a7ac6f017c3ee5b42e036a8c6c6fbc49dc47156dfc8d20360f2a40ae63580545

Analysis

max time kernel
113s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0721c31ec3ffdc6e8c17790668d29cb7.exe
Size

14KB
MD5

0721c31ec3ffdc6e8c17790668d29cb7
SHA1

92bf4602caeb19699bf237328e14082a89c66cfe
SHA256

a7ac6f017c3ee5b42e036a8c6c6fbc49dc47156dfc8d20360f2a40ae63580545
SHA512

a511ad677da378cbe7ac2f36a557204060a025222ff169ecacb238195836f7b4187f30e4fd192bb385431f9329c47aa4573ed15273b645f44ad9bc1abf379037
SSDEEP

384:I0O76fSB3yOxIhGyq6gloNFVQFCq4UELRhuDg7U:Dr+iOCo5cN4Fn4UEvuMY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2600	Process not Found
2744	Process not Found
3052	Process not Found
452	Process not Found
1128	Process not Found
2228	Process not Found
2732	Process not Found
564	Process not Found

Loads dropped DLL 16 IoCs

pid	Process
2356	Process not Found
2356	Process not Found
2600	Process not Found
2600	Process not Found
2744	Process not Found
2744	Process not Found
3052	Process not Found
3052	Process not Found
452	Process not Found
452	Process not Found
1128	Process not Found
1128	Process not Found
2228	Process not Found
2228	Process not Found
2732	Process not Found
2732	Process not Found

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdcaz.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdccs.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File created	C:\Windows\SysWOW64\kawdczy.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdccs.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdccs.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdccs.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdccs.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File created	C:\Windows\SysWOW64\kawdczy.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File created	C:\Windows\SysWOW64\kawdczy.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdcaz.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdcaz.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdcaz.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdczy.dll	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdcaz.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\Windows\SysWOW64\kawdcaz.exe	Process not Found

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\Fonts\enweafx.fon	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found
File opened for modification	C:\Windows\SysWOW64	Process not Found

Modifies registry class 27 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment"	Process not Found

