Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
76d2fa4c3c7a1a2266a0ae542de633c8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
76d2fa4c3c7a1a2266a0ae542de633c8.exe
Resource
win10v2004-20231215-en
General
-
Target
76d2fa4c3c7a1a2266a0ae542de633c8.exe
-
Size
14KB
-
MD5
76d2fa4c3c7a1a2266a0ae542de633c8
-
SHA1
f38eee6e28ba54455439bc87dffdee983093911d
-
SHA256
a4c75a4802d7eb144b72dad0ec5e9dc55e0e10063164e6661537059fb9a9c27a
-
SHA512
25c3e94430058fe33f174a85e6f199e9f0aed8fceb59d69fcf79d55933f5963c0c5a13513abe3995727ffec50299a7caf83d4c472813e4c497f7f6b1a77191bf
-
SSDEEP
384:InL3IUpWlu/0uuGuEwJ5WyQCboVQTUwdIqLvZIRMeK2x:IWlSbugw6yhUVQQw1Kj
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4472 Process not Found -
Executes dropped EXE 64 IoCs
pid Process 2164 rarjctl.exe 2596 rarjctl.exe 952 rarjctl.exe 1368 rarjctl.exe 480 rarjctl.exe 2116 rarjctl.exe 1996 rarjctl.exe 3068 rarjctl.exe 2780 attrib.exe 2840 rarjctl.exe 1100 attrib.exe 1592 rarjctl.exe 2400 rarjctl.exe 2716 rarjctl.exe 1056 attrib.exe 324 rarjctl.exe 2280 rarjctl.exe 1936 attrib.exe 1980 attrib.exe 3028 attrib.exe 2688 rarjctl.exe 2228 rarjctl.exe 2732 rarjctl.exe 1168 attrib.exe 2344 attrib.exe 2480 rarjctl.exe 2568 rarjctl.exe 972 rarjctl.exe 2616 rarjctl.exe 668 rarjctl.exe 2500 rarjctl.exe 1884 rarjctl.exe 2996 rarjctl.exe 1696 rarjctl.exe 1452 rarjctl.exe 2264 rarjctl.exe 1796 rarjctl.exe 3036 rarjctl.exe 2960 rarjctl.exe 1952 rarjctl.exe 2488 rarjctl.exe 1640 rarjctl.exe 1624 Process not Found 2708 Process not Found 3384 Process not Found 3948 Process not Found 3212 Process not Found 3712 Process not Found 1172 Process not Found 3636 Process not Found 1152 Process not Found 604 Process not Found 3284 Process not Found 3972 Process not Found 3144 Process not Found 1712 Process not Found 3844 Process not Found 3652 Process not Found 3232 Process not Found 3872 Process not Found 3812 Process not Found 1608 Process not Found 3516 Process not Found 3776 Process not Found -
Loads dropped DLL 64 IoCs
pid Process 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 2164 rarjctl.exe 2164 rarjctl.exe 2596 rarjctl.exe 2596 rarjctl.exe 952 rarjctl.exe 952 rarjctl.exe 1368 rarjctl.exe 1368 rarjctl.exe 480 rarjctl.exe 480 rarjctl.exe 2116 rarjctl.exe 2116 rarjctl.exe 1996 rarjctl.exe 1996 rarjctl.exe 3068 rarjctl.exe 3068 rarjctl.exe 2780 attrib.exe 2780 attrib.exe 2840 rarjctl.exe 2840 rarjctl.exe 1100 attrib.exe 1100 attrib.exe 1592 rarjctl.exe 1592 rarjctl.exe 2400 rarjctl.exe 2400 rarjctl.exe 2716 rarjctl.exe 2716 rarjctl.exe 1056 attrib.exe 1056 attrib.exe 324 rarjctl.exe 324 rarjctl.exe 2280 rarjctl.exe 2280 rarjctl.exe 1936 attrib.exe 1936 attrib.exe 1980 attrib.exe 1980 attrib.exe 3028 attrib.exe 3028 attrib.exe 2688 rarjctl.exe 2688 rarjctl.exe 2228 rarjctl.exe 2228 rarjctl.exe 2732 rarjctl.exe 2732 rarjctl.exe 1168 attrib.exe 1168 attrib.exe 2344 attrib.exe 2344 attrib.exe 2480 rarjctl.exe 2480 rarjctl.exe 2568 rarjctl.exe 2568 rarjctl.exe 972 rarjctl.exe 972 rarjctl.exe 2616 rarjctl.exe 2616 rarjctl.exe 668 rarjctl.exe 668 rarjctl.exe 2500 rarjctl.exe 2500 rarjctl.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File created C:\Windows\SysWOW64\rarjcpi.dll Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe rarjctl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File created C:\Windows\SysWOW64\rarjcpi.dll rarjctl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File created C:\Windows\SysWOW64\rarjcpi.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe conhost.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\rarjcpi.dll rarjctl.exe File opened for modification C:\Windows\SysWOW64\rarjcni.dll rarjctl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe cmd.exe File opened for modification C:\Windows\SysWOW64\rarjcni.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjcni.dll Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjcni.dll Process not Found File opened for modification C:\Windows\SysWOW64\rarjcni.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjcni.dll rarjctl.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File created C:\Windows\SysWOW64\rarjcpi.dll Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found File opened for modification C:\Windows\SysWOW64\rarjctl.exe Process not Found File opened for modification C:\Windows\SysWOW64\verclsid.exe attrib.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe Process not Found -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\Fonts\chreaur.fon 76d2fa4c3c7a1a2266a0ae542de633c8.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 attrib.exe File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 rarjctl.exe File opened for modification C:\Windows\SysWOW64 Process not Found File opened for modification C:\Windows\SysWOW64 Process not Found -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" attrib.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 76d2fa4c3c7a1a2266a0ae542de633c8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32 attrib.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ThreadingModel = "Apartment" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3598FF45-DA60-F48A-BC43-10AC47853D53}\InprocServer32\ = "C:\\Windows\\SysWow64\\rarjcpi.dll" rarjctl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 2164 rarjctl.exe 2596 rarjctl.exe 952 rarjctl.exe 1368 rarjctl.exe 480 rarjctl.exe 2116 rarjctl.exe 1996 rarjctl.exe 3068 rarjctl.exe 2780 attrib.exe 2840 rarjctl.exe 1100 attrib.exe 1592 rarjctl.exe 2400 rarjctl.exe 2716 rarjctl.exe 1056 attrib.exe 324 rarjctl.exe 2280 rarjctl.exe 1936 attrib.exe 1980 attrib.exe 3028 attrib.exe 2688 rarjctl.exe 2688 rarjctl.exe 2228 rarjctl.exe 2228 rarjctl.exe 2732 rarjctl.exe 2732 rarjctl.exe 1168 attrib.exe 1168 attrib.exe 2344 attrib.exe 2344 attrib.exe 2480 rarjctl.exe 2480 rarjctl.exe 2568 rarjctl.exe 2568 rarjctl.exe 2568 rarjctl.exe 972 rarjctl.exe 972 rarjctl.exe 2616 rarjctl.exe 2616 rarjctl.exe 2616 rarjctl.exe 668 rarjctl.exe 668 rarjctl.exe 668 rarjctl.exe 2500 rarjctl.exe 2500 rarjctl.exe 2500 rarjctl.exe 1884 rarjctl.exe 1884 rarjctl.exe 1884 rarjctl.exe 2996 rarjctl.exe 2996 rarjctl.exe 2996 rarjctl.exe 1696 rarjctl.exe 1696 rarjctl.exe 1696 rarjctl.exe 1696 rarjctl.exe 1452 rarjctl.exe 1452 rarjctl.exe 1452 rarjctl.exe 1452 rarjctl.exe 2264 rarjctl.exe 2264 rarjctl.exe 2264 rarjctl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1088 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 480 PID 1732 wrote to memory of 1088 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 480 PID 1732 wrote to memory of 1088 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 480 PID 1732 wrote to memory of 1088 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 480 PID 1732 wrote to memory of 2164 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 478 PID 1732 wrote to memory of 2164 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 478 PID 1732 wrote to