94dfc4026bbb2d59dc0e8372c37af988809eb288be8f11a35bc50f19b0d67733

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac8c878cc24e071cf8a61b3db2868c17.exe
Size

96KB
MD5

ac8c878cc24e071cf8a61b3db2868c17
SHA1

0066d5b50729986a5e6cf6fd5e04606741aba3c9
SHA256

94dfc4026bbb2d59dc0e8372c37af988809eb288be8f11a35bc50f19b0d67733
SHA512

23d078a830c7e03017728b64abf7fe892f6a0e9a683f0356eb4cc95ff3077c31984a76d35372dbdad3829db4a8fa0c3d59678a8cd404d1afa07c36a83e6e6ff2
SSDEEP

1536:Ws0TMdgQz5Bz+fKyQK4u00Bf3B5l0lNVk2:Ws0odDFsVQT0ZLl0l

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2448	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
2724	msinm.exe
2544	WINWORD.exe
968	WINWORD.exe

Loads dropped DLL 2 IoCs

pid	Process
2488	ac8c878cc24e071cf8a61b3db2868c17.exe
2488	ac8c878cc24e071cf8a61b3db2868c17.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000016cde-4.dat	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Outlook Express\msinm.exe	ac8c878cc24e071cf8a61b3db2868c17.exe
File opened for modification	C:\Program Files (x86)\Outlook Express\msinm.exe	ac8c878cc24e071cf8a61b3db2868c17.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\delloader.bat	ac8c878cc24e071cf8a61b3db2868c17.exe
File created	C:\Windows\KB675428.log	ac8c878cc24e071cf8a61b3db2868c17.exe
File created	C:\Windows\KB673223.log	ac8c878cc24e071cf8a61b3db2868c17.exe
File opened for modification	C:\Windows\KB675428.log	msinm.exe
File opened for modification	C:\Windows\KB675428.log	WINWORD.exe
File opened for modification	C:\Windows\KB673223.log	WINWORD.exe
File created	C:\Windows\WINWORD.exe	msinm.exe
File opened for modification	C:\Windows\Coffee Bean.bmp.bak	msinm.exe
File opened for modification	C:\Windows\Coffee Bean.bmp.bak	WINWORD.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2672	2544	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	msinm.exe
2724	msinm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	ac8c878cc24e071cf8a61b3db2868c17.exe
Token: SeDebugPrivilege	2724	msinm.exe
Token: SeDebugPrivilege	2724	msinm.exe
Token: SeDebugPrivilege	2724	msinm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2724	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	28
PID 2488 wrote to memory of 2724	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	28
PID 2488 wrote to memory of 2724	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	28
PID 2488 wrote to memory of 2724	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	28
PID 2724 wrote to memory of 1196	2724	msinm.exe	21
PID 2724 wrote to memory of 1196	2724	msinm.exe	21
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2724 wrote to memory of 2544	2724	msinm.exe	29
PID 2544 wrote to memory of 2672	2544	WINWORD.exe	30
PID 2544 wrote to memory of 2672	2544	WINWORD.exe	30
PID 2544 wrote to memory of 2672	2544	WINWORD.exe	30
PID 2544 wrote to memory of 2672	2544	WINWORD.exe	30
PID 2488 wrote to memory of 2448	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	31
PID 2488 wrote to memory of 2448	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	31
PID 2488 wrote to memory of 2448	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	31
PID 2488 wrote to memory of 2448	2488	ac8c878cc24e071cf8a61b3db2868c17.exe	31
PID 2448 wrote to memory of 2888	2448	cmd.exe	33
PID 2448 wrote to memory of 2888	2448	cmd.exe	33
PID 2448 wrote to memory of 2888	2448	cmd.exe	33
PID 2448 wrote to memory of 2888	2448	cmd.exe	33
PID 2448 wrote to memory of 3008	2448	cmd.exe	34
PID 2448 wrote to memory of 3008	2448	cmd.exe	34
PID 2448 wrote to memory of 3008	2448	cmd.exe	34
PID 2448 wrote to memory of 3008	2448	cmd.exe	34
PID 2448 wrote to memory of 2004	2448	cmd.exe	35
PID 2448 wrote to memory of 2004	2448	cmd.exe	35
PID 2448 wrote to memory of 2004	2448	cmd.exe	35
PID 2448 wrote to memory of 2004	2448	cmd.exe	35
PID 2448 wrote to memory of 2852	2448	cmd.exe	36
PID 2448 wrote to memory of 2852	2448	cmd.exe	36
PID 2448 wrote to memory of 2852	2448	cmd.exe	36
PID 2448 wrote to memory of 2852	2448	cmd.exe	36
PID 2448 wrote to memory of 2388	2448	cmd.exe	37
PID 2448 wrote to memory of 2388	2448	cmd.exe	37
PID 2448 wrote to memory of 2388	2448	cmd.exe	37
PID 2448 wrote to memory of 2388	2448	cmd.exe	37
PID 2448 wrote to memory of 1656	2448	cmd.exe	38
PID 2448 wrote to memory of 1656	2448	cmd.exe	38
PID 2448 wrote to memory of 1656	2448	cmd.exe	38
PID 2448 wrote to memory of 1656	2448	cmd.exe	38
PID 2448 wrote to memory of 1676	2448	cmd.exe	39
PID 2448 wrote to memory of 1676	2448	cmd.exe	39
PID 2448 wrote to memory of 1676	2448	cmd.exe	39
PID 2448 wrote to memory of 1676	2448	cmd.exe	39
PID 2448 wrote to memory of 1876	2448	cmd.exe	40
PID 2448 wrote to memory of 1876	2448	cmd.exe	40
PID 2448 wrote to memory of 1876	2448	cmd.exe	40
PID 2448 wrote to memory of 1876	2448	cmd.exe	40
PID 2448 wrote to memory of 660	2448	cmd.exe	41
PID 2448 wrote to memory of 660	2448	cmd.exe	41
PID 2448 wrote to memory of 660	2448	cmd.exe	41
PID 2448 wrote to memory of 660	2448	cmd.exe	41
PID 2448 wrote to memory of 268	2448	cmd.exe	42
PID 2448 wrote to memory of 268	2448	cmd.exe	42
PID 2448 wrote to memory of 268	2448	cmd.exe	42
PID 2448 wrote to memory of 268	2448	cmd.exe	42
PID 2448 wrote to memory of 320	2448	cmd.exe	43
PID 2448 wrote to memory of 320	2448	cmd.exe	43
PID 2448 wrote to memory of 320	2448	cmd.exe	43

