469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Size 5.2MB
Sample260910-tk2l3adq21
SHA256 469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d
MD5 d8a1ff8fdba7993f430a41eae77a52ad
SHA1 7868944202f185bebd9559639168e619cdd333e1
SHA512 a70755d9e92c88d91c98125fde085b9cff60ad841de1d8105c9f7b6991b11d5473f4dc36f554b33935338d32172b2875dfc19372f9f8ddf5a1e52328a45acaeb
SSDEEP 98304:ZKKKKKKKKKKKGoYoYoYoYoYoYoyKKKKKK:ZKKKKKKKKKKK8KKKKKK
TLSH
T11246AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 33 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Process not Found
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe

Executes dropped EXE 33 IoCs

pid	Process
2508	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
3348	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
2924	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4064	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5004	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
2472	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
540	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
1084	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
1456	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4892	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
3216	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
3036	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4924	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
776	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4168	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
1832	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
2880	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
2512	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4292	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
3600	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4764	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
1560	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5248	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5368	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5644	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
6016	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5596	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
3096	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5788	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
4140	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5556	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
5568	Process not Found
3468	Process not Found

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 34 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1076	cmd.exe
4272	cmd.exe
3116	cmd.exe
4364	cmd.exe
3264	cmd.exe
960	cmd.exe
4560	cmd.exe
5436	cmd.exe
1664	Process not Found
5308	cmd.exe
5620	cmd.exe
3488	cmd.exe
2712	cmd.exe
4484	cmd.exe
4276	cmd.exe
3668	cmd.exe
1252	cmd.exe
2412	cmd.exe
1224	cmd.exe
1780	cmd.exe
2816	cmd.exe
3868	cmd.exe
3056	Process not Found
4776	cmd.exe
1772	cmd.exe
6056	cmd.exe
5504	cmd.exe
5196	cmd.exe
5584	cmd.exe
2748	cmd.exe
3228	cmd.exe
5880	cmd.exe
5688	cmd.exe
4444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4776	4352	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	85
PID 4776 wrote to memory of 2480	4776	cmd.exe	88
PID 4776 wrote to memory of 2508	4776	cmd.exe	89
PID 2508 wrote to memory of 2412	2508	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	90
PID 2412 wrote to memory of 5008	2412	cmd.exe	92
PID 2412 wrote to memory of 4596	2412	cmd.exe	93
PID 2412 wrote to memory of 2504	2412	cmd.exe	211
PID 2412 wrote to memory of 3348	2412	cmd.exe	95
PID 3348 wrote to memory of 3488	3348	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	96
PID 3488 wrote to memory of 904	3488	cmd.exe	98
PID 3488 wrote to memory of 2016	3488	cmd.exe	99
PID 3488 wrote to memory of 2164	3488	cmd.exe	100
PID 3488 wrote to memory of 2648	3488	cmd.exe	101
PID 3488 wrote to memory of 2924	3488	cmd.exe	102
PID 2924 wrote to memory of 1224	2924	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	103
PID 1224 wrote to memory of 2088	1224	cmd.exe	105
PID 1224 wrote to memory of 4836	1224	cmd.exe	162
PID 1224 wrote to memory of 2880	1224	cmd.exe	107
PID 1224 wrote to memory of 4996	1224	cmd.exe	108
PID 1224 wrote to memory of 2292	1224	cmd.exe	164
PID 1224 wrote to memory of 3844	1224	cmd.exe	165
PID 1224 wrote to memory of 4064	1224	cmd.exe	111
PID 4064 wrote to memory of 1780	4064	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	112
PID 1780 wrote to memory of 32	1780	cmd.exe	114
PID 1780 wrote to memory of 4496	1780	cmd.exe	253
PID 1780 wrote to memory of 4116	1780	cmd.exe	116
PID 1780 wrote to memory of 4224	1780	cmd.exe	117
PID 1780 wrote to memory of 4700	1780	cmd.exe	177
PID 1780 wrote to memory of 4324	1780	cmd.exe	178
PID 1780 wrote to memory of 2520	1780	cmd.exe	179
PID 1780 wrote to memory of 2800	1780	cmd.exe	180
PID 1780 wrote to memory of 3796	1780	cmd.exe	181
PID 1780 wrote to memory of 5004	1780	cmd.exe	123
PID 5004 wrote to memory of 2748	5004	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	124
PID 2748 wrote to memory of 3060	2748	cmd.exe	126
PID 2748 wrote to memory of 3152	2748	cmd.exe	127
PID 2748 wrote to memory of 3728	2748	cmd.exe	128
PID 2748 wrote to memory of 1296	2748	cmd.exe	129
PID 2748 wrote to memory of 3808	2748	cmd.exe	130
PID 2748 wrote to memory of 2552	2748	cmd.exe	131
PID 2748 wrote to memory of 4348	2748	cmd.exe	132
PID 2748 wrote to memory of 4468	2748	cmd.exe	221
PID 2748 wrote to memory of 1612	2748	cmd.exe	134
PID 2748 wrote to memory of 2672	2748	cmd.exe	284
PID 2748 wrote to memory of 1116	2748	cmd.exe	136
PID 2748 wrote to memory of 1848	2748	cmd.exe	137
PID 2748 wrote to memory of 2352	2748	cmd.exe	138
PID 2748 wrote to memory of 2472	2748	cmd.exe	139
PID 2472 wrote to memory of 1076	2472	469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe	140
PID 1076 wrote to memory of 4436	1076	cmd.exe	142
PID 1076 wrote to memory of 4252	1076	cmd.exe	143
PID 1076 wrote to memory of 2772	1076	cmd.exe	224
PID 1076 wrote to memory of 1260	1076	cmd.exe	145
PID 1076 wrote to memory of 4160	1076	cmd.exe	146
PID 1076 wrote to memory of 1560	1076	cmd.exe	226
PID 1076 wrote to memory of 4268	1076	cmd.exe	227
PID 1076 wrote to memory of 3004	1076	cmd.exe	228
PID 1076 wrote to memory of 3216	1076	cmd.exe	280
PID 1076 wrote to memory of 3764	1076	cmd.exe	151
PID 1076 wrote to memory of 1556	1076	cmd.exe	152
PID 1076 wrote to memory of 2148	1076	cmd.exe	232
PID 1076 wrote to memory of 2376	1076	cmd.exe	154
PID 1076 wrote to memory of 4736	1076	cmd.exe	155
PID 1076 wrote to memory of 5016	1076	cmd.exe	156