memory of 2164 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 478 PID 1732 wrote to memory of 2164 1732 76d2fa4c3c7a1a2266a0ae542de633c8.exe 478 PID 1088 wrote to memory of 2620 1088 cmd.exe 477 PID 1088 wrote to memory of 2620 1088 cmd.exe 477 PID 1088 wrote to memory of 2620 1088 cmd.exe 477 PID 1088 wrote to memory of 2620 1088 cmd.exe 477 PID 1088 wrote to memory of 2608 1088 cmd.exe 399 PID 1088 wrote to memory of 2608 1088 cmd.exe 399 PID 1088 wrote to memory of 2608 1088 cmd.exe 399 PID 1088 wrote to memory of 2608 1088 cmd.exe 399 PID 1088 wrote to memory of 2584 1088 cmd.exe 223 PID 1088 wrote to memory of 2584 1088 cmd.exe 223 PID 1088 wrote to memory of 2584 1088 cmd.exe 223 PID 1088 wrote to memory of 2584 1088 cmd.exe 223 PID 2164 wrote to memory of 2736 2164 rarjctl.exe 476 PID 2164 wrote to memory of 2736 2164 rarjctl.exe 476 PID 2164 wrote to memory of 2736 2164 rarjctl.exe 476 PID 2164 wrote to memory of 2736 2164 rarjctl.exe 476 PID 1088 wrote to memory of 2632 1088 cmd.exe 475 PID 1088 wrote to memory of 2632 1088 cmd.exe 475 PID 1088 wrote to memory of 2632 1088 cmd.exe 475 PID 1088 wrote to memory of 2632 1088 cmd.exe 475 PID 1088 wrote to memory of 2768 1088 cmd.exe 473 PID 1088 wrote to memory of 2768 1088 cmd.exe 473 PID 1088 wrote to memory of 2768 1088 cmd.exe 473 PID 1088 wrote to memory of 2768 1088 cmd.exe 473 PID 2736 wrote to memory of 2612 2736 cmd.exe 530 PID 2736 wrote to memory of 2612 2736 cmd.exe 530 PID 2736 wrote to memory of 2612 2736 cmd.exe 530 PID 2736 wrote to memory of 2612 2736 cmd.exe 530 PID 2164 wrote to memory of 2596 2164 rarjctl.exe 471 PID 2164 wrote to memory of 2596 2164 rarjctl.exe 471 PID 2164 wrote to memory of 2596 2164 rarjctl.exe 471 PID 2164 wrote to memory of 2596 2164 rarjctl.exe 471 PID 1088 wrote to memory of 2740 1088 cmd.exe 470 PID 1088 wrote to memory of 2740 1088 cmd.exe 470 PID 1088 wrote to memory of 2740 1088 cmd.exe 470 PID 1088 wrote to memory of 2740 1088 cmd.exe 470 PID 2736 wrote to memory of 2704 2736 cmd.exe 469 PID 2736 wrote to memory of 2704 2736 cmd.exe 469 PID 2736 wrote to memory of 2704 2736 cmd.exe 469 PID 2736 wrote to memory of 2704 2736 cmd.exe 469 PID 1088 wrote to memory of 2828 1088 cmd.exe 16 PID 1088 wrote to memory of 2828 1088 cmd.exe 16 PID 1088 wrote to memory of 2828 1088 cmd.exe 16 PID 1088 wrote to memory of 2828 1088 cmd.exe 16 PID 2736 wrote to memory of 2616 2736 cmd.exe 512 PID 2736 wrote to memory of 2616 2736 cmd.exe 512 PID 2736 wrote to memory of 2616 2736 cmd.exe 512 PID 2736 wrote to memory of 2616 2736 cmd.exe 512 PID 1088 wrote to memory of 2652 1088 cmd.exe 467 PID 1088 wrote to memory of 2652 1088 cmd.exe 467 PID 1088 wrote to memory of 2652 1088 cmd.exe 467 PID 1088 wrote to memory of 2652 1088 cmd.exe 467 PID 1088 wrote to memory of 1228 1088 cmd.exe 800 PID 1088 wrote to memory of 1228 1088 cmd.exe 800 PID 1088 wrote to memory of 1228 1088 cmd.exe 800 PID 1088 wrote to memory of 1228 1088 cmd.exe 800 -
Views/modifies file attributes 1 TTPs 64 IoCs
pid Process 5092 Process not Found 5528 Process not Found 12620 Process not Found 20024 Process not Found 5708 Process not Found 1884 Process not Found 8916 Process not Found 7428 Process not Found 572 attrib.exe 3112 Process not Found 3924 Process not Found 4404 Process not Found 17728 Process not Found 16644 Process not Found 4048 Process not Found 1880 Process not Found 5156 Process not Found 5180 Process not Found 4008 Process not Found 3700 Process not Found 4964 Process not Found 3984 Process not Found 3688 Process not Found 2224 Process not Found 4020 Process not Found 4664 Process not Found 11168 Process not Found 4056 Process not Found 3824 Process not Found 4072 Process not Found 3796 Process not Found 5460 Process not Found 18176 Process not Found 3224 Process not Found 4552 Process not Found 4124 Process not Found 8316 Process not Found 1084 Process not Found 8160 Process not Found 6588 Process not Found 7468 Process not Found 1952 attrib.exe 3024 attrib.exe 3376 Process not Found 3660 Process not Found 5816 Process not Found 17272 Process not Found 3024 Process not Found 4864 Process not Found 5052 Process not Found 10236 Process not Found 12184 Process not Found 14896 Process not Found 2844 Process not Found 4968 Process not Found 10080 Process not Found 6272 Process not Found 18308 Process not Found 5248 Process not Found 6992 Process not Found 4676 Process not Found 16920 Process not Found 11500 Process not Found 14092 Process not Found
Processes
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2828
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1640
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1056
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2324
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:480 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2116
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390834.bat2⤵PID:1940
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2516
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2592
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1544
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2820
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2516
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1996 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391052.bat2⤵PID:1668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:604
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1460
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2176
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2588
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2600
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵PID:2780
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391302.bat2⤵PID:884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2032
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2128
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3000
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2864
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2840
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1168
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393064.bat2⤵PID:1120
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3016
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2540
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵PID:2344
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2992
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2088407221763126684-176443631416884137642024541553-223939103-1876623978-297370466"1⤵PID:1824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:940
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391598.bat1⤵PID:2888
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3028
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2688 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392659.bat4⤵PID:1612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2764
