Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
0721c31ec3ffdc6e8c17790668d29cb7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0721c31ec3ffdc6e8c17790668d29cb7.exe
Resource
win10v2004-20231215-en
General
-
Target
0721c31ec3ffdc6e8c17790668d29cb7.exe
-
Size
14KB
-
MD5
0721c31ec3ffdc6e8c17790668d29cb7
-
SHA1
92bf4602caeb19699bf237328e14082a89c66cfe
-
SHA256
a7ac6f017c3ee5b42e036a8c6c6fbc49dc47156dfc8d20360f2a40ae63580545
-
SHA512
a511ad677da378cbe7ac2f36a557204060a025222ff169ecacb238195836f7b4187f30e4fd192bb385431f9329c47aa4573ed15273b645f44ad9bc1abf379037
-
SSDEEP
384:I0O76fSB3yOxIhGyq6gloNFVQFCq4UELRhuDg7U:Dr+iOCo5cN4Fn4UEvuMY
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 2600 Process not Found 2744 Process not Found 3052 Process not Found 452 Process not Found 1128 Process not Found 2228 Process not Found 2732 Process not Found 564 Process not Found -
Loads dropped DLL 16 IoCs
pid Process 2356 Process not Found 2356 Process not Found 2600 Process not Found 2600 Process not Found 2744 Process not Found 2744 Process not Found 3052 Process not Found 3052 Process not Found 452 Process not Found 452 Process not Found 1128 Process not Found 1128 Process not Found 2228 Process not Found 2228 Process not Found 2732 Process not Found 2732 Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdcaz.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdccs.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File created C:\Windows\SysWOW64\kawdczy.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdccs.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdccs.dll Process not Found File opened for modification C:\Windows\SysWOW64\kawdccs.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdccs.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File created C:\Windows\SysWOW64\kawdczy.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File created C:\Windows\SysWOW64\kawdczy.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdcaz.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdcaz.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdcaz.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdczy.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdcaz.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\kawdcaz.exe Process not Found -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\Fonts\enweafx.fon Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found -
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ = "C:\\Windows\\SysWow64\\kawdczy.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{38907901-1416-3389-9981-372178569983}\InprocServer32\ThreadingModel = "Apartment" Process not Found -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2356 Process not Found 2600 Process not Found 2744 Process not Found 3052 Process not Found 452 Process not Found 1128 Process not Found 2228 Process not Found 2732 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2236 2356 Process not Found 9635 PID 2356 wrote to memory of 2236 2356 Process not Found 9635 PID 2356 wrote to memory of 2236 2356 Process not Found 9635 PID 2356 wrote to memory of 2236 2356 Process not Found 9635 PID 2236 wrote to memory of 3012 2236 Process not Found 9525 PID 2236 wrote to memory of 3012 2236 Process not Found 9525 PID 2236 wrote to memory of 3012 2236 Process not Found 9525 PID 2236 wrote to memory of 3012 2236 Process not Found 9525 PID 2236 wrote to memory of 2820 2236 Process not Found 9633 PID 2236 wrote to memory of 2820 2236 Process not Found 9633 PID 2236 wrote to memory of 2820 2236 Process not Found 9633 PID 2236 wrote to memory of 2820 2236 Process not Found 9633 PID 2356 wrote to memory of 2600 2356 Process not Found 9632 PID 2356 wrote to memory of 2600 2356 Process not Found 9632 PID 2356 wrote to memory of 2600 2356 Process not Found 9632 PID 2356 wrote to memory of 2600 2356 Process not Found 9632 PID 2236 wrote to memory of 2640 2236 Process not Found 9631 PID 2236 wrote to memory of 2640 2236 Process not Found 9631 PID 2236 wrote to memory of 2640 2236 Process not Found 9631 PID 2236 wrote to memory of 2640 2236 Process not Found 9631 PID 2236 wrote to memory of 2588 2236 Process not Found 9630 PID 2236 wrote to memory of 2588 2236 Process not Found 9630 PID 2236 wrote to memory of 2588 2236 Process not Found 9630 PID 2236 wrote to memory of 2588 2236 Process not Found 9630 PID 2236 wrote to memory of 2576 2236 Process not Found 9629 PID 2236 wrote to memory of 2576 2236 Process not Found 9629 PID 2236 wrote to memory of 2576 2236 Process not Found 9629 PID 2236 wrote to memory of 2576 2236 Process not Found 9629 PID 2236 wrote to memory of 2268 2236 Process not Found 9628 PID 2236 wrote to memory of 2268 2236 Process not Found 9628 PID 2236 wrote to memory of 2268 2236 Process not Found 9628 PID 2236 wrote to memory of 2268 2236 Process not Found 9628 PID 2236 wrote to memory of 2708 2236 Process not Found 9627 PID 2236 wrote to memory of 2708 2236 Process not Found 9627 PID 2236 wrote to memory of 2708 2236 Process not Found 9627 PID 2236 wrote to memory of 2708 2236 Process not Found 9627 PID 2236 wrote to memory of 2740 2236 Process not Found 9626 PID 2236 wrote to memory of 2740 2236 Process not Found 9626 PID 2236 wrote to memory of 2740 2236 Process not Found 9626 PID 2236 wrote to memory of 2740 2236 Process not Found 9626 PID 2236 wrote to memory of 2604 2236 Process not Found 9625 PID 2236 wrote to memory of 2604 2236 Process not Found 9625 PID 2236 wrote to memory of 2604 2236 Process not Found 9625 PID 2236 wrote to memory of 2604 2236 Process not Found 9625 PID 2236 wrote to memory of 2260 2236 Process not Found 9624 PID 2236 wrote to memory of 2260 2236 Process not Found 9624 PID 2236 wrote to memory of 2260 2236 Process not Found 9624 PID 2236 wrote to memory of 2260 2236 Process not Found 9624 PID 2600 wrote to memory of 1468 2600 Process not Found 17 PID 2600 wrote to memory of 1468 2600 Process not Found 17 PID 2600 wrote to memory of 1468 2600 Process not Found 17 PID 2600 wrote to memory of 1468 2600 Process not Found 17 PID 2236 wrote to memory of 2464 2236 Process not Found 9623 PID 2236 wrote to memory of 2464 2236 Process not Found 9623 PID 2236 wrote to memory of 2464 2236 Process not Found 9623 PID 2236 wrote to memory of 2464 2236 Process not Found 9623 PID 2236 wrote to memory of 308 2236 Process not Found 9621 PID 2236 wrote to memory of 308 2236 Process not Found 9621 PID 2236 wrote to memory of 308 2236 Process not Found 9621 PID 2236 wrote to memory of 308 2236 Process not Found 9621 PID 1468 wrote to memory of 2672 1468 cmd.exe 9620 PID 1468 wrote to memory of 2672 1468 cmd.exe 9620 PID 1468 wrote to memory of 2672 1468 cmd.exe 9620 PID 1468 wrote to memory of 2672 1468 cmd.exe 9620 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 6000 Process not Found 3104 Process not Found 4620 Process not Found 4656 Process not Found 896 Process not Found 8812 Process not Found 8304 Process not Found 6200 Process not Found 3316 Process not Found 4668 Process not Found 4056 Process not Found 6976 Process not Found 7024 Process not Found 6844 Process not Found 7552 Process not Found 3624 Process not Found 5844 Process not Found 4312 Process not Found 4076 Process not Found 6488 Process not Found 6816 Process not Found 5676 Process not Found 3308 Process not Found 7560 Process not Found 6624 Process not Found 2824 Process not Found 9092 Process not Found 5052 Process not Found 4804 attrib.exe 8868 Process not Found 8844 Process not Found 7436 Process not Found 6400 Process not Found 7588 Process not Found 3208 Process not Found 6696 Process not Found 4516 Process not Found 4416 Process not Found 7444 Process not Found 3124 Process not Found 6508 Process not Found 7244 Process not Found 5904 Process not Found 5908 Process not Found 6360 Process not Found 4504 Process not Found 8668 Process not Found 2228 Process not Found 4760 Process not Found 9000 Process not Found 5876 Process not Found 6560 Process not Found 3356 Process not Found 2500 Process not Found 9200 Process not Found 6532 Process not Found 1812 attrib.exe 5496 Process not Found 3456 Process not Found 8092 Process not Found 8816 Process not Found 4632 Process not Found 4128 Process not Found 5452 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\0721c31ec3ffdc6e8c17790668d29cb7.exe"C:\Users\Admin\AppData\Local\Temp\0721c31ec3ffdc6e8c17790668d29cb7.exe"1⤵PID:2356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3012