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2356	Process not Found
2600	Process not Found
2744	Process not Found
3052	Process not Found
452	Process not Found
1128	Process not Found
2228	Process not Found
2732	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2236	2356	Process not Found	9635
PID 2356 wrote to memory of 2236	2356	Process not Found	9635
PID 2356 wrote to memory of 2236	2356	Process not Found	9635
PID 2356 wrote to memory of 2236	2356	Process not Found	9635
PID 2236 wrote to memory of 3012	2236	Process not Found	9525
PID 2236 wrote to memory of 3012	2236	Process not Found	9525
PID 2236 wrote to memory of 3012	2236	Process not Found	9525
PID 2236 wrote to memory of 3012	2236	Process not Found	9525
PID 2236 wrote to memory of 2820	2236	Process not Found	9633
PID 2236 wrote to memory of 2820	2236	Process not Found	9633
PID 2236 wrote to memory of 2820	2236	Process not Found	9633
PID 2236 wrote to memory of 2820	2236	Process not Found	9633
PID 2356 wrote to memory of 2600	2356	Process not Found	9632
PID 2356 wrote to memory of 2600	2356	Process not Found	9632
PID 2356 wrote to memory of 2600	2356	Process not Found	9632
PID 2356 wrote to memory of 2600	2356	Process not Found	9632
PID 2236 wrote to memory of 2640	2236	Process not Found	9631
PID 2236 wrote to memory of 2640	2236	Process not Found	9631
PID 2236 wrote to memory of 2640	2236	Process not Found	9631
PID 2236 wrote to memory of 2640	2236	Process not Found	9631
PID 2236 wrote to memory of 2588	2236	Process not Found	9630
PID 2236 wrote to memory of 2588	2236	Process not Found	9630
PID 2236 wrote to memory of 2588	2236	Process not Found	9630
PID 2236 wrote to memory of 2588	2236	Process not Found	9630
PID 2236 wrote to memory of 2576	2236	Process not Found	9629
PID 2236 wrote to memory of 2576	2236	Process not Found	9629
PID 2236 wrote to memory of 2576	2236	Process not Found	9629
PID 2236 wrote to memory of 2576	2236	Process not Found	9629
PID 2236 wrote to memory of 2268	2236	Process not Found	9628
PID 2236 wrote to memory of 2268	2236	Process not Found	9628
PID 2236 wrote to memory of 2268	2236	Process not Found	9628
PID 2236 wrote to memory of 2268	2236	Process not Found	9628
PID 2236 wrote to memory of 2708	2236	Process not Found	9627
PID 2236 wrote to memory of 2708	2236	Process not Found	9627
PID 2236 wrote to memory of 2708	2236	Process not Found	9627
PID 2236 wrote to memory of 2708	2236	Process not Found	9627
PID 2236 wrote to memory of 2740	2236	Process not Found	9626
PID 2236 wrote to memory of 2740	2236	Process not Found	9626
PID 2236 wrote to memory of 2740	2236	Process not Found	9626
PID 2236 wrote to memory of 2740	2236	Process not Found	9626
PID 2236 wrote to memory of 2604	2236	Process not Found	9625
PID 2236 wrote to memory of 2604	2236	Process not Found	9625
PID 2236 wrote to memory of 2604	2236	Process not Found	9625
PID 2236 wrote to memory of 2604	2236	Process not Found	9625
PID 2236 wrote to memory of 2260	2236	Process not Found	9624
PID 2236 wrote to memory of 2260	2236	Process not Found	9624
PID 2236 wrote to memory of 2260	2236	Process not Found	9624
PID 2236 wrote to memory of 2260	2236	Process not Found	9624
PID 2600 wrote to memory of 1468	2600	Process not Found	17
PID 2600 wrote to memory of 1468	2600	Process not Found	17
PID 2600 wrote to memory of 1468	2600	Process not Found	17
PID 2600 wrote to memory of 1468	2600	Process not Found	17
PID 2236 wrote to memory of 2464	2236	Process not Found	9623
PID 2236 wrote to memory of 2464	2236	Process not Found	9623
PID 2236 wrote to memory of 2464	2236	Process not Found	9623
PID 2236 wrote to memory of 2464	2236	Process not Found	9623
PID 2236 wrote to memory of 308	2236	Process not Found	9621
PID 2236 wrote to memory of 308	2236	Process not Found	9621
PID 2236 wrote to memory of 308	2236	Process not Found	9621
PID 2236 wrote to memory of 308	2236	Process not Found	9621
PID 1468 wrote to memory of 2672	1468	cmd.exe	9620
PID 1468 wrote to memory of 2672	1468	cmd.exe	9620
PID 1468 wrote to memory of 2672	1468	cmd.exe	9620
PID 1468 wrote to memory of 2672	1468	cmd.exe	9620

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6000	Process not Found
3104	Process not Found
4620	Process not Found
4656	Process not Found
896	Process not Found
8812	Process not Found
8304	Process not Found
6200	Process not Found
3316	Process not Found
4668	Process not Found
4056	Process not Found
6976	Process not Found
7024	Process not Found
6844	Process not Found
7552	Process not Found
3624	Process not Found
5844	Process not Found
4312	Process not Found
4076	Process not Found
6488	Process not Found
6816	Process not Found
5676	Process not Found
3308	Process not Found
7560	Process not Found
6624	Process not Found
2824	Process not Found
9092	Process not Found
5052	Process not Found
4804	attrib.exe
8868	Process not Found
8844	Process not Found
7436	Process not Found
6400	Process not Found
7588	Process not Found
3208	Process not Found
6696	Process not Found
4516	Process not Found
4416	Process not Found
7444	Process not Found
3124	Process not Found
6508	Process not Found
7244	Process not Found
5904	Process not Found
5908	Process not Found
6360	Process not Found
4504	Process not Found
8668	Process not Found
2228	Process not Found
4760	Process not Found
9000	Process not Found
5876	Process not Found
6560	Process not Found
3356	Process not Found
2500	Process not Found
9200	Process not Found
6532	Process not Found
1812	attrib.exe
5496	Process not Found
3456	Process not Found
8092	Process not Found
8816	Process not Found
4632	Process not Found
4128	Process not Found
5452	Process not Found