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1808	attrib.exe
4392	Process not Found
5784	Process not Found
4200	attrib.exe
4560	attrib.exe
1696	attrib.exe
3956	attrib.exe
1376	attrib.exe
4224	attrib.exe
2104	attrib.exe
5216	Process not Found
5108	attrib.exe
5296	attrib.exe
5712	attrib.exe
2800	attrib.exe
5192	attrib.exe
5760	Process not Found
3828	attrib.exe
180	attrib.exe
972	attrib.exe
4224	attrib.exe
5372	attrib.exe
6132	attrib.exe
3068	attrib.exe
4908	attrib.exe
5264	attrib.exe
5232	attrib.exe
5660	attrib.exe
5784	attrib.exe
5836	attrib.exe
2352	attrib.exe
4336	attrib.exe
3296	attrib.exe
5028	attrib.exe
5384	attrib.exe
5924	attrib.exe
4244	Process not Found
4252	attrib.exe
3004	attrib.exe
3068	attrib.exe
1624	Process not Found
3796	attrib.exe
4072	attrib.exe
2268	attrib.exe
812	attrib.exe
5724	attrib.exe
1624	attrib.exe
3352	attrib.exe
5168	attrib.exe
2272	attrib.exe
4588	attrib.exe
5820	attrib.exe
5296	attrib.exe
3344	attrib.exe
5716	attrib.exe
5548	attrib.exe
4260	attrib.exe
5028	attrib.exe
2104	attrib.exe
6032	attrib.exe
2820	attrib.exe
716	attrib.exe
1660	attrib.exe
5168	attrib.exe

C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
"C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3D04.tmp\3D05.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
    3⤵
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
    C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\405F.tmp\4060.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        5⤵
        
        PID:5008
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        5⤵
        
        PID:4596
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3348
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4810.tmp\4821.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        7⤵
        
        PID:904
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        7⤵
        
        PID:2016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        7⤵
        
        PID:2164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        7⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4DCD.tmp\4DDE.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        9⤵
        
        PID:2088
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        9⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        9⤵
        
        PID:2880
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        9⤵
        
        PID:4996
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        9⤵
        
        PID:2292
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        9⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\561A.tmp\561B.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        11⤵
        
        PID:32
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        11⤵
        
        PID:4496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        11⤵
        
        PID:4116
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        11⤵
        
        PID:4224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        11⤵
        
        PID:4700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        11⤵
        
        PID:4324
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        11⤵
        
        PID:2520
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        11⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        11⤵
        Views/modifies file attributes
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5D2E.tmp\5D2F.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        13⤵
        
        PID:3060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        13⤵
        
        PID:3152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        13⤵
        
        PID:3728
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        13⤵
        
        PID:1296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        13⤵
        
        PID:3808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        13⤵
        
        PID:2552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        13⤵
        
        PID:4348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        13⤵
        
        PID:4468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        13⤵
        
        PID:1612
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        13⤵
        
        PID:2672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        13⤵
        
        PID:1116
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        13⤵
        
        PID:1848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        13⤵
        Views/modifies file attributes
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5F71.tmp\5F72.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        15⤵
        
        PID:4436
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        15⤵
        Views/modifies file attributes
        
        PID:4252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        15⤵
        
        PID:2772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        15⤵
        
        PID:1260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        15⤵
        
        PID:4160
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        15⤵
        
        PID:1560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        15⤵
        
        PID:4268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        15⤵
        
        PID:3004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        15⤵
        
        PID:3216
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        15⤵
        
        PID:3764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        15⤵
        
        PID:1556
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        15⤵
        
        PID:2148
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        15⤵
        
        PID:2376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        15⤵
        
        PID:4736
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        15⤵
        
        PID:5016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        15⤵
        
        PID:1188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        15⤵
        
        PID:1900
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        15⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6491.tmp\6492.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        16⤵
        Executes a command shell one-liner
        
        PID:4444
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        17⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        17⤵
        
        PID:4784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        17⤵
        
        PID:2292
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        17⤵
        
        PID:3844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        17⤵
        
        PID:4076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        17⤵
        
        PID:3080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        17⤵
        
        PID:836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        17⤵
        
        PID:1652
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        17⤵
        
        PID:2884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        17⤵
        
        PID:4896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        17⤵
        
        PID:4304
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        17⤵
        
        PID:4936
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        17⤵
        
        PID:2716
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        17⤵
        
        PID:3228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        17⤵
        
        PID:3744
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        17⤵
        
        PID:4700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        17⤵
        
        PID:4324
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        17⤵
        
        PID:2520
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        17⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        17⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        17⤵
        Views/modifies file attributes
        
        PID:5108
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        17⤵
        
        PID:3964
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        17⤵
        Views/modifies file attributes
        
        PID:1696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        17⤵
        
        PID:1412
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        17⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1084
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\69C1.tmp\69C2.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        18⤵
        Executes a command shell one-liner
        
        PID:2816
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        19⤵
        
        PID:376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        19⤵
        
        PID:2220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        19⤵
        
        PID:4696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        19⤵
        
        PID:1788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        19⤵
        
        PID:1536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        19⤵
        
        PID:4356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        19⤵
        Views/modifies file attributes
        
        PID:4260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        19⤵
        
        PID:4292
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        19⤵
        
        PID:4248
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        19⤵
        
        PID:2360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        19⤵
        
        PID:5112
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        19⤵
        
        PID:560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        19⤵
        Views/modifies file attributes
        
        PID:4560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        19⤵
        
        PID:3220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        19⤵
        
        PID:2480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        19⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        19⤵
        
        PID:764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        19⤵
        
        PID:4948
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        19⤵
        Views/modifies file attributes
        
        PID:2272
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        19⤵
        
        PID:2056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        19⤵
        
        PID:4284
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        19⤵
        
        PID:2504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        19⤵
        
        PID:1400
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        19⤵
        
        PID:2576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        19⤵
        
        PID:1896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        19⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1E8A.tmp\1E8B.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        20⤵
        Executes a command shell one-liner
        
        PID:2712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        21⤵
        
        PID:4468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        21⤵
        
        PID:2892
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        21⤵
        
        PID:2220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        21⤵
        
        PID:2772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        21⤵
        
        PID:2384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        21⤵
        
        PID:1560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        21⤵
        
        PID:4268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        21⤵
        Views/modifies file attributes
        
        PID:3004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        21⤵
        
        PID:2012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        21⤵
        
        PID:2932
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        21⤵
        
        PID:560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        21⤵
        
        PID:2148
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        21⤵
        
        PID:3548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        21⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        21⤵
        
        PID:2672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        21⤵
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        21⤵
        
        PID:2008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        21⤵
        
        PID:5064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        21⤵
        
        PID:1208
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        21⤵
        
        PID:60
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        21⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        21⤵
        
        PID:1384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        21⤵
        
        PID:3192
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        21⤵
        
        PID:3688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        21⤵
        
        PID:1108
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        21⤵
        
        PID:2168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        21⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        21⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2457.tmp\2458.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        22⤵
        Executes a command shell one-liner
        