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259398322.bat1⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Drops file in System32 directory
PID:1792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5840
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:1812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2312
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:928
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2120
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:3252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:6672
-
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1504
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2604
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:2784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2344
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2604
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259401145.bat1⤵PID:2068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:4200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:2384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:5188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:5484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:6544
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2900
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3348
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2344
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1872
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4876
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3420
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259450473.bat3⤵PID:6052
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1636
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:1212
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2224
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1644
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:6132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:6416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:5336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:5228
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6608
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:908
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6852
-
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:2984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:972
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:2580
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259403782.bat2⤵PID:1756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3092
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:948
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2480
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:2648
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1788
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2540
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:948
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2768
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1072
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:972
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259419725.bat2⤵PID:4392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:6504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:5528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:5612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h4⤵PID:4068
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5296
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259450988.bat2⤵PID:6156
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6920
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3112
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3260
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3524
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3900
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:3224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3300
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3404
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3528
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:3548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3660
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3920
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2136
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3120
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:4680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:3068
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5440
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5812
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:2112
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5340
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3284
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:3596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3212
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3980
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259449396.bat2⤵PID:5880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3500
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3416
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3780
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:3384
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259446011.bat2⤵PID:5168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5192
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3348
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3152
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2768
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3208
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259450301.bat2⤵PID:4620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2284
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259448726.bat2⤵PID:6140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6696
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:3556
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3232
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1212
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe3⤵PID:4388
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe4⤵PID:5300
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe5⤵PID:2952
-
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3912
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5448
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3504
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1920
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4204
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:6024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5912
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4244
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:3128
