2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Size 6.7MB
Sample260916-3gc9qsgp2x
SHA256 2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82
MD5 4f9f0ee819d04528dde2398607fa8bd7
SHA1 5ad548b47883bc9c8685d68a3dac85f148c14c2c
SHA512 107560004b3a8384f947a990c391ea3cf9d5439f4e18dd207f0286b88dc79e207fb48d9a3ff01bf44be20f13855a36c35b558e868cd10f6a69c8659c567ad2a8
SSDEEP 49152:Ew9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
TLSH
T14B66AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 29 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe

Executes dropped EXE 28 IoCs

pid	Process
616	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2344	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
1952	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
1192	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4428	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4596	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3052	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2596	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4660	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4528	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2392	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3600	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3628	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4636	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
1324	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4396	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2360	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4788	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4760	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3804	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2972	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3768	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2516	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
2348	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
4080	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3404	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
1976	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
3824	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3076	cmd.exe
3060	cmd.exe
2876	cmd.exe
3312	cmd.exe
1784	cmd.exe
1984	cmd.exe
3980	cmd.exe
5080	cmd.exe
4472	cmd.exe
2868	cmd.exe
3288	cmd.exe
992	cmd.exe
4720	cmd.exe
792	cmd.exe
848	cmd.exe
3752	cmd.exe
1924	cmd.exe
2228	cmd.exe
1040	cmd.exe
1808	cmd.exe
4604	cmd.exe
4724	cmd.exe
1608	cmd.exe
4952	cmd.exe
2556	cmd.exe
2176	cmd.exe
3780	cmd.exe
4164	cmd.exe
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 3752	3192	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	88
PID 3752 wrote to memory of 4472	3752	cmd.exe	91
PID 3752 wrote to memory of 616	3752	cmd.exe	92
PID 616 wrote to memory of 3076	616	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	93
PID 3076 wrote to memory of 456	3076	cmd.exe	95
PID 3076 wrote to memory of 3160	3076	cmd.exe	96
PID 3076 wrote to memory of 3496	3076	cmd.exe	97
PID 3076 wrote to memory of 2344	3076	cmd.exe	98
PID 2344 wrote to memory of 3060	2344	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	99
PID 3060 wrote to memory of 1404	3060	cmd.exe	101
PID 3060 wrote to memory of 788	3060	cmd.exe	102
PID 3060 wrote to memory of 4508	3060	cmd.exe	103
PID 3060 wrote to memory of 1560	3060	cmd.exe	104
PID 3060 wrote to memory of 1952	3060	cmd.exe	105
PID 1952 wrote to memory of 1040	1952	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	106
PID 1040 wrote to memory of 888	1040	cmd.exe	108
PID 1040 wrote to memory of 640	1040	cmd.exe	109
PID 1040 wrote to memory of 3944	1040	cmd.exe	110
PID 1040 wrote to memory of 4232	1040	cmd.exe	111
PID 1040 wrote to memory of 4004	1040	cmd.exe	112
PID 1040 wrote to memory of 1192	1040	cmd.exe	113
PID 1192 wrote to memory of 992	1192	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	114
PID 992 wrote to memory of 3512	992	cmd.exe	116
PID 992 wrote to memory of 448	992	cmd.exe	117
PID 992 wrote to memory of 2548	992	cmd.exe	212
PID 992 wrote to memory of 2868	992	cmd.exe	214
PID 992 wrote to memory of 3576	992	cmd.exe	213
PID 992 wrote to memory of 4832	992	cmd.exe	121
PID 992 wrote to memory of 3308	992	cmd.exe	122
PID 992 wrote to memory of 4720	992	cmd.exe	161
PID 992 wrote to memory of 2716	992	cmd.exe	124
PID 992 wrote to memory of 4428	992	cmd.exe	125
PID 4428 wrote to memory of 1808	4428	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	126
PID 1808 wrote to memory of 4636	1808	cmd.exe	170
PID 1808 wrote to memory of 3880	1808	cmd.exe	171
PID 1808 wrote to memory of 1168	1808	cmd.exe	130
PID 1808 wrote to memory of 740	1808	cmd.exe	245
PID 1808 wrote to memory of 4356	1808	cmd.exe	132
PID 1808 wrote to memory of 2864	1808	cmd.exe	133
PID 1808 wrote to memory of 2392	1808	cmd.exe	254
PID 1808 wrote to memory of 3840	1808	cmd.exe	135
PID 1808 wrote to memory of 712	1808	cmd.exe	136
PID 1808 wrote to memory of 5060	1808	cmd.exe	137
PID 1808 wrote to memory of 4596	1808	cmd.exe	138
PID 4596 wrote to memory of 4604	4596	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	140
PID 4604 wrote to memory of 4680	4604	cmd.exe	187
PID 4604 wrote to memory of 2140	4604	cmd.exe	145
PID 4604 wrote to memory of 4268	4604	cmd.exe	270
PID 4604 wrote to memory of 1404	4604	cmd.exe	190
PID 4604 wrote to memory of 4480	4604	cmd.exe	191
PID 4604 wrote to memory of 1992	4604	cmd.exe	192
PID 4604 wrote to memory of 3480	4604	cmd.exe	193
PID 4604 wrote to memory of 2984	4604	cmd.exe	194
PID 4604 wrote to memory of 4160	4604	cmd.exe	195
PID 4604 wrote to memory of 1056	4604	cmd.exe	196
PID 4604 wrote to memory of 1244	4604	cmd.exe	197
PID 4604 wrote to memory of 1560	4604	cmd.exe	231
PID 4604 wrote to memory of 4744	4604	cmd.exe	199
PID 4604 wrote to memory of 4996	4604	cmd.exe	200
PID 4604 wrote to memory of 3588	4604	cmd.exe	201
PID 4604 wrote to memory of 4860	4604	cmd.exe	234
PID 4604 wrote to memory of 3052	4604	cmd.exe	160
PID 3052 wrote to memory of 4720	3052	2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe	161
PID 4720 wrote to memory of 4016	4720	cmd.exe	163