        PID:4484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        23⤵
        
        PID:792
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        23⤵
        
        PID:4496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        23⤵
        
        PID:4244
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        23⤵
        
        PID:4540
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        23⤵
        
        PID:1664
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        23⤵
        
        PID:4516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        23⤵
        
        PID:3212
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        23⤵
        
        PID:1776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        23⤵
        
        PID:1564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        23⤵
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        23⤵
        Views/modifies file attributes
        
        PID:4336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        23⤵
        
        PID:3424
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        23⤵
        
        PID:3052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        23⤵
        
        PID:3956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        23⤵
        
        PID:3336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        23⤵
        Views/modifies file attributes
        
        PID:4072
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        23⤵
        
        PID:4060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        23⤵
        
        PID:4500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        23⤵
        Views/modifies file attributes
        
        PID:3296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        23⤵
        
        PID:2780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        23⤵
        
        PID:4132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        23⤵
        
        PID:2044
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        23⤵
        
        PID:4068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        23⤵
        
        PID:3500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        23⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        23⤵
        
        PID:180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        23⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        23⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        23⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2AA0.tmp\2AA1.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        24⤵
        Executes a command shell one-liner
        
        PID:3116
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        25⤵
        
        PID:560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        25⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        25⤵
        
        PID:2672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        25⤵
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        25⤵
        
        PID:2008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        25⤵
        
        PID:5064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        25⤵
        
        PID:2576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        25⤵
        
        PID:752
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        25⤵
        
        PID:4004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        25⤵
        
        PID:4820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        25⤵
        
        PID:5012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        25⤵
        
        PID:904
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        25⤵
        
        PID:4772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        25⤵
        
        PID:1772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        25⤵
        
        PID:616
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        25⤵
        
        PID:3864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        25⤵
        
        PID:2756
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        25⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        25⤵
        
        PID:4076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        25⤵
        
        PID:3908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        25⤵
        
        PID:4312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        25⤵
        
        PID:4876
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        25⤵
        
        PID:1308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        25⤵
        
        PID:828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        25⤵
        
        PID:2876
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        25⤵
        
        PID:2128
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        25⤵
        
        PID:3228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        25⤵
        
        PID:3744
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        25⤵
        
        PID:4480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        25⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        25⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3176.tmp\31E5.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        26⤵
        Executes a command shell one-liner
        
        PID:3868
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        27⤵
        
        PID:2044
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        27⤵
        
        PID:3740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        27⤵
        
        PID:3748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        27⤵
        
        PID:1972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        27⤵
        
        PID:2060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        27⤵
        Views/modifies file attributes
        
        PID:4200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        27⤵
        
        PID:1648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        27⤵
        
        PID:4908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        27⤵
        
        PID:4408
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        27⤵
        
        PID:4156
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        27⤵
        
        PID:3696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        27⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        27⤵
        
        PID:5068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        27⤵
        
        PID:5000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        27⤵
        
        PID:4468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        27⤵
        
        PID:2892
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        27⤵
        
        PID:4252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        27⤵
        
        PID:1788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        27⤵
        
        PID:4160
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        27⤵
        
        PID:1952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        27⤵
        
        PID:2360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        27⤵
        
        PID:4948
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        27⤵
        
        PID:2272
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        27⤵
        
        PID:1848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        27⤵
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        27⤵
        
        PID:2008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        27⤵
        
        PID:1208
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        27⤵
        
        PID:60
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        27⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        27⤵
        
        PID:752
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        27⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        27⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\388B.tmp\388C.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        28⤵
        Executes a command shell one-liner
        
        PID:4272
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        29⤵
        
        PID:4496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        29⤵
        
        PID:4732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        29⤵
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        29⤵
        
        PID:1776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        29⤵
        
        PID:5024
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        29⤵
        
        PID:4168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        29⤵
        
        PID:2432
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        29⤵
        
        PID:1860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        29⤵
        
        PID:468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        29⤵
        
        PID:3336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        29⤵
        Views/modifies file attributes
        
        PID:3828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        29⤵
        
        PID:2000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        29⤵
        
        PID:3512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        29⤵
        
        PID:1048
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        29⤵
        
        PID:3740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        29⤵
        
        PID:3748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        29⤵
        
        PID:1972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        29⤵
        
        PID:2060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        29⤵
        
        PID:4200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        29⤵
        
        PID:1648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        29⤵
        
        PID:2268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        29⤵
        
        PID:1660
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        29⤵
        
        PID:3920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        29⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        29⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        29⤵
        
        PID:5000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        29⤵
        
        PID:4468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        29⤵
        
        PID:2892
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        29⤵
        
        PID:3372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        29⤵
        
        PID:1788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        29⤵
        
        PID:1952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        29⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        29⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:776
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3F61.tmp\3F62.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        30⤵
        Executes a command shell one-liner
        
        PID:3228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        31⤵
        
        PID:4732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        31⤵
        Views/modifies file attributes
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        31⤵
        
        PID:3648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        31⤵
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        31⤵
        
        PID:4768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        31⤵
        
        PID:3424
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        31⤵
        
        PID:1860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        31⤵
        
        PID:468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        31⤵
        
        PID:4364
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        31⤵
        
        PID:5036
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        31⤵
        
        PID:740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        31⤵
        
        PID:3600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        31⤵
        
        PID:3740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        31⤵
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        31⤵
        
        PID:2356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        31⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        31⤵
        
        PID:3940
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        31⤵
        
        PID:1648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        31⤵
        Views/modifies file attributes
        
        PID:2268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        31⤵
        Views/modifies file attributes
        
        PID:1660
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        31⤵
        
        PID:3920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        31⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        31⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        31⤵
        
        PID:5000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        31⤵
        
        PID:2220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        31⤵
        Views/modifies file attributes
        
        PID:1624
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        31⤵
        
        PID:2360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        31⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        31⤵
        Views/modifies file attributes
        
        PID:972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        31⤵
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        31⤵
        
        PID:60
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        31⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        31⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4168
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\46B4.tmp\46B5.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        32⤵
        Executes a command shell one-liner
        
        PID:4364
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:2000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        33⤵
        
        PID:3600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        33⤵
        
        PID:3740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        33⤵
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        33⤵
        
        PID:2356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        33⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        33⤵
        
        PID:3940
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        33⤵
        
        PID:4408
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        33⤵
        
        PID:4036
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        33⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        33⤵
        
        PID:812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        33⤵
        
        PID:3140
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        33⤵
        
        PID:4468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        33⤵
        
        PID:2892
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        33⤵
        
        PID:4260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        33⤵
        
        PID:1952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        33⤵
        
        PID:816
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        33⤵
        
        PID:5056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        33⤵
        
        PID:5064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        33⤵
        
        PID:2576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        33⤵
        
        PID:2912
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        33⤵
        
        PID:1384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        33⤵
        
        PID:3192
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        33⤵
        
        PID:2548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        33⤵
        
        PID:1376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        33⤵
        
        PID:4756
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        33⤵
        
        PID:2884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        33⤵
        
        PID:4176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        33⤵
        
        PID:4020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        33⤵
        
        PID:2648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        33⤵
        
        PID:552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        33⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        33⤵
        