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2000	attrib.exe
1884	attrib.exe
2688	attrib.exe
1244	attrib.exe
2084	attrib.exe
1504	attrib.exe
1504	attrib.exe
1724	attrib.exe
2112	attrib.exe
960	attrib.exe
920	attrib.exe
1840	attrib.exe
1532	attrib.exe
1940	attrib.exe
2868	attrib.exe
1960	attrib.exe
1664	attrib.exe
692	attrib.exe
2876	attrib.exe
820	attrib.exe
1260	attrib.exe
1072	attrib.exe
1356	attrib.exe
1116	attrib.exe
2496	attrib.exe
1636	attrib.exe
1728	attrib.exe
1916	attrib.exe
1032	attrib.exe
1672	attrib.exe
2980	attrib.exe
2224	attrib.exe
1944	attrib.exe
2936	attrib.exe
2792	attrib.exe
2184	attrib.exe
2444	attrib.exe
1876	attrib.exe
2824	attrib.exe
1080	attrib.exe
1872	attrib.exe
928	attrib.exe
1732	attrib.exe
1472	attrib.exe
1076	attrib.exe
1840	attrib.exe
2908	attrib.exe
2596	attrib.exe
2780	attrib.exe
2276	attrib.exe
1612	attrib.exe
1964	attrib.exe
2992	attrib.exe
3016	attrib.exe
1948	attrib.exe
2424	attrib.exe
1624	attrib.exe
2068	attrib.exe
1284	attrib.exe
916	attrib.exe
2264	attrib.exe
2140	attrib.exe
2060	attrib.exe
2760	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1196
- C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe
  "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Program Files (x86)\Outlook Express\msinm.exe
    "C:\Program Files (x86)\Outlook Express\msinm.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\WINWORD.exe
      "C:\Windows\WINWORD.exe" c
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 280
        5⤵
        Program crash
        
