Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
0e5508195cce17c870f3d95145f21851.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e5508195cce17c870f3d95145f21851.exe
Resource
win10v2004-20231215-en
General
-
Target
0e5508195cce17c870f3d95145f21851.exe
-
Size
14KB
-
MD5
0e5508195cce17c870f3d95145f21851
-
SHA1
c6ed6da61b595b19aaffa2a4dc0c9aabe13cf3da
-
SHA256
a4809f392c8c5f7f48ce0b3bcaf1a9d6f415ab29a438e6ca50ce25d4ae0e854d
-
SHA512
164dceb4eb40f68fdf59066a3ca08c35e11d691fd0a35a792a517d5f68d48e11e9c11dda392ef6789b37e9bd1759bcccb06299a823029b586e65002070b9ec5e
-
SSDEEP
384:IDppUZee8Qn3LUdrv6HU3OVNnhe12aYGIQ:8de8QbUdry0e3nhe12aY4
Malware Config
Signatures
-
Executes dropped EXE 27 IoCs
pid Process 5112 rarjbtl.exe 3892 rarjbtl.exe 3508 rarjbtl.exe 2764 rarjbtl.exe 1172 rarjbtl.exe 4592 rarjbtl.exe 4356 rarjbtl.exe 4568 rarjbtl.exe 2924 rarjbtl.exe 4572 rarjbtl.exe 3628 rarjbtl.exe 2500 rarjbtl.exe 2120 attrib.exe 3164 rarjbtl.exe 4256 attrib.exe 932 attrib.exe 2796 rarjbtl.exe 1016 rarjbtl.exe 4144 attrib.exe 2172 attrib.exe 2160 rarjbtl.exe 2476 rarjbtl.exe 5312 rarjbtl.exe 5632 rarjbtl.exe 5832 rarjbtl.exe 6100 rarjbtl.exe 5160 rarjbtl.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rarjani.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbtl.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbtl.exe rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File created C:\Windows\SysWOW64\rarjbpi.dll attrib.exe File created C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File created C:\Windows\SysWOW64\rarjbpi.dll attrib.exe File opened for modification C:\Windows\SysWOW64\rarjani.dll rarjbtl.exe File created C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjani.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbtl.exe rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjani.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbtl.exe rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbtl.exe rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjani.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbpi.dll attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File created C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Conhost.exe File created C:\Windows\SysWOW64\rarjbtl.exe 0e5508195cce17c870f3d95145f21851.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File created C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbpi.dll attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjbtl.exe rarjbtl.exe File opened for modification C:\Windows\SysWOW64\rarjbpi.dll attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File created C:\Windows\SysWOW64\rarjbpi.dll attrib.exe File opened for modification C:\Windows\SysWOW64\rarjani.dll rarjbtl.exe File created C:\Windows\SysWOW64\rarjbpi.dll rarjbtl.exe -
Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 0e5508195cce17c870f3d95145f21851.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\Fonts\chreaur.fon 0e5508195cce17c870f3d95145f21851.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 rarjbtl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 0e5508195cce17c870f3d95145f21851.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" 0e5508195cce17c870f3d95145f21851.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52} 0e5508195cce17c870f3d95145f21851.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 0e5508195cce17c870f3d95145f21851.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ThreadingModel = "Apartment" rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32 rarjbtl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2598FF45-DA60-F48A-BC43-10AC47853D52}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjbpi.dll" rarjbtl.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 1660 0e5508195cce17c870f3d95145f21851.exe 1660 0e5508195cce17c870f3d95145f21851.exe 5112 rarjbtl.exe 5112 rarjbtl.exe 3892 rarjbtl.exe 3892 rarjbtl.exe 3508 rarjbtl.exe 3508 rarjbtl.exe 2764 rarjbtl.exe 2764 rarjbtl.exe 1172 rarjbtl.exe 1172 rarjbtl.exe 4592 rarjbtl.exe 4592 rarjbtl.exe 4356 rarjbtl.exe 4356 rarjbtl.exe 4568 rarjbtl.exe 4568 rarjbtl.exe 2924 rarjbtl.exe 2924 rarjbtl.exe 4572 rarjbtl.exe 4572 rarjbtl.exe 3628 rarjbtl.exe 3628 rarjbtl.exe 2500 rarjbtl.exe 2500 rarjbtl.exe 2120 attrib.exe 2120 attrib.exe 3164 rarjbtl.exe 3164 rarjbtl.exe 4256 attrib.exe 4256 attrib.exe 932 attrib.exe 932 attrib.exe 2796 rarjbtl.exe 2796 rarjbtl.exe 1016 rarjbtl.exe 1016 rarjbtl.exe 4144 attrib.exe 4144 attrib.exe 2172 attrib.exe 2172 attrib.exe 2160 rarjbtl.exe 2160 rarjbtl.exe 2476 rarjbtl.exe 2476 rarjbtl.exe 5312 rarjbtl.exe 5312 rarjbtl.exe 5632 rarjbtl.exe 5632 rarjbtl.exe 5832 rarjbtl.exe 5832 rarjbtl.exe 6100 rarjbtl.exe 6100 rarjbtl.exe 5160 rarjbtl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 2960 1660 0e5508195cce17c870f3d95145f21851.exe 35 PID 1660 wrote to memory of 2960 1660 0e5508195cce17c870f3d95145f21851.exe 35 PID 1660 wrote to memory of 2960 1660 0e5508195cce17c870f3d95145f21851.exe 35 PID 1660 wrote to memory of 5112 1660 0e5508195cce17c870f3d95145f21851.exe 36 PID 1660 wrote to memory of 5112 1660 0e5508195cce17c870f3d95145f21851.exe 36 PID 1660 wrote to memory of 5112 1660 0e5508195cce17c870f3d95145f21851.exe 36 PID 5112 wrote to memory of 1336 5112 rarjbtl.exe 40 PID 5112 wrote to memory of 1336 5112 rarjbtl.exe 40 PID 5112 wrote to memory of 1336 5112 rarjbtl.exe 40 PID 5112 wrote to memory of 3892 5112 rarjbtl.exe 731 PID 5112 wrote to memory of 3892 5112 rarjbtl.exe 731 PID 5112 wrote to memory of 3892 5112 rarjbtl.exe 731 PID 2960 wrote to memory of 5012 2960 cmd.exe 730 PID 2960 wrote to memory of 5012 2960 cmd.exe 730 PID 2960 wrote to memory of 5012 2960 cmd.exe 730 PID 1336 wrote to memory of 2164 1336 cmd.exe 247 PID 1336 wrote to memory of 2164 1336 cmd.exe 247 PID 1336 wrote to memory of 2164 1336 cmd.exe 247 PID 2960 wrote to memory of 1512 2960 cmd.exe 607 PID 2960 wrote to memory of 1512 2960 cmd.exe 607 PID 2960 wrote to memory of 1512 2960 cmd.exe 607 PID 1336 wrote to memory of 5072 1336 cmd.exe 728 PID 1336 wrote to memory of 5072 1336 cmd.exe 728 PID 1336 wrote to memory of 5072 1336 cmd.exe 728 PID 1336 wrote to memory of 4788 1336 cmd.exe 727 PID 1336 wrote to memory of 4788 1336 cmd.exe 727 PID 1336 wrote to memory of 4788 1336 cmd.exe 727 PID 2960 wrote to memory of 3744 2960 cmd.exe 726 PID 2960 wrote to memory of 3744 2960 cmd.exe 726 PID 2960 wrote to memory of 3744 2960 cmd.exe 726 PID 3892 wrote to memory of 2304 3892 rarjbtl.exe 725 PID 3892 wrote to memory of 2304 3892 rarjbtl.exe 725 PID 3892 wrote to memory of 2304 3892 rarjbtl.exe 725 PID 1336 wrote to memory of 1996 1336 cmd.exe 723 PID 1336 wrote to memory of 1996 1336 cmd.exe 723 PID 1336 wrote to memory of 1996 1336 cmd.exe 723 PID 3892 wrote to memory of 3508 3892 rarjbtl.exe 722 PID 3892 wrote to memory of 3508 3892 rarjbtl.exe 722 PID 3892 wrote to memory of 3508 3892 rarjbtl.exe 722 PID 1336 wrote to memory of 400 1336 cmd.exe 721 PID 1336 wrote to memory of 400 1336 cmd.exe 721 PID 1336 wrote to memory of 400 1336 cmd.exe 721 PID 2304 wrote to memory of 3572 2304 cmd.exe 720 PID 2304 wrote to memory of 3572 2304 cmd.exe 720 PID 2304 wrote to memory of 3572 2304 cmd.exe 720 PID 2960 wrote to memory of 4128 2960 cmd.exe 719 PID 2960 wrote to memory of 4128 2960 cmd.exe 719 PID 2960 wrote to memory of 4128 2960 cmd.exe 719 PID 1336 wrote to memory of 3612 1336 cmd.exe 718 PID 1336 wrote to memory of 3612 1336 cmd.exe 718 PID 1336 wrote to memory of 3612 1336 cmd.exe 718 PID 2960 wrote to memory of 4696 2960 cmd.exe 717 PID 2960 wrote to memory of 4696 2960 cmd.exe 717 PID 2960 wrote to memory of 4696 2960 cmd.exe 717 PID 1336 wrote to memory of 4092 1336 cmd.exe 715 PID 1336 wrote to memory of 4092 1336 cmd.exe 715 PID 1336 wrote to memory of 4092 1336 cmd.exe 715 PID 3508 wrote to memory of 4848 3508 rarjbtl.exe 716 PID 3508 wrote to memory of 4848 3508 rarjbtl.exe 716 PID 3508 wrote to memory of 4848 3508 rarjbtl.exe 716 PID 3508 wrote to memory of 2764 3508 rarjbtl.exe 712 PID 3508 wrote to memory of 2764 3508 rarjbtl.exe 712 PID 3508 wrote to memory of 2764 3508 rarjbtl.exe 712 PID 2304 wrote to memory of 1724 2304 cmd.exe 713 