        PID:2352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        33⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        33⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1832
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4E93.tmp\4E94.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        34⤵
        Executes a command shell one-liner
        
        PID:4560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        35⤵
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        35⤵
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        35⤵
        
        PID:4144
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        35⤵
        
        PID:4788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        35⤵
        
        PID:3688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        35⤵
        
        PID:5012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        35⤵
        
        PID:1200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        35⤵
        
        PID:744
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        35⤵
        
        PID:944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        35⤵
        
        PID:3668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        35⤵
        
        PID:4176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        35⤵
        
        PID:1772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        35⤵
        
        PID:2648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        35⤵
        
        PID:552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        35⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        35⤵
        
        PID:2352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        35⤵
        
        PID:116
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        35⤵
        
        PID:4224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        35⤵
        
        PID:644
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        35⤵
        
        PID:1564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        35⤵
        
        PID:4588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        35⤵
        
        PID:3772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        35⤵
        Views/modifies file attributes
        
        PID:3956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        35⤵
        
        PID:3056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        35⤵
        
        PID:3748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        35⤵
        
        PID:1972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        35⤵
        
        PID:2076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        35⤵
        
        PID:4200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        35⤵
        
        PID:3528
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        35⤵
        
        PID:1648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        35⤵
        
        PID:2268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        35⤵
        
        PID:4156
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        35⤵
        
        PID:3920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        35⤵
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        35⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\57DA.tmp\57DB.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        36⤵
        Executes a command shell one-liner
        
        PID:3264
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        37⤵
        
        PID:3940
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        37⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        37⤵
        
        PID:3920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        37⤵
        
        PID:4276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        37⤵
        
        PID:456
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        37⤵
        
        PID:1624
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        37⤵
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        37⤵
        
        PID:4820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        37⤵
        
        PID:1376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        37⤵
        
        PID:2164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        37⤵
        
        PID:2648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        37⤵
        
        PID:3476
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        37⤵
        
        PID:1772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        37⤵
        
        PID:2352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        37⤵
        
        PID:116
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        37⤵
        Views/modifies file attributes
        
        PID:4224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        37⤵
        
        PID:4732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        37⤵
        Views/modifies file attributes
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        37⤵
        
        PID:1776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        37⤵
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        37⤵
        
        PID:3600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        37⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        37⤵
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        37⤵
        
        PID:3528
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        37⤵
        
        PID:1648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        37⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        37⤵
        
        PID:3920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        37⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        37⤵
        
        PID:1620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        37⤵
        
        PID:4828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        37⤵
        
        PID:3508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        37⤵
        
        PID:2512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        37⤵
        
        PID:1712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        37⤵
        Views/modifies file attributes
        
        PID:1376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        37⤵
        
        PID:616
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        37⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        37⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2512
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\619E.tmp\621C.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        38⤵
        Executes a command shell one-liner
        
        PID:1772
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        39⤵
        
        PID:1652
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        39⤵
        Views/modifies file attributes
        
        PID:4224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        39⤵
        
        PID:4244
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        39⤵
        
        PID:4240
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        39⤵
        
        PID:4336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        39⤵
        
        PID:1860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        39⤵
        Views/modifies file attributes
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        39⤵
        
        PID:3600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        39⤵
        Views/modifies file attributes
        
        PID:3344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        39⤵
        
        PID:2076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        39⤵
        
        PID:4280
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        39⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        39⤵
        
        PID:3632
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        39⤵
        
        PID:3060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        39⤵
        
        PID:1384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        39⤵
        
        PID:4820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        39⤵
        
        PID:3508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        39⤵
        
        PID:4004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        39⤵
        
        PID:1536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        39⤵
        
        PID:3180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        39⤵
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        39⤵
        
        PID:1776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        39⤵
        
        PID:3956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        39⤵
        
        PID:1860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        39⤵
        
        PID:3352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        39⤵
        
        PID:3080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        39⤵
        
        PID:1048
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        39⤵
        
        PID:3832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        39⤵
        
        PID:4908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        39⤵
        
        PID:3600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        39⤵
        
        PID:3344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        39⤵
        
        PID:2076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        39⤵
        
        PID:4280
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        39⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        39⤵
        
        PID:456
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        39⤵
        
        PID:3060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        39⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        39⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4292
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6B14.tmp\6B15.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        40⤵
        Executes a command shell one-liner
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        41⤵
        
        PID:3180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        41⤵
        
        PID:4336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        41⤵
        
        PID:3772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        41⤵
        
        PID:5068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        41⤵
        
        PID:3352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        41⤵
        Views/modifies file attributes
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        41⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        41⤵
        
        PID:3832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        41⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        41⤵
        
        PID:3600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        41⤵
        
        PID:3344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        41⤵
        
        PID:2076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        41⤵
        Views/modifies file attributes
        
        PID:812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        41⤵
        
        PID:4276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        41⤵
        
        PID:1624
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        41⤵
        
        PID:2352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        41⤵
        
        PID:3180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        41⤵
        
        PID:4336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        41⤵
        
        PID:3044
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        41⤵
        
        PID:3080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        41⤵
        Views/modifies file attributes
        
        PID:3352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        41⤵
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        41⤵
        
        PID:1944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        41⤵
        
        PID:3740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        41⤵
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        41⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        41⤵
        
        PID:384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        41⤵
        
        PID:4696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        41⤵
        
        PID:4280
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        41⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        41⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        41⤵
        
        PID:456
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        41⤵
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        41⤵
        
        PID:4500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        41⤵
        
        PID:3180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        41⤵
        
        PID:1100
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        41⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        41⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\769D.tmp\769E.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        42⤵
        Executes a command shell one-liner
        
        PID:4276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        43⤵
        
        PID:4588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        43⤵
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        43⤵
        
        PID:4076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        43⤵
        
        PID:4312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        43⤵
        
        PID:3448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        43⤵
        
        PID:3080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        43⤵
        
        PID:3352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        43⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        43⤵
        
        PID:4804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        43⤵
        
        PID:3924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        43⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        43⤵
        
        PID:4004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        43⤵
        
        PID:4588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        43⤵
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        43⤵
        
        PID:4076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        43⤵
        
        PID:4312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        43⤵
        
        PID:3448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        43⤵
        
        PID:3080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        43⤵
        
        PID:3352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        43⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        43⤵
        
        PID:4804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        43⤵
        
        PID:3924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        43⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        43⤵
        
        PID:4000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        43⤵
        
        PID:4500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        43⤵
        
        PID:3956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        43⤵
        
        PID:4336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        43⤵
        
        PID:4312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        43⤵
        
        PID:1896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        43⤵
        
        PID:2104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        43⤵
        
        PID:4908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        43⤵
        
        PID:1660
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        43⤵
        
        PID:2220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        43⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        43⤵
        