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe3⤵PID:4432
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4568
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:3112
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:6292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2384
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5532
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4184
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4492
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:4776
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:4308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3212
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4500
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1580
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4804
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:4728
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:4180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4788
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6536
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4908
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:4804
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3732
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:2824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:4528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6788
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4492
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:4672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:2704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:2824
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:3508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:5944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:6912
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:6076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5792
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4312
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2400
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4916
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:2416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3204
-
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:4316
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:3616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4660
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4532
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3416
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:2320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4660
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4808
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:4964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4344
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2272
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4156
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5116
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2660
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:6552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:1156
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4280
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4500
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3372
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4696
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4956
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4768
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4360
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4364
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:2296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4280
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:4376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5636
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5516
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3184
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2536
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:6092
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe3⤵PID:1196
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259447150.bat4⤵PID:5852
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5552
-
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3948
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5640
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:5268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5524
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3792
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3112
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5400
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4732
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4184
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5336
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5544
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3148
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259449833.bat2⤵PID:5688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1156
-
-
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe2⤵PID:584
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe3⤵PID:5164
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5208
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2416
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:1996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3956
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:1716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2900
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5580
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6056
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6048
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1080
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:5732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:3068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h2⤵PID:6640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h3⤵PID:4176
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5532
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5260
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259448460.bat1⤵PID:3220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5516
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4312
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2660
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6064
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3432
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6004
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5916
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5872
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3256
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6012
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5720
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3660
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5532
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3796
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3432
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4184
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5868
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5940
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5524
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:1744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5860
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:2240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5796
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5156