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 15632 Process not Found 16112 Process not Found 1512 attrib.exe 7964 attrib.exe 5256 Process not Found 13880 Process not Found 8336 Process not Found 5580 attrib.exe 12540 Process not Found 6004 Process not Found 15136 Process not Found 5404 Process not Found 2332 attrib.exe 6748 attrib.exe 12972 Process not Found 6856 attrib.exe 8320 Process not Found 5512 attrib.exe 7352 attrib.exe 8628 Process not Found 10292 Process not Found 6888 attrib.exe 6568 attrib.exe 15704 Process not Found 6072 attrib.exe 6904 attrib.exe 6928 attrib.exe 10152 Process not Found 7068 Process not Found 11792 Process not Found 5288 attrib.exe 4464 attrib.exe 7812 Process not Found 13332 Process not Found 6544 attrib.exe 16180 Process not Found 8488 Process not Found 5236 attrib.exe 13036 Process not Found 14636 Process not Found 8716 Process not Found 15824 Process not Found 6536 attrib.exe 5512 attrib.exe 6252 attrib.exe 5692 Process not Found 13916 Process not Found 10896 Process not Found 9688 Process not Found 2332 attrib.exe 3020 attrib.exe 6776 attrib.exe 14924 Process not Found 14904 Process not Found 6188 Process not Found 1996 attrib.exe 12520 Process not Found 15112 Process not Found 9980 Process not Found 9672 Process not Found 5388 attrib.exe 5372 attrib.exe 15092 Process not Found 6704 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e5508195cce17c870f3d95145f21851.exe"C:\Users\Admin\AppData\Local\Temp\0e5508195cce17c870f3d95145f21851.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240608468.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:1512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:4696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:4128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:8164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:6568
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240608656.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5652
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6512
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6180
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4716
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Drops file in System32 directory
PID:1168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4788
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4920
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7024
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609093.bat1⤵PID:1840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:5388
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Drops file in System32 directory
PID:228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:7964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:4296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2356
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4592 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4356 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4568
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609484.bat3⤵PID:380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7128
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609359.bat2⤵PID:4408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7304
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:1200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4036
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609812.bat2⤵PID:3880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4360
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6804
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:5372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7756
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:568
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3628 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610078.bat2⤵PID:3648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7152
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5064
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2568
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6948
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4920
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1768
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6612
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3640
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:2120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610359.bat2⤵PID:3972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:5220
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Views/modifies file attributes
PID:6888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:8144
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:4020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2196
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:4256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610625.bat2⤵PID:944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:1940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵
- Drops file in System32 directory
PID:4148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3988
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5596
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6136
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:8148
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6420
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3872
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610765.bat1⤵PID:3240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:6072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6384
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240622203.bat3⤵PID:6328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:8044
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:6544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4292
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610906.bat1⤵PID:4856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Drops file in System32 directory
PID:3476
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵PID:2944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5364
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7888
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1016 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:4144
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240611046.bat2⤵PID:2568
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5504
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5664
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6872
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6204
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:8080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6640
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4160
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4312
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:872
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3476
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2160
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240611515.bat2⤵PID:3396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2692
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2476 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240613562.bat4⤵PID:5544
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵
- Views/modifies file attributes
PID:5580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6732
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7112
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7048
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6512
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240613734.bat5⤵PID:5744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:5568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6896
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:5400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6784
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:4920
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:3556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:7208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:5800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:7644