        PID:1776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        43⤵
        
        PID:4588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        43⤵
        
        PID:1100
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        43⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        43⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4764
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8265.tmp\8266.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        44⤵
        Executes a command shell one-liner
        
        PID:3668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        45⤵
        Views/modifies file attributes
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        45⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        45⤵
        
        PID:4696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        45⤵
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        45⤵
        
        PID:3772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        45⤵
        Views/modifies file attributes
        
        PID:4588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        45⤵
        
        PID:1896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        45⤵
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        45⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        45⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        45⤵
        
        PID:4028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        45⤵
        
        PID:3180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        45⤵
        
        PID:5068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        45⤵
        
        PID:3528
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        45⤵
        
        PID:1660
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        45⤵
        
        PID:2220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        45⤵
        
        PID:4876
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        45⤵
        
        PID:4500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        45⤵
        
        PID:3772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        45⤵
        
        PID:1796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        45⤵
        
        PID:1896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        45⤵
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        45⤵
        
        PID:2220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        45⤵
        
        PID:4336
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        45⤵
        
        PID:3180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        45⤵
        
        PID:3344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        45⤵
        
        PID:4696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        45⤵
        
        PID:1660
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        45⤵
        
        PID:4152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        45⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        45⤵
        
        PID:4028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        45⤵
        
        PID:4804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        45⤵
        
        PID:3924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        45⤵
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        45⤵
        
        PID:4004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        45⤵
        
        PID:5028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        45⤵
        
        PID:3908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        45⤵
        
        PID:3772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        45⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        45⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1560
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8EF8.tmp\8EF9.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        46⤵
        Executes a command shell one-liner
        
        PID:1252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        47⤵
        
        PID:5168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        47⤵
        
        PID:5184
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        47⤵
        
        PID:5200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        47⤵
        
        PID:5216
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        47⤵
        Views/modifies file attributes
        
        PID:5232
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        47⤵
        
        PID:5252
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        47⤵
        
        PID:5268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        47⤵
        Views/modifies file attributes
        
        PID:5296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        47⤵
        
        PID:5312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        47⤵
        
        PID:5332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        47⤵
        
        PID:5352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        47⤵
        
        PID:5368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        47⤵
        Views/modifies file attributes
        
        PID:5384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        47⤵
        
        PID:5400
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        47⤵
        
        PID:5416
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        47⤵
        
        PID:5432
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        47⤵
        
        PID:5448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        47⤵
        
        PID:5464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        47⤵
        
        PID:5484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        47⤵
        
        PID:5500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        47⤵
        
        PID:5520
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        47⤵
        
        PID:5540
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        47⤵
        
        PID:5556
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        47⤵
        
        PID:5572
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        47⤵
        
        PID:5588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        47⤵
        
        PID:5604
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        47⤵
        
        PID:5620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        47⤵
        
        PID:5636
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        47⤵
        
        PID:5652
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        47⤵
        
        PID:5668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        47⤵
        
        PID:5684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        47⤵
        
        PID:5700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        47⤵
        
        PID:5716
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        47⤵
        
        PID:5736
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        47⤵
        
        PID:5756
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        47⤵
        
        PID:5772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        47⤵
        
        PID:5788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        47⤵
        
        PID:5804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        47⤵
        
        PID:5820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        47⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        47⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5248
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9A52.tmp\9A53.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        48⤵
        Executes a command shell one-liner
        
        PID:5308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        49⤵
        
        PID:5344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        49⤵
        
        PID:5360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        49⤵
        
        PID:5376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        49⤵
        
        PID:5388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        49⤵
        
        PID:5428
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        49⤵
        
        PID:5384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        49⤵
        
        PID:5440
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        49⤵
        
        PID:5452
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        49⤵
        
        PID:5468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        49⤵
        
        PID:5492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        49⤵
        
        PID:5504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        49⤵
        
        PID:5500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        49⤵
        
        PID:5524
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        49⤵
        
        PID:5548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        49⤵
        
        PID:5568
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        49⤵
        
        PID:5556
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        49⤵
        
        PID:5576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        49⤵
        
        PID:5600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        49⤵
        
        PID:5608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        49⤵
        
        PID:5632
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        49⤵
        
        PID:5620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        49⤵
        
        PID:5640
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        49⤵
        Views/modifies file attributes
        
        PID:5660
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        49⤵
        
        PID:5676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        49⤵
        
        PID:5692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        49⤵
        
        PID:5704
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        49⤵
        Views/modifies file attributes
        
        PID:5712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        49⤵
        
        PID:5724
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        49⤵
        
        PID:5752
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        49⤵
        
        PID:5764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        49⤵
        
        PID:5784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        49⤵
        
        PID:5800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        49⤵
        
        PID:5788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        49⤵
        
        PID:5808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        49⤵
        
        PID:5824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        49⤵
        
        PID:5840
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        49⤵
        
        PID:5856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        49⤵
        
        PID:5868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        49⤵
        
        PID:5884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        49⤵
        
        PID:5900
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        49⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        49⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AB4A.tmp\AB5A.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        50⤵
        Executes a command shell one-liner
        
        PID:5436
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        51⤵
        
        PID:5496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        51⤵
        
        PID:5492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        51⤵
        
        PID:5536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        51⤵
        
        PID:5552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        51⤵
        
        PID:5548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        51⤵
        
        PID:5584
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        51⤵
        
        PID:5592
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        51⤵
        
        PID:5600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        51⤵
        
        PID:5608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        51⤵
        
        PID:5632
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        51⤵
        
        PID:5620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        51⤵
        
        PID:5640
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        51⤵
        
        PID:5652
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        51⤵
        
        PID:5696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        51⤵
        
        PID:5684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        51⤵
        
        PID:5708
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        51⤵
        
        PID:5732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        51⤵
        Views/modifies file attributes
        
        PID:5716
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        51⤵
        
        PID:5768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        51⤵
        
        PID:5752
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        51⤵
        
        PID:5764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        51⤵
        
        PID:5776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        51⤵
        
        PID:5816
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        51⤵
        
        PID:5832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        51⤵
        
        PID:5784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        51⤵
        
        PID:5824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        51⤵
        
        PID:5840
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        51⤵
        
        PID:5872
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        51⤵
        
        PID:5868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        51⤵
        
        PID:5892
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        51⤵
        
        PID:5900
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        51⤵
        
        PID:5940
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        51⤵
        
        PID:5948
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        51⤵
        
        PID:5976
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        51⤵
        
        PID:5988
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        51⤵
        
        PID:6012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        51⤵
        
        PID:6016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        51⤵
        Views/modifies file attributes
        
        PID:6032
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        51⤵
        
        PID:6040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        51⤵
        
        PID:6056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        51⤵
        
        PID:6072
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        51⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        51⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BF01.tmp\BF02.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        52⤵
        Executes a command shell one-liner
        