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2228 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392752.bat5⤵PID:904
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392550.bat3⤵PID:1496
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2972
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2132
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:976
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1592 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2400
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391754.bat2⤵PID:2928
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1148
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2176
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391863.bat1⤵PID:2648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2492
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2060
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2568
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2656
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:904
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:3016
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2956
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1580
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2684
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391972.bat1⤵PID:2808
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2496
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1688
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2756
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵PID:1056
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:324 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392160.bat3⤵PID:1032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2500
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2944
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2720
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392066.bat2⤵PID:1984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:768
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:560
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1164
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵PID:1936
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵PID:1980
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392456.bat3⤵PID:2476
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:668
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2856
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe3⤵PID:3028
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392362.bat2⤵PID:2724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:1684
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2592
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2956
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1104
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2460
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2084
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2120
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1152
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2480
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2832
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392846.bat1⤵PID:2728
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1432
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2944
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2428
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2524
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2568
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-421638686-1391714979309530156-15918450241956943552-581403358783413080746816246"1⤵PID:836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2300
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393283.bat1⤵PID:1720
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2528
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1256
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2748
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2200
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2480 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393579.bat2⤵PID:876
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393673.bat3⤵PID:3032
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2748
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:1620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h4⤵PID:2124
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:972 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393766.bat4⤵PID:2776
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2308
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h5⤵PID:2200
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393860.bat5⤵
- Drops file in System32 directory
PID:2976 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1436
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:1584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h6⤵PID:2576
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:668 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2500 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259394188.bat7⤵PID:2320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2960
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:1888
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h8⤵PID:2540
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1884 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259394453.bat8⤵PID:2564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h9⤵PID:2224
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe8⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2996 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259394827.bat9⤵PID:2600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:1256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h10⤵PID:2612
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1696 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259395139.bat10⤵PID:1512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h11⤵PID:2924
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1452 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259395467.bat11⤵PID:2308
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h12⤵PID:2372
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2264 -
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe12⤵
- Executes dropped EXE
- Modifies registry class
PID:1796 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259396106.bat13⤵PID:1016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h14⤵PID:2208
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3036 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259396465.bat14⤵PID:2584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h15⤵PID:2720
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe14⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259396902.bat15⤵PID:2300