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3780	attrib.exe
2312	attrib.exe
3768	attrib.exe
2012	attrib.exe
4836	attrib.exe
1020	attrib.exe
5096	attrib.exe
4944	attrib.exe
4160	attrib.exe
4160	attrib.exe
5012	attrib.exe
2484	attrib.exe
888	attrib.exe
1020	attrib.exe
2984	attrib.exe
1392	attrib.exe
4764	attrib.exe
4432	attrib.exe
788	attrib.exe
3304	attrib.exe
4764	attrib.exe
2056	attrib.exe
688	attrib.exe
1028	attrib.exe
4508	attrib.exe
1992	attrib.exe
4344	attrib.exe
844	attrib.exe
4368	attrib.exe
4368	attrib.exe
3576	attrib.exe
1168	attrib.exe
4996	attrib.exe
3104	attrib.exe
2868	attrib.exe
3968	attrib.exe
2228	attrib.exe
3388	attrib.exe
4004	attrib.exe
4996	attrib.exe
4800	attrib.exe
2700	attrib.exe
4764	attrib.exe
4996	attrib.exe
4232	attrib.exe
3856	attrib.exe
1404	attrib.exe
960	attrib.exe
2012	attrib.exe
3096	attrib.exe
4836	attrib.exe
844	attrib.exe
1020	attrib.exe
1020	attrib.exe
2716	attrib.exe
3768	attrib.exe
5060	attrib.exe
4608	attrib.exe
1020	attrib.exe
4256	attrib.exe
3352	attrib.exe
2972	attrib.exe
3588	attrib.exe
1396	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
"C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\81FC.tmp\81FD.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\attrib.exe
    attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
    C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\85A6.tmp\85A7.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        5⤵
        
        PID:456
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        5⤵
        
        PID:3160
    - - C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9304.tmp\9305.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        7⤵
        
        PID:1404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe.exe"
        7⤵
        Views/modifies file attributes
        
        PID:788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        7⤵
        
        PID:4508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        7⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9CD7.tmp\9CD8.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        9⤵
        
        PID:888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        9⤵
        
        PID:640
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        9⤵
        
        PID:3944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        9⤵
        
        PID:4232
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        9⤵
        Views/modifies file attributes
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A013.tmp\A014.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        11⤵
        
        PID:3512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe.exe"
        11⤵
        
        PID:448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        11⤵
        
        PID:2548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        11⤵
        
        PID:2868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        11⤵
        Views/modifies file attributes
        
        PID:3576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        11⤵
        
        PID:4832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        11⤵
        
        PID:3308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        11⤵
        
        PID:4720
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        11⤵
        Views/modifies file attributes
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CA6F.tmp\CA80.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        13⤵
        
        PID:4636
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        13⤵
        
        PID:3880
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        13⤵
        Views/modifies file attributes
        