C:\Users\Admin\AppData\Local\Temp\0721c31ec3ffdc6e8c17790668d29cb7.exe
"C:\Users\Admin\AppData\Local\Temp\0721c31ec3ffdc6e8c17790668d29cb7.exe"
1⤵
PID:2356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3012

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\DFD259398322.bat
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  - Drops file in System32 directory
  PID:1792
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1680
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:800
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:960
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:4468
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5840
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:576
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1180
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2768
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3588
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4608
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5708
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6340
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:1812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2120
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:3252
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5396
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4732
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4456
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5984
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:6672

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1612

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2604

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:2784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1168
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:948
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4572
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2088
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1436
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\DFD259401145.bat
1⤵
PID:2068
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1904
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:4144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:4200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:5188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:5484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:6544
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:6560
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:2900
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1676
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4108
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5072
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3348
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1864

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2604
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3148
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5108
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5724
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5888
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1872
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3152
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3960
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4936
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4696
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4876
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3164
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3492
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\DFD259450473.bat
    3⤵
    PID:6052
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1636

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:1212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2444
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3140
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:2656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:6132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:6416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:5336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:5228
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:6608
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:908
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4228
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5192
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5776
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3384
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6852

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:2984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2808

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:828

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:600

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:972

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:2580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259403782.bat
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:896
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:3724
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:632
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:6600
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:3092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2480

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:2648
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3628
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5132
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2540
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4528
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4692
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1072

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259419725.bat
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:3560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:6504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:5528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:5612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
      4⤵
      PID:4068
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5900
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:6284
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:5296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259450988.bat
  2⤵
  PID:6156
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3832
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2008
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4068
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2296
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5336
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6196
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3900
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:3224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3196

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3300

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3404
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5588
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3512

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3528

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:3548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2136
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4100
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5352
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3796
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5520
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4484
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2560
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3844
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4380
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5328
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5716
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5896
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5360
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:828
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5448
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5440
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3120

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3512
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6356
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:3068
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3740
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6724
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:2112
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5340
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3284

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:3596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259449396.bat
  2⤵
  PID:5880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3828
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3116
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4620
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4836
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6140
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2228
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2784
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3780

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:3384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259446011.bat
  2⤵
  PID:5168
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5732
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3016
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5224
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5840
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259450301.bat
  2⤵
  PID:4620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259448726.bat
  2⤵
  PID:6140
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
      4⤵
      PID:6696
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5164
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:3556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:108
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5596
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6528
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5288
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3232

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3708
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4368
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1892
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4940
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3588
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2356
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3968
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4732
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4532
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3784
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\kawdcaz.exe
    C:\Windows\system32\kawdcaz.exe
    3⤵
    PID:4388
  - - C:\Windows\SysWOW64\kawdcaz.exe
      C:\Windows\system32\kawdcaz.exe
      4⤵
      PID:5300
    - - C:\Windows\SysWOW64\kawdcaz.exe
        
        C:\Windows\system32\kawdcaz.exe
        5⤵
        
        PID:2952
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1180
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5128
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5208
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4644
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6796
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3288
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2980
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4280
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5692
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5576
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3420

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3912
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6236
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:1744
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3896
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4204
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5236
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:6024
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4244
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\kawdcaz.exe
    C:\Windows\system32\kawdcaz.exe
    3⤵
    PID:4432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4568
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3896
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:3112
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:6292
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5700
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5024
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4924
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2384
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4620
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6788
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5532
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5044
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:2416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2332

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3356
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6512
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4220
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4492

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:4776
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:4308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1580

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4804

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:4728
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:4180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4788
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3884
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6536
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3412
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4908

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
- Views/modifies file attributes
PID:4804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4968
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6080
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:4456
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3732
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5356
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6788
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6036
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5888
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6276
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4228

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4492
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:4672
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:3508
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:6912
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4940
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5628
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:6076
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5792
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3640
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2400
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4916
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:2416
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4292
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5836
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3556
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3204

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:4316
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:3616

