740edb7f3dfdd8a986bb3949e8d9d90a4ae352981cf7ad61666f3f6bfd74af41

Analysis

max time kernel
58s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e46c4fec38dd74ac034fca86ae347cd.dll
Size

15KB
MD5

0e46c4fec38dd74ac034fca86ae347cd
SHA1

f61f07c74305be6008e6b0a4e4cd434fdbca1560
SHA256

740edb7f3dfdd8a986bb3949e8d9d90a4ae352981cf7ad61666f3f6bfd74af41
SHA512

e2d35782d624a40e714734d6cd611d6070aea74d19372f4c3173aa07fd7733e5ce988d0256f738a31d40d682fd771f4f0b0d662415daf0ef6d669b9a13ea1ab2
SSDEEP

384:e96zMSYrbPH7WfOYeF3sQcqcdjcZhzcPVYYO9d:ekgnaleFsJnpKlcPJ4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found
File opened for modification	C:\WINDOWS\SysWOW64\verclsid.exe	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 3416	988	attrib.exe	2528
PID 988 wrote to memory of 3416	988	attrib.exe	2528
PID 988 wrote to memory of 3416	988	attrib.exe	2528
PID 3416 wrote to memory of 1796	3416	Process not Found	32
PID 3416 wrote to memory of 1796	3416	Process not Found	32
PID 3416 wrote to memory of 1796	3416	Process not Found	32
PID 1796 wrote to memory of 1244	1796	cmd.exe	2585
PID 1796 wrote to memory of 1244	1796	cmd.exe	2585
PID 1796 wrote to memory of 1244	1796	cmd.exe	2585
PID 1796 wrote to memory of 392	1796	cmd.exe	2767
PID 1796 wrote to memory of 392	1796	cmd.exe	2767
PID 1796 wrote to memory of 392	1796	cmd.exe	2767
PID 1796 wrote to memory of 3476	1796	cmd.exe	2464
PID 1796 wrote to memory of 3476	1796	cmd.exe	2464
PID 1796 wrote to memory of 3476	1796	cmd.exe	2464
PID 1796 wrote to memory of 4156	1796	cmd.exe	2766
PID 1796 wrote to memory of 4156	1796	cmd.exe	2766
PID 1796 wrote to memory of 4156	1796	cmd.exe	2766
PID 1796 wrote to memory of 4044	1796	cmd.exe	2765
PID 1796 wrote to memory of 4044	1796	cmd.exe	2765
PID 1796 wrote to memory of 4044	1796	cmd.exe	2765
PID 1796 wrote to memory of 3664	1796	cmd.exe	2764
PID 1796 wrote to memory of 3664	1796	cmd.exe	2764
PID 1796 wrote to memory of 3664	1796	cmd.exe	2764
PID 1796 wrote to memory of 4036	1796	cmd.exe	2716
PID 1796 wrote to memory of 4036	1796	cmd.exe	2716
PID 1796 wrote to memory of 4036	1796	cmd.exe	2716
PID 1796 wrote to memory of 2096	1796	cmd.exe	2763
PID 1796 wrote to memory of 2096	1796	cmd.exe	2763
PID 1796 wrote to memory of 2096	1796	cmd.exe	2763
PID 1796 wrote to memory of 1564	1796	cmd.exe	2714
PID 1796 wrote to memory of 1564	1796	cmd.exe	2714
PID 1796 wrote to memory of 1564	1796	cmd.exe	2714
PID 1796 wrote to memory of 652	1796	cmd.exe	2761
PID 1796 wrote to memory of 652	1796	cmd.exe	2761
PID 1796 wrote to memory of 652	1796	cmd.exe	2761
PID 1796 wrote to memory of 3988	1796	cmd.exe	2760
PID 1796 wrote to memory of 3988	1796	cmd.exe	2760
PID 1796 wrote to memory of 3988	1796	cmd.exe	2760
PID 1796 wrote to memory of 3048	1796	cmd.exe	2759
PID 1796 wrote to memory of 3048	1796	cmd.exe	2759
PID 1796 wrote to memory of 3048	1796	cmd.exe	2759
PID 1796 wrote to memory of 1072	1796	cmd.exe	2497
PID 1796 wrote to memory of 1072	1796	cmd.exe	2497
PID 1796 wrote to memory of 1072	1796	cmd.exe	2497
PID 1796 wrote to memory of 4652	1796	cmd.exe	2127
PID 1796 wrote to memory of 4652	1796	cmd.exe	2127
PID 1796 wrote to memory of 4652	1796	cmd.exe	2127
PID 1796 wrote to memory of 1936	1796	cmd.exe	2758
PID 1796 wrote to memory of 1936	1796	cmd.exe	2758
PID 1796 wrote to memory of 1936	1796	cmd.exe	2758
PID 1796 wrote to memory of 5012	1796	cmd.exe	2614
PID 1796 wrote to memory of 5012	1796	cmd.exe	2614
PID 1796 wrote to memory of 5012	1796	cmd.exe	2614
PID 1796 wrote to memory of 4000	1796	cmd.exe	2757
PID 1796 wrote to memory of 4000	1796	cmd.exe	2757
PID 1796 wrote to memory of 4000	1796	cmd.exe	2757
PID 1796 wrote to memory of 4932	1796	cmd.exe	2286
PID 1796 wrote to memory of 4932	1796	cmd.exe	2286
PID 1796 wrote to memory of 4932	1796	cmd.exe	2286
PID 1796 wrote to memory of 4620	1796	cmd.exe	1894
PID 1796 wrote to memory of 4620	1796	cmd.exe	1894
PID 1796 wrote to memory of 4620	1796	cmd.exe	1894
PID 1796 wrote to memory of 4476	1796	cmd.exe	2756

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2376	Process not Found
472	Process not Found
4664	attrib.exe
4012	attrib.exe
2504	attrib.exe
352	attrib.exe
3656	Process not Found
2340	Process not Found
4868	Process not Found
4548	attrib.exe
748	Process not Found
4040	Process not Found
3340	Process not Found
428	Process not Found
1516	Process not Found
3456	Process not Found
4992	Process not Found
2124	Process not Found
2992	Process not Found
4220	Process not Found
4516	Process not Found
3364	attrib.exe
4620	Process not Found
2112	Process not Found
4628	Process not Found
4548	attrib.exe
3516	attrib.exe
352	Process not Found
4012	Process not Found
636	Process not Found
352	Process not Found
3808	Process not Found
4060	attrib.exe
4936	Process not Found
2852	Process not Found
3908	Process not Found
1740	Process not Found
2412	attrib.exe
4164	Process not Found
4956	Process not Found
4164	Process not Found
4920	Process not Found
888	Process not Found
4036	Process not Found
4728	Process not Found
332	Process not Found
3416	Process not Found
4132	Process not Found
2800	attrib.exe
400	attrib.exe
4536	Process not Found
2280	Process not Found
4896	Process not Found
3952	attrib.exe
3544	Process not Found
4880	Process not Found
2972	Process not Found
3456	Process not Found
3716	Process not Found
1504	Process not Found
400	attrib.exe
3824	attrib.exe
4340	Process not Found
2768	Process not Found

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e46c4fec38dd74ac034fca86ae347cd.dll,#1
1⤵
PID:988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e46c4fec38dd74ac034fca86ae347cd.dll,#1
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\deletefiledos.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1244
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3476
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:4664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3476
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Suspicious use of WriteProcessMemory
      PID:988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4604
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:60
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3568
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2244
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:4012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3476
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3408
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:4548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4740
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:3364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:3952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:416
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:60
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:60
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:428
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:3516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2168
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4896
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:3824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4208
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3900
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4896
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      Views/modifies file attributes
      PID:4548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1516
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:5056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:4664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:1436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:2412
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\WINDOWS\SYSTEM32\VERCLSID.EXE" -r -a -s -h
      4⤵
      PID:3124

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\deletefiledos.bat

Filesize
176B

MD5
656da6bd53be9d048af4fb2e360cc4a8

SHA1
780490d1f5a14709f4a7301671df55024fb46839

SHA256
70263262c8bd81e56eede708772bd9c669cefcb68fae3601e5af381f47ce90b6

SHA512
b45a7e7d2a191428ed6df5f82bd808d317a27be217ae8566416ab20b143cdd2c2fbecee9a67b25e31e9eed5f9a32b4f3e28505900815c66e641a43f832ba27c6

Download Submit