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5832 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe6⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:6100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240613875.bat6⤵PID:6000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:6644
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:6564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:6420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:7992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:6640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:6900
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240611671.bat3⤵PID:5132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5356
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6248
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4320
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240625265.bat6⤵PID:6784
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:7820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:7836
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:5004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:7836
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe6⤵PID:7220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240629796.bat7⤵PID:7672
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:7200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Views/modifies file attributes
PID:6748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:7544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:7436
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe7⤵PID:7792
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe8⤵PID:8064
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240630093.bat9⤵PID:8188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:8124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:6984
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:6808
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe9⤵PID:2420
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe10⤵PID:6204
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240631656.bat11⤵PID:8100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:6996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:8000
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe11⤵PID:7852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240631812.bat12⤵PID:6632
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:7356
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe12⤵PID:7244
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240631984.bat13⤵PID:3608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:7708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:7408
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe13⤵PID:6472
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe14⤵PID:7540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240632343.bat15⤵PID:7884
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe15⤵PID:7312
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe16⤵PID:6976
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe17⤵PID:7844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240632640.bat17⤵PID:7768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240632484.bat16⤵PID:7632
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240632125.bat14⤵PID:6944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:7372
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240630234.bat10⤵PID:7448
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4660
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:7668
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240629953.bat8⤵PID:7916
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:7532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:7444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:7232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:7260
-
-
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:4920
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5404
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:8140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3484
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4540
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2476
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240611343.bat1⤵PID:2236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5044
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5212
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5164
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5324
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:4464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:7352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3504
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3372
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4540
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5260
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5204
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5156
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:2196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6192
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5736
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5332
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3504
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:2172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240611203.bat1⤵PID:2968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6072
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3396
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6412
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Drops file in System32 directory
PID:5276
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6168
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:8036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3740
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3040
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2372
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4540
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2692
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2796
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3428
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:5520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:6108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5272
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5160 -
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:5812
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614312.bat3⤵PID:6080
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6996
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6216
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6272
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7556
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵PID:5264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614171.bat2⤵PID:5700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:8184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614453.bat1⤵PID:5204
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6160
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6472
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6444
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7724
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:5900
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:5436
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614921.bat3⤵PID:5904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6672
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Views/modifies file attributes
PID:5288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:5724
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7528
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵PID:2164
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe4⤵PID:5720
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe5⤵PID:5124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615218.bat5⤵PID:6048
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:7024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:7292