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3416
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4820
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5972
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3956
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:2320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4612

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4808

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:4964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1196

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2272

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3600

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3856
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:632
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5772
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5628
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3760
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4280
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:6552
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5020

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:1156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4280

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4864

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4696

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3636
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5396
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:896
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4364
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:2296
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4280
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:4376
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5516

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5836

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2536
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:6092
- - C:\Windows\SysWOW64\kawdcaz.exe
    C:\Windows\system32\kawdcaz.exe
    3⤵
    PID:1196
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\DFD259447150.bat
      4⤵
      PID:5852
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
        5⤵
        
        PID:6464
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
        5⤵
        
        PID:5860
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
        5⤵
        
        PID:5552

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5228

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5452

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5640

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:5268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5400

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3144

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\DFD259449833.bat
  2⤵
  PID:5688
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
    3⤵
    PID:1156
- C:\Windows\SysWOW64\kawdcaz.exe
  C:\Windows\system32\kawdcaz.exe
  2⤵
  PID:584
- - C:\Windows\SysWOW64\kawdcaz.exe
    C:\Windows\system32\kawdcaz.exe
    3⤵
    PID:5164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:1996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3956

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:1716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2356

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5580

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5196

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5228

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3332

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5880
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:5732
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:3068
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
    3⤵
    PID:4176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5260

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\DFD259448460.bat
1⤵
PID:3220
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5772
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:3672
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:5756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2228

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4864

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5516

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5412

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5452

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6004

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5916

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3256

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5720

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4864

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5396

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5332

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2784

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5816

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5868

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5940

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:1744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5860

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:2240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5796

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6044

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5576

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3556

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5868

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5836

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5452

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5860

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6004

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6244
- C:\Windows\SysWOW64\attrib.exe
  attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
  2⤵
  PID:6892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6656

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6616

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\DFD259451237.bat
1⤵
PID:6408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6332

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6324

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6316

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6576

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6568

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6480

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6440

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6300

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6228

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6780

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6204

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1180

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4008

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4732

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:1764

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4836

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:896

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3924

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3092

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:1596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3068

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3572

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5712

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6008

C:\Windows\SysWOW64\kawdcaz.exe
C:\Windows\system32\kawdcaz.exe
1⤵
PID:3148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4972

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5912

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:3476

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:3640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6828

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4532

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6836

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:6844

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:4608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:4128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:5628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h
1⤵
PID:5320

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:2384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\system32\verclsid.exe" -r -a -s -h
1⤵
PID:6724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DFD259399850.bat

Filesize
176B

MD5
2afeebcd2748d7fe6a9deb1ef8f83046

SHA1
4bddd82d8955f53a4a8ca922286e02858dbe1eda

SHA256
c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731

SHA512
457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd

Download Submit
C:\DFD259428913.bat

Filesize
290B

MD5
20d87e84ae8c3cae6890ce956e323140

SHA1
dd464f4058a983b5458f7d5cb63305fc50aa0dfe

SHA256
7911484eaab0c4484e3c494d5aa603345215eff2c5e80eb221987cb85ed2e705

SHA512
ab15029d2d2bc4949161aa3b54b014d28c615b2cae5ad680a06284a3fa87e19e9899c170f0f990733fd64aea2eff70a46aec326e1fc25175ff866a9fe7537215

Download Submit
C:\DFD259429194.bat

Filesize
173B

MD5
109814868681485c31171dd96b6496ea

SHA1
1464ea9aefc469eed42c141e90faff28523c9aa9

SHA256
ef02703dd684b435886447da4a785c4b598f0ea063dfd7b61ee3f38f435058fd

SHA512
9c01ae19b8d26e7db7406afcebef13fdc228be0e6ccde6505a32b5fb3e473075e411e67ab432a651a9c749f92a31208b4f912ae2bc0dcf595a742e83d26dd297

Download Submit
C:\Windows\Fonts\enweafx.fon

Filesize
95B

MD5
f8b0634edb79f55586aa2e185e2ab7dc

SHA1
f712c90e7e29458e6f52e0c56e9b95e58b3289b4

SHA256
52c90ff4f13638d440242e8eed437efcb3e47e96e139be619709e795affe224f

SHA512
fcc4f0e6e071449383f37fbdb6d802f762b5678f67a788dad4ead87c8896052fa0f258ab6857ec93a594b025740219d4fedf36353d90f8f419ee395aade1d394

