740edb7f3dfdd8a986bb3949e8d9d90a4ae352981cf7ad61666f3f6bfd74af41

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:20 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e46c4fec38dd74ac034fca86ae347cd.dll
Size

15KB
MD5

0e46c4fec38dd74ac034fca86ae347cd
SHA1

f61f07c74305be6008e6b0a4e4cd434fdbca1560
SHA256

740edb7f3dfdd8a986bb3949e8d9d90a4ae352981cf7ad61666f3f6bfd74af41
SHA512

e2d35782d624a40e714734d6cd611d6070aea74d19372f4c3173aa07fd7733e5ce988d0256f738a31d40d682fd771f4f0b0d662415daf0ef6d669b9a13ea1ab2
SSDEEP

384:e96zMSYrbPH7WfOYeF3sQcqcdjcZhzcPVYYO9d:ekgnaleFsJnpKlcPJ4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	attrib.exe
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 2032 wrote to memory of 1212	2032	rundll32.exe	24
PID 1212 wrote to memory of 1116	1212	rundll32.exe	29
PID 1212 wrote to memory of 1116	1212	rundll32.exe	29
PID 1212 wrote to memory of 1116	1212	rundll32.exe	29
PID 1212 wrote to memory of 1116	1212	rundll32.exe	29
PID 1116 wrote to memory of 2152	1116	cmd.exe	31
PID 1116 wrote to memory of 2152	1116	cmd.exe	31
PID 1116 wrote to memory of 2152	1116	cmd.exe	31
PID 1116 wrote to memory of 2152	1116	cmd.exe	31
PID 1116 wrote to memory of 3020	1116	cmd.exe	32
PID 1116 wrote to memory of 3020	1116	cmd.exe	32
PID 1116 wrote to memory of 3020	1116	cmd.exe	32
PID 1116 wrote to memory of 3020	1116	cmd.exe	32
PID 1116 wrote to memory of 2036	1116	cmd.exe	33
PID 1116 wrote to memory of 2036	1116	cmd.exe	33
PID 1116 wrote to memory of 2036	1116	cmd.exe	33
PID 1116 wrote to memory of 2036	1116	cmd.exe	33
PID 1116 wrote to memory of 2864	1116	cmd.exe	34
PID 1116 wrote to memory of 2864	1116	cmd.exe	34
PID 1116 wrote to memory of 2864	1116	cmd.exe	34
PID 1116 wrote to memory of 2864	1116	cmd.exe	34
PID 1116 wrote to memory of 2440	1116	cmd.exe	35
PID 1116 wrote to memory of 2440	1116	cmd.exe	35
PID 1116 wrote to memory of 2440	1116	cmd.exe	35
PID 1116 wrote to memory of 2440	1116	cmd.exe	35
PID 1116 wrote to memory of 3024	1116	cmd.exe	36
PID 1116 wrote to memory of 3024	1116	cmd.exe	36
PID 1116 wrote to memory of 3024	1116	cmd.exe	36
PID 1116 wrote to memory of 3024	1116	cmd.exe	36
PID 1116 wrote to memory of 2572	1116	cmd.exe	37
PID 1116 wrote to memory of 2572	1116	cmd.exe	37
PID 1116 wrote to memory of 2572	1116	cmd.exe	37
PID 1116 wrote to memory of 2572	1116	cmd.exe	37
PID 1116 wrote to memory of 2812	1116	cmd.exe	38
PID 1116 wrote to memory of 2812	1116	cmd.exe	38
PID 1116 wrote to memory of 2812	1116	cmd.exe	38
PID 1116 wrote to memory of 2812	1116	cmd.exe	38
PID 1116 wrote to memory of 2584	1116	cmd.exe	39
PID 1116 wrote to memory of 2584	1116	cmd.exe	39
PID 1116 wrote to memory of 2584	1116	cmd.exe	39
PID 1116 wrote to memory of 2584	1116	cmd.exe	39
PID 1116 wrote to memory of 2624	1116	cmd.exe	40
PID 1116 wrote to memory of 2624	1116	cmd.exe	40
PID 1116 wrote to memory of 2624	1116	cmd.exe	40
PID 1116 wrote to memory of 2624	1116	cmd.exe	40
PID 1116 wrote to memory of 2688	1116	cmd.exe	41
PID 1116 wrote to memory of 2688	1116	cmd.exe	41
PID 1116 wrote to memory of 2688	1116	cmd.exe	41
PID 1116 wrote to memory of 2688	1116	cmd.exe	41
PID 1116 wrote to memory of 2704	1116	cmd.exe	42
PID 1116 wrote to memory of 2704	1116	cmd.exe	42
PID 1116 wrote to memory of 2704	1116	cmd.exe	42
PID 1116 wrote to memory of 2704	1116	cmd.exe	42
PID 1116 wrote to memory of 2708	1116	cmd.exe	43
PID 1116 wrote to memory of 2708	1116	cmd.exe	43
PID 1116 wrote to memory of 2708	1116	cmd.exe	43
PID 1116 wrote to memory of 2708	1116	cmd.exe	43
PID 1116 wrote to memory of 2716	1116	cmd.exe	44

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2120	attrib.exe
1524	Process not Found
2880	Process not Found
1560	Process not Found
568	Process not Found
2688	attrib.exe
588	attrib.exe
2120	Process not Found
1100	attrib.exe
952	Process not Found
1388	Process not Found
2960	Process not Found
2752	Process not Found
2296	Process not Found
112	Process not Found
848	Process not Found
2440	Process not Found
1540	Process not Found
2032	Process not Found
1740	Process not Found
1964	Process not Found
2780	Process not Found
2076	attrib.exe
1196	Process not Found
2836	Process not Found
2888	Process not Found
1228	attrib.exe
768	Process not Found
1844	Process not Found
2928	Process not Found
692	Process not Found
2004	Process not Found
2828	attrib.exe
1100	Process not Found
2076	Process not Found
2180	attrib.exe
2724	Process not Found
1160	Process not Found
2000	Process not Found
1172	Process not Found
2824	Process not Found
2028	Process not Found
1104	Process not Found
1072	Process not Found
280	Process not Found
2608	Process not Found
1936	attrib.exe
276	Process not Found
1500	Process not Found
2880	Process not Found
2408	Process not Found
2216	Process not Found
2660	attrib.exe
2168	attrib.exe
1104	Process not Found
1696	Process not Found
1548	Process not Found
680	Process not Found
816	Process not Found
788	Process not Found
2952	Process not Found
1476	Process not Found
2024	Process not Found
2992	attrib.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e46c4fec38dd74ac034fca86ae347cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e46c4fec38dd74ac034fca86ae347cd.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\deletefiledos.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:2000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1232
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:1228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:3068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1232
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:1152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2696
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1428
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:2188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:1348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:1100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2696
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Drops file in System32 directory
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1096
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2312
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\deletefiledos.bat

Filesize
176B

MD5
656da6bd53be9d048af4fb2e360cc4a8

SHA1
780490d1f5a14709f4a7301671df55024fb46839

SHA256
70263262c8bd81e56eede708772bd9c669cefcb68fae3601e5af381f47ce90b6

SHA512
b45a7e7d2a191428ed6df5f82bd808d317a27be217ae8566416ab20b143cdd2c2fbecee9a67b25e31e9eed5f9a32b4f3e28505900815c66e641a43f832ba27c6

Download Submit