        PID:5688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        53⤵
        
        PID:5724
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        53⤵
        
        PID:5768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        53⤵
        
        PID:5780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        53⤵
        
        PID:5800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        53⤵
        
        PID:5828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        53⤵
        
        PID:5808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        53⤵
        
        PID:5844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        53⤵
        
        PID:5824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        53⤵
        
        PID:5840
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        53⤵
        
        PID:5888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        53⤵
        
        PID:5908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        53⤵
        
        PID:5916
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        53⤵
        
        PID:5956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        53⤵
        
        PID:1668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        53⤵
        
        PID:5948
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        53⤵
        
        PID:5976
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        53⤵
        
        PID:5988
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        53⤵
        
        PID:6012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        53⤵
        
        PID:6016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        53⤵
        
        PID:6032
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        53⤵
        
        PID:6040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        53⤵
        
        PID:6056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        53⤵
        
        PID:6072
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        53⤵
        
        PID:6088
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        53⤵
        
        PID:6112
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        53⤵
        
        PID:1548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        53⤵
        
        PID:6136
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        53⤵
        
        PID:5180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        53⤵
        
        PID:4132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        53⤵
        
        PID:452
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        53⤵
        
        PID:5200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        53⤵
        
        PID:5220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        53⤵
        
        PID:5260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        53⤵
        
        PID:5364
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        53⤵
        Views/modifies file attributes
        
        PID:5372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        53⤵
        
        PID:5412
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        53⤵
        
        PID:5460
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        53⤵
        
        PID:5468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        53⤵
        
        PID:5512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        53⤵
        
        PID:5500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        53⤵
        
        PID:5544
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        53⤵
        
        PID:5568
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "966.exe"
        53⤵
        Views/modifies file attributes
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        53⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6016
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D23A.tmp\D23B.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        54⤵
        Executes a command shell one-liner
        
        PID:6056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        55⤵
        
        PID:6128
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        55⤵
        
        PID:1548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        55⤵
        
        PID:5132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        55⤵
        Views/modifies file attributes
        
        PID:5168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        55⤵
        
        PID:4944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        55⤵
        
        PID:1748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        55⤵
        
        PID:5228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        55⤵
        
        PID:5264
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        55⤵
        
        PID:5332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        55⤵
        
        PID:5380
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        55⤵
        
        PID:5352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        55⤵
        
        PID:5372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        55⤵
        
        PID:5412
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        55⤵
        
        PID:5460
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        55⤵
        
        PID:5496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        55⤵
        
        PID:5492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        55⤵
        
        PID:3608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        55⤵
        
        PID:5552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        55⤵
        
        PID:5568
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        55⤵
        
        PID:4060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        55⤵
        
        PID:5580
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        55⤵
        
        PID:5596
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        55⤵
        
        PID:5604
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        55⤵
        
        PID:5628
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        55⤵
        
        PID:5620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        55⤵
        
        PID:5684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        55⤵
        
        PID:5748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        55⤵
        
        PID:5752
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        55⤵
        
        PID:5768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        55⤵
        
        PID:5772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        55⤵
        
        PID:5776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        55⤵
        
        PID:5788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        55⤵
        
        PID:5820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        55⤵
        Views/modifies file attributes
        
        PID:5784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        55⤵
        
        PID:5864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        55⤵
        
        PID:5880
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        55⤵
        
        PID:5896
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        55⤵
        
        PID:5888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        55⤵
        
        PID:5884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        55⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        55⤵
        
        PID:5916
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        55⤵
        
        PID:5940
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "966.exe"
        55⤵
        
        PID:5960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "982.exe"
        55⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        55⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E8A1.tmp\E8B1.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        56⤵
        Executes a command shell one-liner
        
        PID:5620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        57⤵
        
        PID:5768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        57⤵
        
        PID:5812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        57⤵
        
        PID:5832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        57⤵
        
        PID:5820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        57⤵
        
        PID:5836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        57⤵
        
        PID:5856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        57⤵
        
        PID:5872
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        57⤵
        
        PID:5868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        57⤵
        
        PID:5904
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        57⤵
        
        PID:5888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        57⤵
        
        PID:5884
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        57⤵
        Views/modifies file attributes
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        57⤵
        
        PID:5972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        57⤵
        
        PID:1668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        57⤵
        
        PID:6000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        57⤵
        
        PID:5976
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        57⤵
        
        PID:6020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        57⤵
        
        PID:6024
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        57⤵
        
        PID:6032
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        57⤵
        Views/modifies file attributes
        
        PID:6132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        57⤵
        
        PID:6140
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        57⤵
        
        PID:1548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        57⤵
        
        PID:5132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        57⤵
        Views/modifies file attributes
        
        PID:5168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        57⤵
        
        PID:5224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        57⤵
        
        PID:5200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        57⤵
        
        PID:5220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        57⤵
        
        PID:5324
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        57⤵
        
        PID:5356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        57⤵
        
        PID:3096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        57⤵
        
        PID:716
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        57⤵
        
        PID:1564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        57⤵
        
        PID:5504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        57⤵
        
        PID:5528
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        57⤵
        
        PID:5492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        57⤵
        
        PID:5536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        57⤵
        
        PID:5544
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        57⤵
        
        PID:5572
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        57⤵
        
        PID:4060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        57⤵
        
        PID:5552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        57⤵
        
        PID:5648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        57⤵
        
        PID:5772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "966.exe"
        57⤵
        
        PID:5828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "982.exe"
        57⤵
        
        PID:5788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "999.exe"
        57⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        57⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3096
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FEB9.tmp\FEBA.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        58⤵
        Executes a command shell one-liner
        
        PID:5504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1018.exe"
        59⤵
        
        PID:5536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        59⤵
        
        PID:5556
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        59⤵
        
        PID:5584
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        59⤵
        
        PID:5588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        59⤵
        
        PID:5592
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        59⤵
        Views/modifies file attributes
        
        PID:5724
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        59⤵
        
        PID:5792
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        59⤵
        
        PID:5776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        59⤵
        
        PID:5832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        59⤵
        Views/modifies file attributes
        
        PID:5820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        59⤵
        Views/modifies file attributes
        
        PID:5836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        59⤵
        
        PID:5856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        59⤵
        
        PID:792
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        59⤵
        
        PID:2920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        59⤵
        
        PID:5900
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        59⤵
        
        PID:5932
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        59⤵
        
        PID:5916
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        59⤵
        
        PID:5964
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        59⤵
        
        PID:5996
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        59⤵
        
        PID:5948
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        59⤵
        
        PID:3932
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        59⤵
        
        PID:5976
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        59⤵
        
        PID:6020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        59⤵
        
        PID:6024
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        59⤵
        
        PID:6032
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        59⤵
        
        PID:3804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        59⤵
        Views/modifies file attributes
        