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1544
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:1152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h16⤵PID:2184
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:1952 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259397401.bat16⤵PID:1020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h17⤵PID:1772
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe16⤵
- Executes dropped EXE
PID:2488 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259397807.bat17⤵PID:2528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h18⤵PID:2456
-
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe17⤵
- Executes dropped EXE
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259398275.bat18⤵PID:2968
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259395779.bat12⤵PID:2516
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h13⤵PID:2832
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259393954.bat6⤵PID:1756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2380
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1484
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h7⤵PID:2064
-
-
-
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2380
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2552
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1580
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2176
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:648
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2408
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2352
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2500
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2968
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵PID:1168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2752
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2756
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:940
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1016
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2992
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2428
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2088
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2844
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:2744
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2264
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2440
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2344
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2080
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259392269.bat1⤵PID:2444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2932
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3020
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2064
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1628
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1548
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1688
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1772
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1604
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2124
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1104
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:108
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1172
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1168
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1624
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2580
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-138948882967518120-1431290769-4027764551388689076-15348193912017346531-53246052"1⤵PID:2836
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2600
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2680
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2540
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2476
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2288
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1696
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2332
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2108
-
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2716
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2724
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2728
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:376
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵
- Views/modifies file attributes
PID:3024
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1624
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:976
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2756
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3060
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2200
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2620
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1616
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2352
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2912
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2388
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:860
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2412
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2000
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3056
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Views/modifies file attributes
PID:572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2864
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2044
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1812
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2184
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:764
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:3036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1792
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:376
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "308276244180893863020075805791871413650-741300870-917691672033986445-884403597"1⤵PID:2820
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1968
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵PID:1100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1256
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:540
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:668
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2332
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2076
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2188
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391473.bat1⤵PID:1416
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2300
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2488
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2064
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1244
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2968
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1796
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2620
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1552
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1240
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2088
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2144
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1776
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1244
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2848
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2104
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3028
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2528
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2756
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259391177.bat1⤵PID:2636
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2608
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2572
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1616
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2444
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1512
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2964
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2064
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:880
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2132
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2912
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2884
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2360
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:2928 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1884
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2144
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1952
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2264
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1700
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2092
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2068
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1196
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1148
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390943.bat1⤵PID:3048
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1680
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1640
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:768
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1256
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2176
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2452
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1464
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:1164
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1536
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:976
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1496
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2372
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:648
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:320
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1832
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2576
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2720
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:564
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1152
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1708
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1320
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2288
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:564
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1100
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1452
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1656
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1464
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:876
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2524
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2600
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1828
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2188
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2844
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2140
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2328
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390724.bat1⤵PID:1964
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2336
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2980
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3016
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1196
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2856
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1584
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2268
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1832
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2996
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2960
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2968
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2984
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2308
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Drops file in System32 directory
PID:1776
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:864
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1368
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1244
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390615.bat1⤵PID:2824
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2592
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1772
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2200
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2992
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1580
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2684
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2108
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2208
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2408
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2708
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3008
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2684
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2036
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2656
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:952
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1796
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1980
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2972
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2540
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390506.bat1⤵PID:2512
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2120
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2140
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:560
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2084
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2184
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2612
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1228
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:940
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1156
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:1228