Download Submit
C:\Windows\SysWOW64\kawdcaz.exe

Filesize
14KB

MD5
0721c31ec3ffdc6e8c17790668d29cb7

SHA1
92bf4602caeb19699bf237328e14082a89c66cfe

SHA256
a7ac6f017c3ee5b42e036a8c6c6fbc49dc47156dfc8d20360f2a40ae63580545

SHA512
a511ad677da378cbe7ac2f36a557204060a025222ff169ecacb238195836f7b4187f30e4fd192bb385431f9329c47aa4573ed15273b645f44ad9bc1abf379037

Download Submit
C:\Windows\SysWOW64\kawdccs.dll

Filesize
54B

MD5
080c4d43ba7da3f5f2f78a13d61d0d6e

SHA1
3747bff723eee9374b3a46104689e8cd46eae2de

SHA256
d37a0d7b9520a55ae74c76286b86ba3d01728e6ab5676f9132576a4e24ca0569

SHA512
7707091fa2cfe41143785690d6f207a167f8895e9519f2f6b47371c8cc4a709a215f241881743d2d7a6f9d16afa2877fb1bebfbe6bcf842f012d5f14d85ffcdd

Download Submit
C:\Windows\SysWOW64\kawdccs.dll

Filesize
566B

MD5
6e426b8680e0716e353a60380d51236b

SHA1
7f6c06881e1b882a87d379aad06f8adf0dbc9a58

SHA256
f6b27630e11b4a6155bb2d280f8899ce5d63bf8c4adb9e43aec1389cfae5a566

SHA512
c2a106fc2ddfc4dc18ff126e95ffd8b649c916dbe2c052aa5c79c315febbc7fcb9811789b6361166dda331d8b53068fd4d03d8b6e10fd31147394fd5a7a486d2

Download Submit
C:\Windows\SysWOW64\kawdccs.dll

Filesize
1KB

MD5
b90b2db94a8e90572d5ced1d037c8a0b

SHA1
6207cd08045e0ffbd69332f7f1aaf6b72bbab737

SHA256
49d954b5c5d0d0e0efce162c38951c468a19a1f8bd61d4636ba8ff698008dc9b

SHA512
f0c0eb6f0f505baec1c3816eafcf7cfd2ed161bb8fd279b59734d773c83c536eaeb59089b020107ab46f22d33fc4a213d72038a264b5bf62ac3e85befd80c2e5

Download Submit
C:\Windows\SysWOW64\kawdczy.dll

Filesize
20KB

MD5
863d71a9ad0a7318441017b9c11e416c

SHA1
9e7d97a5bfd97f2e3bdb36a3eff87e80a83dd19e

SHA256
f30701eee38f09d1a0aa53e7aa1784b5ea94a09d8edf61fba543a9310ddeb419

SHA512
8e9060f611217bf304b357d5758cb3a00927ff9d711b0004a640a1231ee22323e1b048b39b556334574af3ab69f4eb335ab79c3bc5abadc1fe77840df2326be7

Download Submit
C:\Windows\SysWOW64\kawdczy.dll

Filesize
20KB

MD5
6a265d5f7d8b14a251f4947112023bf4

SHA1
8a12b8309323f289f394fdb5a441ff029a516c24

SHA256
d61347745fd5415c9ce9ce80c76407f09ef643d7e9ecdc3a30baa03f0a2d641e

SHA512
034a012d0fad58453ad5e960f6376a2e61ba699aa6c14a2fa8038bd86f64c371e5be3ee15b992b960e5db12d75b2edc7bb96f3935be4d1dc99a0f38b18ba4b0c