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5736
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1080
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5544
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5576
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4680
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5732
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3504
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3508
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5792
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3556
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3792
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5868
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5860
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6004
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6680
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6664
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6616
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259451237.bat1⤵PID:6408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6372
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6364
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6348
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6308
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6316
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6576
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6568
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6440
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6424
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6432
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6488
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6300
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6220
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6204
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4312
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5336
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5776
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5252
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4008
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4312
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4732
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1080
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3900
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5900
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5736
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6804
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3924
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3112
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2112
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:1596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3792
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5252
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5712
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6008
-
C:\Windows\SysWOW64\kawdcaz.exeC:\Windows\system32\kawdcaz.exe1⤵PID:3148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5912
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3476
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:3640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4532
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5776
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:6844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:4608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\kawdcaz.exe" -r -a -s -h1⤵PID:5320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2384
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
290B
MD520d87e84ae8c3cae6890ce956e323140
SHA1dd464f4058a983b5458f7d5cb63305fc50aa0dfe
SHA2567911484eaab0c4484e3c494d5aa603345215eff2c5e80eb221987cb85ed2e705
SHA512ab15029d2d2bc4949161aa3b54b014d28c615b2cae5ad680a06284a3fa87e19e9899c170f0f990733fd64aea2eff70a46aec326e1fc25175ff866a9fe7537215
-
Filesize
173B
MD5109814868681485c31171dd96b6496ea
SHA11464ea9aefc469eed42c141e90faff28523c9aa9
SHA256ef02703dd684b435886447da4a785c4b598f0ea063dfd7b61ee3f38f435058fd
SHA5129c01ae19b8d26e7db7406afcebef13fdc228be0e6ccde6505a32b5fb3e473075e411e67ab432a651a9c749f92a31208b4f912ae2bc0dcf595a742e83d26dd297
-
Filesize
95B
MD5f8b0634edb79f55586aa2e185e2ab7dc
SHA1f712c90e7e29458e6f52e0c56e9b95e58b3289b4
SHA25652c90ff4f13638d440242e8eed437efcb3e47e96e139be619709e795affe224f
SHA512fcc4f0e6e071449383f37fbdb6d802f762b5678f67a788dad4ead87c8896052fa0f258ab6857ec93a594b025740219d4fedf36353d90f8f419ee395aade1d394
-
Filesize
14KB
MD50721c31ec3ffdc6e8c17790668d29cb7
SHA192bf4602caeb19699bf237328e14082a89c66cfe
SHA256a7ac6f017c3ee5b42e036a8c6c6fbc49dc47156dfc8d20360f2a40ae63580545
SHA512a511ad677da378cbe7ac2f36a557204060a025222ff169ecacb238195836f7b4187f30e4fd192bb385431f9329c47aa4573ed15273b645f44ad9bc1abf379037
-
Filesize
54B
MD5080c4d43ba7da3f5f2f78a13d61d0d6e
SHA13747bff723eee9374b3a46104689e8cd46eae2de
SHA256d37a0d7b9520a55ae74c76286b86ba3d01728e6ab5676f9132576a4e24ca0569
SHA5127707091fa2cfe41143785690d6f207a167f8895e9519f2f6b47371c8cc4a709a215f241881743d2d7a6f9d16afa2877fb1bebfbe6bcf842f012d5f14d85ffcdd
-
Filesize
566B
MD56e426b8680e0716e353a60380d51236b
SHA17f6c06881e1b882a87d379aad06f8adf0dbc9a58
SHA256f6b27630e11b4a6155bb2d280f8899ce5d63bf8c4adb9e43aec1389cfae5a566
SHA512c2a106fc2ddfc4dc18ff126e95ffd8b649c916dbe2c052aa5c79c315febbc7fcb9811789b6361166dda331d8b53068fd4d03d8b6e10fd31147394fd5a7a486d2
-
Filesize
1KB
MD5b90b2db94a8e90572d5ced1d037c8a0b
SHA16207cd08045e0ffbd69332f7f1aaf6b72bbab737
SHA25649d954b5c5d0d0e0efce162c38951c468a19a1f8bd61d4636ba8ff698008dc9b
SHA512f0c0eb6f0f505baec1c3816eafcf7cfd2ed161bb8fd279b59734d773c83c536eaeb59089b020107ab46f22d33fc4a213d72038a264b5bf62ac3e85befd80c2e5
-
Filesize
20KB
MD5863d71a9ad0a7318441017b9c11e416c
SHA19e7d97a5bfd97f2e3bdb36a3eff87e80a83dd19e
SHA256f30701eee38f09d1a0aa53e7aa1784b5ea94a09d8edf61fba543a9310ddeb419
SHA5128e9060f611217bf304b357d5758cb3a00927ff9d711b0004a640a1231ee22323e1b048b39b556334574af3ab69f4eb335ab79c3bc5abadc1fe77840df2326be7
-
Filesize
20KB
MD56a265d5f7d8b14a251f4947112023bf4
SHA18a12b8309323f289f394fdb5a441ff029a516c24
SHA256d61347745fd5415c9ce9ce80c76407f09ef643d7e9ecdc3a30baa03f0a2d641e
SHA512034a012d0fad58453ad5e960f6376a2e61ba699aa6c14a2fa8038bd86f64c371e5be3ee15b992b960e5db12d75b2edc7bb96f3935be4d1dc99a0f38b18ba4b0c
-
Filesize
20KB
MD58f7130893553ab7d9a048dd486daaa92
SHA117a0ed4f5cc410da854f50ea743e78b56ba3af3a
SHA2567a45a7eb9741173d6e84fe747e4e30979bc5d647b4986a68be030bd0fd72e9e6
SHA512808fbf280ca6bc1c740b5d1199fe82ea3cb3b8d0c9a15d9f9d0c8193c3b759b209b4c49a61816f4e2c689f8d5aada11ef1b2a7d577188d6f10bdd3651b231eec
-
Filesize
20KB
MD57c4e2d789aa5bb7e30221ae8b482f556
SHA17ef8d3b9566481bf689376a16d7778c8cc849ca5
SHA2565642c283234e22e1348a139efaba9d9955bf7bb107f449f439b6575b7eea98a0
SHA512c05c30c169710e302aceb1f84e1f98c0a00972d56879df401c2c0ba8b8a353c09aa2a0dea1018476758a2205a790b657a5af480a654e1e173f84304bedf009a8
-
Filesize
20KB
MD5b32c69bfa78f2ddfdb361d5864962d54
SHA139427ad22bccef7be681dfa4c387fd2e6375a0a9
SHA2561d413853a65108d4f0defb0440dd1f87dd1d3220fed404306337aa7fcea61793
SHA51212659648c762ba5d52b1ae6e625781053e96cacfc2e2a9deab5fd34bbd417a3eacc0fcf76e19d41ec8e520c4ae164e0bea6a9a6b9c671ddf1dd60d43f98a3bd4
-
Filesize
20KB
MD5710357a20f5f7ea8f4668994678fc859
SHA1089407c28283a14ae773e30321d3799aebe9dba7
SHA2563357078b4dfec9f804d986556c73e2fd80d571df654faf9fe621311f88673c76
SHA51251e4bb0fdd6684fce74f55fa45c549947fcf4a9e46e19d99a3760e9daa340b5cddc901ecdb637627319aa2e35723d09fc8eb426665e0f0359755d947e5c12fe0