        PID:3068
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        59⤵
        
        PID:3448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        59⤵
        
        PID:5172
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        59⤵
        Views/modifies file attributes
        
        PID:5192
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        59⤵
        
        PID:4132
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        59⤵
        
        PID:5168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        59⤵
        
        PID:5184
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        59⤵
        
        PID:5228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        59⤵
        
        PID:5260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        59⤵
        Views/modifies file attributes
        
        PID:5296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        59⤵
        
        PID:5324
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        59⤵
        
        PID:5356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        59⤵
        
        PID:716
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        59⤵
        
        PID:5560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        59⤵
        
        PID:5568
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        59⤵
        
        PID:180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        59⤵
        
        PID:5604
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "966.exe"
        59⤵
        
        PID:5736
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "982.exe"
        59⤵
        
        PID:5768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "999.exe"
        59⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        59⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5788
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\182D.tmp\182E.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        60⤵
        Executes a command shell one-liner
        
        PID:5880
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1018.exe"
        61⤵
        
        PID:5908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1035.exe"
        61⤵
        
        PID:5924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        61⤵
        
        PID:5952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        61⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        61⤵
        
        PID:5972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        61⤵
        
        PID:4140
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        61⤵
        
        PID:4752
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        61⤵
        
        PID:1380
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        61⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        61⤵
        
        PID:1012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        61⤵
        Views/modifies file attributes
        
        PID:4908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        61⤵
        
        PID:5180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        61⤵
        
        PID:4780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        61⤵
        
        PID:2552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        61⤵
        
        PID:5188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        61⤵
        
        PID:1748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        61⤵
        
        PID:5168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        61⤵
        
        PID:5184
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        61⤵
        Views/modifies file attributes
        
        PID:5264
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        61⤵
        
        PID:3596
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        61⤵
        
        PID:5268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        61⤵
        
        PID:5364
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        61⤵
        
        PID:5352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        61⤵
        
        PID:5324
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        61⤵
        
        PID:5356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        61⤵
        
        PID:5372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        61⤵
        
        PID:5564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        61⤵
        
        PID:5548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        61⤵
        
        PID:3004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        61⤵
        
        PID:5580
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        61⤵
        
        PID:5588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        61⤵
        
        PID:5592
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        61⤵
        
        PID:5816
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        61⤵
        
        PID:5808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        61⤵
        
        PID:5828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        61⤵
        
        PID:5820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        61⤵
        
        PID:5908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        61⤵
        
        PID:5932
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        61⤵
        
        PID:5984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        61⤵
        
        PID:4812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        61⤵
        
        PID:4140
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        61⤵
        
        PID:2080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        61⤵
        
        PID:176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        61⤵
        
        PID:1012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "966.exe"
        61⤵
        
        PID:4908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "982.exe"
        61⤵
        
        PID:5180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "999.exe"
        61⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        61⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4140
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\30B6.tmp\30B7.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        62⤵
        Executes a command shell one-liner
        
        PID:5196
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1018.exe"
        63⤵
        
        PID:760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1035.exe"
        63⤵
        
        PID:5016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1057.exe"
        63⤵
        
        PID:5168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        63⤵
        Views/modifies file attributes
        
        PID:2820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        63⤵
        
        PID:2928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        63⤵
        
        PID:5332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        63⤵
        
        PID:5344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        63⤵
        
        PID:5352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        63⤵
        
        PID:5396
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        63⤵
        Views/modifies file attributes
        
        PID:716
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        63⤵
        
        PID:5572
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        63⤵
        
        PID:5356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        63⤵
        
        PID:5548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        63⤵
        
        PID:3988
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        63⤵
        Views/modifies file attributes
        
        PID:180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        63⤵
        
        PID:4816
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        63⤵
        
        PID:700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        63⤵
        
        PID:4268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        63⤵
        
        PID:5648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        63⤵
        
        PID:5772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe"
        63⤵
        Views/modifies file attributes
        
        PID:1808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe"
        63⤵
        
        PID:4304
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe"
        63⤵
        
        PID:3692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "675.exe.exe.exe.exe"
        63⤵
        
        PID:5844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe"
        63⤵
        
        PID:5820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe"
        63⤵
        
        PID:5908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "685.exe.exe.exe"
        63⤵
        
        PID:5932
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "688.exe"
        63⤵
        
        PID:5984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "692.exe"
        63⤵
        
        PID:4812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "698.exe"
        63⤵
        
        PID:5020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "848.exe"
        63⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "852.exe"
        63⤵
        
        PID:3728
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "858.exe"
        63⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "865.exe"
        63⤵
        
        PID:5188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "868.exe"
        63⤵
        
        PID:1748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "875.exe"
        63⤵
        
        PID:4868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "881.exe"
        63⤵
        
        PID:1996
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "888.exe"
        63⤵
        
        PID:2304
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "897.exe"
        63⤵
        
        PID:5296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "904.exe"
        63⤵
        
        PID:5364
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "914.exe"
        63⤵
        
        PID:5388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "924.exe"
        63⤵
        
        PID:3776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "933.exe"
        63⤵
        
        PID:5372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "943.exe"
        63⤵
        
        PID:5444
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "953.exe"
        63⤵
        
        PID:5568
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "966.exe"
        63⤵
        
        PID:5464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "982.exe"
        63⤵
        
        PID:5552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "999.exe"
        63⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        
        C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
        63⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5556
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4AF5.tmp\4AF6.bat C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        64⤵
        Executes a command shell one-liner
        
        PID:5584
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1018.exe"
        65⤵
        
        PID:5780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1035.exe"
        65⤵
        
        PID:4060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1057.exe"
        65⤵
        
        PID:3800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "1077.exe"
        65⤵
        
        PID:5604
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe"
        65⤵
        
        PID:5684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe"
        65⤵
        
        PID:5768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe"
        65⤵
        
        PID:5812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe"
        65⤵
        
        PID:656
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe"
        65⤵
        
        PID:5784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe"
        65⤵
        
        PID:2228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe"
        65⤵
        Views/modifies file attributes
        
        PID:5924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe.exe"
        65⤵
        
        PID:5944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe"
        65⤵
        
        PID:5916
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe"
        65⤵
        
        PID:2800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe"
        65⤵
        
        PID:5056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe"
        65⤵
        
        PID:5984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "662.exe.exe.exe.exe.exe"
        65⤵
        
        PID:3296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe"
        65⤵
        
        PID:3476
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe"
        65⤵
        
        PID:60
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe"
        65⤵
        
        PID:3964
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "669.exe.exe.exe.exe"
        65⤵
        