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:7468
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:6928
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615078.bat4⤵PID:2844
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614750.bat2⤵PID:6092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:4544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7656
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6068
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:6772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240616796.bat3⤵PID:6332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6416
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7548
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7232
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵PID:5824
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe4⤵PID:5352
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240617078.bat5⤵PID:6604
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe5⤵PID:7044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240617218.bat6⤵PID:6724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Drops file in System32 directory
PID:5624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:6420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:4684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:7284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:7164
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe6⤵PID:6856
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240621921.bat7⤵PID:7060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵
- Views/modifies file attributes
PID:6928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:6756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:6244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:7616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:8076
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe7⤵PID:6188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240622046.bat8⤵PID:1076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:6316
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:1488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:6900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:7256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:6464
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe8⤵PID:6384
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe9⤵PID:4540
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240622359.bat10⤵PID:6216
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:7124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2420
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:6928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:8008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:4576
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe10⤵PID:6560
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240624812.bat11⤵PID:6968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:5800
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:6568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:7456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:6640
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe11⤵PID:6152
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe12⤵PID:6504
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe13⤵PID:4320
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240624953.bat12⤵PID:6496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:7632
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:7312
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:7260
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240616937.bat4⤵PID:1584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:6460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7432
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240616484.bat2⤵PID:6656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6136
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5400
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:5180
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5736
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5612
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240616328.bat2⤵PID:6248
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6476
-
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:6068
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:5604
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:5484
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe3⤵PID:5340
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe4⤵PID:6264
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615765.bat4⤵PID:5140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1532
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7424
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:7196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:8168
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615625.bat3⤵PID:6084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵
- Views/modifies file attributes
PID:3020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:4544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7352
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615484.bat2⤵PID:5296
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5256
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5404
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6524
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6532
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6708
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240616078.bat1⤵PID:6788
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7772
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7232
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:6856
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:6916
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe2⤵PID:5612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240616203.bat2⤵PID:7072
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:5328
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:6880
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6924
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6868
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7092
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7056
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7152
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6216
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6176
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7004
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6260
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6712
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6888
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7116
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:6704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6568
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:7000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6728
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:6536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6488
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6520
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6464
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6508
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5284
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6232
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6840
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6816
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6752
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:6580
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6488
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615937.bat1⤵PID:6480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7056
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6392
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6152
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5276
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6024