Download Submit
C:\Windows\SysWOW64\kawdczy.dll

Filesize
20KB

MD5
8f7130893553ab7d9a048dd486daaa92

SHA1
17a0ed4f5cc410da854f50ea743e78b56ba3af3a

SHA256
7a45a7eb9741173d6e84fe747e4e30979bc5d647b4986a68be030bd0fd72e9e6

SHA512
808fbf280ca6bc1c740b5d1199fe82ea3cb3b8d0c9a15d9f9d0c8193c3b759b209b4c49a61816f4e2c689f8d5aada11ef1b2a7d577188d6f10bdd3651b231eec

Download Submit
C:\Windows\SysWOW64\kawdczy.dll

Filesize
20KB

MD5
7c4e2d789aa5bb7e30221ae8b482f556

SHA1
7ef8d3b9566481bf689376a16d7778c8cc849ca5

SHA256
5642c283234e22e1348a139efaba9d9955bf7bb107f449f439b6575b7eea98a0

SHA512
c05c30c169710e302aceb1f84e1f98c0a00972d56879df401c2c0ba8b8a353c09aa2a0dea1018476758a2205a790b657a5af480a654e1e173f84304bedf009a8

Download Submit
C:\Windows\SysWOW64\kawdczy.dll

Filesize
20KB

MD5
b32c69bfa78f2ddfdb361d5864962d54

SHA1
39427ad22bccef7be681dfa4c387fd2e6375a0a9

SHA256
1d413853a65108d4f0defb0440dd1f87dd1d3220fed404306337aa7fcea61793

SHA512
12659648c762ba5d52b1ae6e625781053e96cacfc2e2a9deab5fd34bbd417a3eacc0fcf76e19d41ec8e520c4ae164e0bea6a9a6b9c671ddf1dd60d43f98a3bd4

Download Submit
C:\Windows\SysWOW64\kawdczy.dll

Filesize
20KB

MD5
710357a20f5f7ea8f4668994678fc859

SHA1
089407c28283a14ae773e30321d3799aebe9dba7

SHA256
3357078b4dfec9f804d986556c73e2fd80d571df654faf9fe621311f88673c76

SHA512
51e4bb0fdd6684fce74f55fa45c549947fcf4a9e46e19d99a3760e9daa340b5cddc901ecdb637627319aa2e35723d09fc8eb426665e0f0359755d947e5c12fe0

Download Submit
memory/452-91-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/584-518-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/584-415-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/1028-753-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/1028-839-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/1516-352-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/1672-881-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/1672-774-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2032-708-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2112-902-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2112-1055-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2164-519-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2164-665-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2240-456-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2240-311-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2320-517-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2320-394-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2356-31-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2356-32-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2356-172-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2356-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2356-168-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2356-170-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2392-353-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2464-795-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2464-687-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2576-582-0x00000000002A0000-0x00000000002B9000-memory.dmp

Filesize
100KB

Download
memory/2580-603-0x00000000003A0000-0x00000000003B9000-memory.dmp

Filesize
100KB

Download
memory/2580-731-0x00000000003A0000-0x00000000003B9000-memory.dmp

Filesize
100KB

Download
memory/2580-732-0x00000000003A0000-0x00000000003B9000-memory.dmp

Filesize
100KB

Download
memory/2580-604-0x00000000003A0000-0x00000000003B9000-memory.dmp

Filesize
100KB

Download
memory/2600-49-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2600-33-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2648-710-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2648-709-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2648-816-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2648-817-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2660-236-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/2744-76-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2744-210-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2784-250-0x00000000002A0000-0x00000000002B9000-memory.dmp

Filesize
100KB

Download
memory/2984-686-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/2984-540-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2984-561-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3112-990-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3224-1034-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3252-818-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3252-967-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3280-1056-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3380-924-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/3380-1077-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/3380-923-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/3380-1078-0x00000000001B0000-0x00000000001C9000-memory.dmp

Filesize
100KB

Download
memory/3596-1081-0x00000000003C0000-0x00000000003D9000-memory.dmp

Filesize
100KB

Download
memory/3640-946-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3640-1080-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3640-945-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3640-1079-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3792-840-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3792-1011-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3900-1013-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/3900-1012-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/4084-969-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download
memory/4084-968-0x0000000000220000-0x0000000000239000-memory.dmp

Filesize
100KB

Download