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2652
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2616
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2704
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2740
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2612
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2768
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2632
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390397.bat1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2540
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2236
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1816
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1628
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2076
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1040
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1744
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2124
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:3004
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2864
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1608
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h1⤵PID:2620
-
C:\Windows\SysWOW64\rarjctl.exeC:\Windows\system32\rarjctl.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2164
-
C:\Windows\SysWOW64\cmd.execmd /c C:\DFD259390303.bat1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:572
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2460
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1932
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2752
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2760
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1172
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2604
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2516
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h3⤵PID:2864
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1020
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1036
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2224
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2080
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2456
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:1676
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:764
-
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\system32\verclsid.exe" -r -a -s -h2⤵PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\76d2fa4c3c7a1a2266a0ae542de633c8.exe"C:\Users\Admin\AppData\Local\Temp\76d2fa4c3c7a1a2266a0ae542de633c8.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "402175757-203055980717221241491626390265-11784212151082731534-19059289311450001568"1⤵PID:2972
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4314248741079991495-981960497819728432607466963-12583439761914436291-1930024897"1⤵PID:2412
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1373645553-1800948768-10643364272015642019-1016183402-768765447743375956718949401"1⤵PID:2848
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1162945673116456933-1131707398-14879106591079709721094370117-616145520-1478913765"1⤵
- Drops file in System32 directory
PID:1432
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1097541490-527120053-16452116633642802601791730483-622074729-1336576992-1352955349"1⤵PID:540
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-6352342271554288958241607539-1697107666632444361-1955882511-1094777719-1888128079"1⤵PID:2980
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "20636973121855207691-1543877841112690180-561394047442853241073525722546784270"1⤵PID:1552
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-956654112-78413570417153555171121615005537138018-385311159-35879637628510175"1⤵PID:2188
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "189772031413280225758056631621667078631163220282210755592821668445208959860663"1⤵PID:1832
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1432305210-1965651847-1616359102711572111023170028-1015058247-16746023741065613842"1⤵PID:2176
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "141471077629025360-1568867875181210187912482237871844778317-39790911169268489"1⤵PID:864
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1764286383222248615-199656559810261113171531102848154812570743276252877366037"1⤵PID:3008
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1934975927714401453-70373802295788240-1495844711114524639119551065151281490453"1⤵PID:1772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176B
MD52afeebcd2748d7fe6a9deb1ef8f83046
SHA14bddd82d8955f53a4a8ca922286e02858dbe1eda
SHA256c0348f6f1c884212db58ebedf50a1f852712366063e5e8c3ae9701b0b4f7e731
SHA512457f362c884681eb306f6c8718abfdc468eb2598ef46a9740381cb89919ffdd34f5e2fe15967eee3559de493f12d5abb6959accc395037f3f8e15e06f13446cd
-
Filesize
290B
MD5f40422476f0e3670344688613a119133
SHA14f10048343e98b3425ed633ec19245e3ea06db9d
SHA256b0aca222fcf2b0237f570d05dcb35bdd3531dfed5ca0642f42056172dffc4550
SHA5121a7069f5dcb092b0b82d75095243c47e503dcfacc2218380719820cc1b17fb896fec343c9dbafb5a9b6baa7aee5cc0e1be7980f5178cd2c37dcdc135b828974d
-
Filesize
173B
MD5ab345736450312d70489a5629f7e4667
SHA164294d9cd75da2f0ba80a5d7bc9f39287103e7cf
SHA2560c6c2a50ec94d2604261bcdf3c7efcb812b88dd8ce4693bcc52e33e664070a24
SHA512d717e64ff3da83617d255cde16e2e47dfc95fab1b78553794d93870ef8620c926473377fe1692a44566f0f91b986dc0947ecd90c3451a375a62fb4b1e5bda03e
-
Filesize
346B
MD5f1a652029f9bf03d69b8618a6fdc5d09
SHA1f1e06415b8524c1a87298e6bb8385fef638f071f
SHA25600cdf2e3810a86c01f3bbda8bc0e193c1f3c53135d6c87d266771607b765171b
SHA512671a565dfa8c2c228593093c02232ef4406deee779cfccf433ddea3fb61c6a525c66163025a0b06cc394fd8746e0b0d81777989608bbf5f8c7c4a1389b3dabf7
-
Filesize
107B
MD5fb5ac517654ede17597c8611f64f2d06
SHA1cebfcd0520a15c25e7a0ce59da0bba2e403c2505
SHA256ce86e4434325ff7ca617e29142b9082da48e912d90f3345e809bd922b759e2cb
SHA512b0b5084df2e6effe7554e482e3cca77c4bf6bf3f0ed77795418e2647e74ea971023f6bfb7902aa64f1381342b643a7974199bf2e2c038a3fec659c79de5a5406
-
Filesize
60B
MD59803163a244a97f1a8fe1451825b4258
SHA185ce1825e118a5c5bde08d518520d378d36118c8
SHA2569e5219e064752b704b8ea72e9057f876a0e324ceeebc7edc14a7163c09490c00
SHA512525a74656c8e091b95e7336c9e6e4e12c4b2f93a9d243677115f82a4a70fd8aebb536b7c939a3e5f6b4f0f1bee166f18432cb46f457fedd8ee003a1bf22e61a1
-
Filesize
21KB
MD50f8a194520c1f092292d7ad5b5804ccb
SHA1a65f14434ffc80f5e05af1bcc578577435085cfe
SHA2562465d2a1aae87cae31628def4b5e841086bb086fd3ac93b20c935994671debee
SHA5129eed2883eb63f317c2452bd66af6afd6fb2163d507166c61b2b5bb7bfaf6e38feedc7fe9cbcf61968717f26e76f210a23d9f3b226e57324d868b99cf5eca7f1d
-
Filesize
14KB
MD576d2fa4c3c7a1a2266a0ae542de633c8
SHA1f38eee6e28ba54455439bc87dffdee983093911d
SHA256a4c75a4802d7eb144b72dad0ec5e9dc55e0e10063164e6661537059fb9a9c27a
SHA51225c3e94430058fe33f174a85e6f199e9f0aed8fceb59d69fcf79d55933f5963c0c5a13513abe3995727ffec50299a7caf83d4c472813e4c497f7f6b1a77191bf