        PID:2672
  - - C:\Windows\WINWORD.exe
      "C:\Windows\WINWORD.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\delloader.bat
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2888
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:320
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2492
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2632
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1952
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:932
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2220
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1356
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1508
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2208
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2420
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:328
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1728
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2044
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1244
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1672
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2452
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:3016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:820
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:396
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2904
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:592
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2208
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2496
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2092
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2656
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2420
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2236
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2272
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2256
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2296
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2160
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2076
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2164
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:684
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1420
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1040
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1944
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2892
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1352
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:864
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2808
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2984
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1260
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2992
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2880
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3056
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2148
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2508
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2700
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2716
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2540
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2400
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2420
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:676
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:436
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2444
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3060
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1872
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1244
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2240
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3052
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2612
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:920
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:552
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1584
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2068
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2128
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2228
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2792
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3036
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2064
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2300
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3016
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:2264
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1072
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:3028
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1840
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1332
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      Views/modifies file attributes
      PID:1664
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2812
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -a -r -s -h "C:\Users\Admin\AppData\Local\Temp\ac8c878cc24e071cf8a61b3db2868c17.exe"
      4⤵
      PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\KB673223.log

Filesize
918B

MD5
5225a3e4378071b7ddc6df551b8b15ac

SHA1
823be1825d40c2edbb3d48e7e7d01f5757ab0a0c

SHA256
6ec144fe4b2d92908b14c8e9d12e656c656234a3a9a838a9383001ab0f404745

SHA512
d2cb060178792a27d6e617c46d67edf134ff9cdc3f3cfbe9925556a9780d52aa867008547c07632a858f852cf233c8741f2863182334295c6e7e2f3921d06b8d

Download Submit
C:\Windows\KB675428.log

Filesize
19B

MD5
044ca72427e8c75e611bcd86299cd549

SHA1
aa8a7feb5a42262fa76e438bc25ce01e131e1756

SHA256
075ef720ec5332c8815ff475e064b25d5a055d465fd3f6c80407676cac9d23c5

SHA512
8194a00386502011936ae9733064c2123f7cc08f8e6faa5cf7b125e71e14ee0ee22ba642a3bb8b929b43ac3904196eb096335e46c405dd9206d56b07139e137a

Download Submit
C:\Windows\WINWORD.exe

Filesize
34KB

MD5
9a0d3667ac3ae20b0671620e65975b00

SHA1
742ba15243ed846955b84fb73bcd45010cf0bf85

SHA256
f0044daee06dd53ffdd6db6b4375aea386d30c821bf76fc7cccdbef76044daa5

SHA512
5683fff5df104ade6182806b64e31b8cc77a151b9931cd7b87575c07e42b1647beb378aa4c072a2f56d16dc9076a17026ae29bf04c364233814d5208548d2f20

Download Submit
C:\Windows\delloader.bat

Filesize
292B

MD5
26df8d831fabcd09c40928752be0531a

SHA1
92f18fad23f7e0f36612b4ae6606965e14b57650

SHA256
79df5b0b7c55924d7977953377918fdb4f23f227984e297aad4ab4ed09a75635

SHA512
269d380ab415f6d8acbfa651ee3d4a1ff0a5a3cc1bf2c030edc8b47e947327711ac0fe2c9eda47895fbfe99088782f266e33a2c71105b92abb7638543d1fda6d

Download Submit
\Program Files (x86)\Outlook Express\msinm.exe

Filesize
96KB

MD5
ac8c878cc24e071cf8a61b3db2868c17

SHA1
0066d5b50729986a5e6cf6fd5e04606741aba3c9

SHA256
94dfc4026bbb2d59dc0e8372c37af988809eb288be8f11a35bc50f19b0d67733

SHA512
23d078a830c7e03017728b64abf7fe892f6a0e9a683f0356eb4cc95ff3077c31984a76d35372dbdad3829db4a8fa0c3d59678a8cd404d1afa07c36a83e6e6ff2

Download Submit
memory/1196-13-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download