        PID:4768

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2864

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D05.bat

Path C:\Users\Admin\AppData\Local\Temp\3D04.tmp\3D05.bat
Size 214B
SHA256 d89dd0f34fd2e1ede30f1219b605679c41b951d96317663a6600d9f9acdcd342
MD5 4e62fb3abdc457c7bc1a243f9460e7c3
SHA1 041214e9a4026add8a0c331651af489f10f863a9
SHA512 6f5789f2c145adadddb1ffafe26def963998075f678b22424eaa67a7b1a522742a9b4d392ce8720ece04ccee421bcb4347c398b75440aff4253518c4c04df5cf
TLSH
T144D0C98EBAC2157626833D55C5865C4335CF209F5E520EC37424C1EA2481CBC438FAAA
MD5 SHA1 SHA512 TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe
Size 5.2MB
SHA256 469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d
MD5 d8a1ff8fdba7993f430a41eae77a52ad
SHA1 7868944202f185bebd9559639168e619cdd333e1
SHA512 a70755d9e92c88d91c98125fde085b9cff60ad841de1d8105c9f7b6991b11d5473f4dc36f554b33935338d32172b2875dfc19372f9f8ddf5a1e52328a45acaeb
SSDEEP 98304:ZKKKKKKKKKKKGoYoYoYoYoYoYoyKKKKKK:ZKKKKKKKKKKK8KKKKKK
TLSH
T11246AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe
Size 10.3MB
SHA256 e1a9411cf006a43fcaa9e717bdd5b70488fcf90f650e7d6d9a0f578f08e56776
MD5 26d6594a62409669da5ccf3dc39ff2ab
SHA1 a3c61651bf89e6eee054346acb403dfd725ad835
SHA512 d712414413d6155492bdb6b29b1b4c8bdddfd935f04c1cd094c7f005ab24e0c4c071d2245fde224349fff42b1f657b6d4b205f7f5c3a2c2a2c5ddbd58a01f9d5
SSDEEP 196608:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKK:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKKM
TLSH
T11BB6AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe
Size 768KB
SHA256 d92171ef05dd1b9ff8251cf409190cd65923ca0293d648e92fe3cff6ed41f90d
MD5 0424e9de30ce20aa0765b54962e65fb5
SHA1 0f72d0a0664ac5182197957eca08802e716ff51a
SHA512 a17db0d25ea90713837b590b275891768c00ce06f9030705508cf9faadf4929aec75e5c3fbd38b431bd947ae00dfa3671ca06c1c0b962173a103cac0bced4c3f
SSDEEP 12288:Bv2HAawdJ/AqAKAlv2HAawdJ/AqAKAlv2HAawdJ/AqAKAlv2HAr:h0AawdJ/8Km0AawdJ/8Km0AawdJ/8Km7
TLSH
T17BF4AE07B3D18262C5824671C6A169F6E770AF3987125FD3A34C7F0ABE712E0DDB119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe
Size 15.5MB
SHA256 a866c456b8863b702ddd0c7ae18775ec3c537f607ef2ba8d764acd9a58fbf2e6
MD5 19bead48329fcc156f321c0dd7b72e77
SHA1 4fdd7e72436803fa3d52f5dd9a24b1e88325e090
SHA512 bc2b96af5c07b3eb5fe15f8b09317044654007f9958cd483ee5b3cdbedf033fc418a3ca658479ddf8188c4074549078fcb4cb9c35868210662708702c4b14efe
SSDEEP 393216:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKK:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK1
TLSH
T1AFF6AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe
Size 896KB
SHA256 0cd6ad14b453e73d5dc4a6e1f1c2c715ae7fa0a24a61fdffade492381ec8084b
MD5 bdd7ee394855ce1556677817b9249d42
SHA1 d196e9662d58fd8068228a690a5b9dcbd2197ca3
SHA512 795f175025e910af5ef8466b2507e8ef0ec336fb30a8da9e68e5045b95066a31e8b5d1af3c1ce1f7156351c7042cf585bdacecf79f1a2de14701feb618404661
SSDEEP 24576:h0AawdJ/8Km0AawdJ/8Km0AawdJ/8Km0AawdJ/8K:Ew9w9w9w
TLSH
T1BE15AE07B3D1C262C1824675CAA15AF6E670AF39C7124FD3A3487F0ABE712D0DDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe
Size 20.7MB
SHA256 08d8b7b5d3559b5212ce6f41fd254cf47fae051b48f918a0e3df347e313f80a5
MD5 8ceff85f399ed0f5bfad678999332a4f
SHA1 c3f0df65a2b3b894097367873ded34dc5d6d0664
SHA512 7f3cd48b37d8398ac554e353dc9d00b658a470e9b8284ba2968fa8d3d75a34708eff64719b42626fb16ef5878e4d7ce3db5f8ac510cd230f748ee6a3d3bb3bfa
SSDEEP 393216:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKKM:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK0
TLSH
T1B127AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe
Size 31.0MB
SHA256 c466d4722249ce78e3fefaf903a5e759d55921212b93134e39520dde73611c4c
MD5 a5eff50e0888cab96d797ce205944d36
SHA1 199f524c0571690677be1a3ba3ce9c901b9c1c17
SHA512 14207741d3dba02f32c5363c6704514f2f276e43aaa31d8bd71b91b0dff0706a5c158b0cedb2471a4eaf80577fce91d3eb4a51c6b407484024ce729f8e6fd784
SSDEEP 786432:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKK0:
TLSH
T17D67AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\469979644fa546d4288d701b9c61328867b36189a0c14830f866a897658f1d5d.exe.exe.exe.exe.exe.exe.exe
Size 36.2MB
SHA256 9c449a7e3b49c5026a5ad48cd2418e4159675337c8a8f092077eff2c87b18f40
MD5 315715a2d50de43eaa434e396ac5b5a3
SHA1 2f5bdfc4b42f912b25cc7acc0b1405c86715ed7b
SHA512 70ae81eb3ffdb8a2d061f2124bcd417d8fe7cb042620968bbdc9edd8172600cdfc6b3a28ad05f7f9ce66fa3f362269a625e1f34d85872c468d9233836accf48b
SSDEEP 786432:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKK9:
TLSH
T13787AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

662.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\662.exe.exe.exe.exe
Size 25.9MB
SHA256 84bfdaf3c6a6c1d6262380b000fdadb119e533a3af770e2f95ba6bc24e5c35b7
MD5 0493b6eb3f47fd0ba038e8133db125e9
SHA1 764fa62f8a67b973f602cea2e87b5fe9a6ab7f6e
SHA512 87876d05c4d488b6f5046e1327b40b04a987af1284bc9d12c696e88e09040af4044d61ebf858b36bece897c9f1eeb6065408154368cea11c9de04394281235b5
SSDEEP 786432:ZKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKKKKKKKK8KKKKKKUKKKKK1:
TLSH
T13957AF03B3D1D172C1820275C655A6F2A775AF3587168FC7A3087F0ABE712E0EE7568A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4352-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download

memory/4352-368-0x0000000000412000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads