb8c9424085f90684293a7afbcfc90eb61ba42ac4b774289e5f9e37448a5dfcf4739f8f0dee7be9e2f0098cde765a5a39b9283ad862c3f8a
-
Filesize
513KB
MD5abb22dde121278098c11908f9700c61e
SHA1d8b57cee22b6dfbffce3579046dac4727a20520a
SHA2564b3da12170c5469fbfbf3e522fdc9367b398f4212e025810a17f5702a663dd53
SHA5123878865bdb9a6cfee10a13fbec6874006829a20093aba2fcacadc591714118b42d75df65a8fac2357f3d71f3a63353e18a23c4645d5f619a84e112be4f6e6dce
-
Filesize
513KB
MD55aae4f51f059c1aa4dfd28c812b32904
SHA1737a00e5dda27ab85319f32c833bb785d298bd7b
SHA25634d26bedcc3d905b566b2c712db59e24d32703350c8c569890bfa7469c49d7a7
SHA51258d5e5751621df114d2cfd14adb416cfa14b3fa53f8807969e07c8111fb47e08a1269c2b9199087bb5033bdbe927e0e724542e29f93bfc77328fc2d69ea14f0c
-
Filesize
513KB
MD5af5f6e14d3beb67caba36e263dbdc8f3
SHA113df587f4e250a625ac41b162d85fa7356654fe2
SHA256215dc9c20050675efb24c0147c96b8f70e433c41f91650dcf244f9c7f5dfab8a
SHA51285eb24163b4f7e79fb08de86de8145afd5061c19206adbb7efce46091e473bc795138c5f107fb288d6044537ad4871d86d3432f75661da0a909a68cb25defe28
-
Filesize
513KB
MD5ea127fb858995210887cf608e5ff692f
SHA1a4b1af35af1211e26232b1b5129c21eb4aabcdc4
SHA256dc8884602751057a8774bd17e6ca6fb697596e6061112c8aa29b10c545b8f7ef
SHA51238f9e0baac92c771f485113174e7c651e7f0be2bb41b44e8f8fbd324c75f5fa64ed30a29c728a6b6566f81fc9f4681cd7a9ff9609591f2a40c7dc8fe45356ac2