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5184
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6068
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6072
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5356
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:5512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5404
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5808
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240615343.bat1⤵PID:5760
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6504
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240625093.bat3⤵PID:6208
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:6780
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:7544
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5800
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5324
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6136
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:5236
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5328
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5292
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5340
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5128
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614593.bat1⤵PID:5892
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:7152
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6396
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:8120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7616
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5796
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵PID:5200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:5512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5352
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5296
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5860
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:5192
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:5420
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240614015.bat1⤵PID:5496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:6252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7520
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1240
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4788
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:6012
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5896
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5856
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:5552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5428
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1696
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2692
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610484.bat1⤵PID:4100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6848
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:6776
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7900
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7248
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3052
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:1996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1844
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240610234.bat1⤵PID:4388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7136
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7116
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6588
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4256
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:6904
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6860
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6400
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7476
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7556
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:4160
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2248
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4336
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2104
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3092
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609937.bat1⤵PID:1624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6880
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6692
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2284
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4804
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:2144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4120
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:5044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:752
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:1420
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:4584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:4044
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609656.bat1⤵PID:4224
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7892
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6252
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:1620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4696
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3488
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:2456
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4776
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4416
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:988
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240609218.bat1⤵PID:4288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4508
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6936
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:5868
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:8096
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:3044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:440
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4676
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:712
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:4224
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6432
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6740
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7704
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6352
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:8000
-
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240608937.bat1⤵PID:4848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:4392
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3572
-
C:\Windows\SysWOW64\rarjbtl.exeC:\Windows\system32\rarjbtl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3508
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\DFD240608796.bat1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7100
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:7852
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6368
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:6808
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:8180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
97B
MD5f9d37f0ad626bcf74d0797f89c3185ce
SHA133750b01ccf2ced6b476e5613591f2a6f2263e33
SHA256ac8423bb647988a91091927fb3b470befbda01c9ec1a91916663fa669ceac6a3
SHA5124cba5c81a08f418152a042f8017761211b8d3024d6410ce4ff772fff25193df6f07c5b19a01061548f9d2a7ef2ede6b8ca3778336cd73acaa6abed9372f84d11
-
Filesize
55B
MD5251a2bfba56e940f5b4568a26e373ccf
SHA1068b801e372b5677969a582a9301ec19edd4c3eb
SHA25672a45d7a408cfce63ff9f12735759e7b774390470d7486fbf44000d20037ebbc
SHA512c51c995ff87658ac383b3facfc341534cceaa20a4c424cffd05300585c155b23d3b0af252d4e0d4438d1fa0a7a85ca484e85a9babf11b7dbf2c3e687f08a49fa
-
Filesize
20KB
MD59690ada8f7731cd28163f8a768b2ef33
SHA1dbd238e8ee794aa76e342cefe49d1c1dbaa09bd7
SHA256d7dc98d4d6f4e9778545b8ee99a47640ecd6dce5f73fe3ccd0ad9ab95b00231a
SHA5123f1dd2b84bddf44352377996915cfdb640c0aadf6672690782b6b25ce9dc9152e7e48f17d4155414c046a03a91f0648f71f39bc767bb22731ab3adc321736a06
-
Filesize
14KB
MD50e5508195cce17c870f3d95145f21851
SHA1c6ed6da61b595b19aaffa2a4dc0c9aabe13cf3da
SHA256a4809f392c8c5f7f48ce0b3bcaf1a9d6f415ab29a438e6ca50ce25d4ae0e854d
SHA512164dceb4eb40f68fdf59066a3ca08c35e11d691fd0a35a792a517d5f68d48e11e9c11dda392ef6789b37e9bd1759bcccb06299a823029b586e65002070b9ec5e