        PID:1168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        13⤵
        
        PID:740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        13⤵
        
        PID:4356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        13⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        13⤵
        
        PID:2392
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        13⤵
        
        PID:3840
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        13⤵
        
        PID:712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        13⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FFA8.tmp\FFA9.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        15⤵
        
        PID:4680
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe.exe"
        15⤵
        
        PID:2140
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        15⤵
        
        PID:4268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        15⤵
        
        PID:1404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        15⤵
        
        PID:4480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        15⤵
        
        PID:1992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        15⤵
        
        PID:3480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        15⤵
        
        PID:2984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        15⤵
        Views/modifies file attributes
        
        PID:4160
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        15⤵
        
        PID:1056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        15⤵
        
        PID:1244
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        15⤵
        
        PID:1560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        15⤵
        
        PID:4744
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        15⤵
        Views/modifies file attributes
        
        PID:4996
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        15⤵
        
        PID:3588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        15⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4BB5.tmp\4BB6.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        17⤵
        
        PID:4016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        17⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        17⤵
        
        PID:2176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        17⤵
        
        PID:2544
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        17⤵
        
        PID:3628
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        17⤵
        
        PID:1400
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        17⤵
        
        PID:964
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        17⤵
        
        PID:4636
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        17⤵
        
        PID:3880
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        17⤵
        
        PID:4224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        17⤵
        
        PID:3232
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        17⤵
        
        PID:2228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        17⤵
        
        PID:2392
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        17⤵
        
        PID:2700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        17⤵
        
        PID:4076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        17⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6901.tmp\6902.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        18⤵
        Executes a command shell one-liner
        
        PID:2556
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        19⤵
        
        PID:3992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        19⤵
        
        PID:3864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        19⤵
        
        PID:4408
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        19⤵
        
        PID:1784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        19⤵
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        19⤵
        
        PID:4680
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        19⤵
        
        PID:4208
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        19⤵
        
        PID:1380
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        19⤵
        Views/modifies file attributes
        
        PID:1404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        19⤵
        
        PID:4480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        19⤵
        Views/modifies file attributes
        
        PID:1992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        19⤵
        
        PID:3480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        19⤵
        Views/modifies file attributes
        
        PID:2984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        19⤵
        Views/modifies file attributes
        
        PID:4160
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        19⤵
        
        PID:1056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        19⤵
        
        PID:1244
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        19⤵
        
        PID:1560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        19⤵
        
        PID:4744
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        19⤵
        Views/modifies file attributes
        
        PID:4996
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        19⤵
        
        PID:3588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        19⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6DC4.tmp\6DC5.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        20⤵
        Executes a command shell one-liner
        
        PID:4724
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        21⤵
        
        PID:4308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        21⤵
        Views/modifies file attributes
        
        PID:3104
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        21⤵
        
        PID:2144
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        21⤵
        
        PID:2508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        21⤵
        
        PID:2248
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        21⤵
        
        PID:4576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        21⤵
        
        PID:2548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        21⤵
        
        PID:3576
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        21⤵
        Views/modifies file attributes
        
        PID:2868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        21⤵
        
        PID:1984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        21⤵
        
        PID:4364
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        21⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        21⤵
        
        PID:2176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        21⤵
        
        PID:3920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        21⤵
        Views/modifies file attributes
        
        PID:3780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        21⤵
        
        PID:3844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        21⤵
        
        PID:3628
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        21⤵
        
        PID:2496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        21⤵
        
        PID:964
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        21⤵
        
        PID:2052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        21⤵
        
        PID:4488
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        21⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        21⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4528
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7BBE.tmp\7BBF.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        22⤵
        Executes a command shell one-liner
        
        PID:1784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        23⤵
        
        PID:1560
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        23⤵
        
        PID:3264
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        23⤵
        
        PID:3612
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        23⤵
        
        PID:4860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        23⤵
        
        PID:848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        23⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        23⤵
        
        PID:788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        23⤵
        Views/modifies file attributes
        
        PID:3768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        23⤵
        
        PID:1688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        23⤵
        
        PID:3804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        23⤵
        
        PID:5064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        23⤵
        
        PID:1712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        23⤵
        
        PID:3268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        23⤵
        
        PID:4372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        23⤵
        
        PID:740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        23⤵
        
        PID:824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        23⤵
        
        PID:5096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        23⤵
        
        PID:2408
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        23⤵
        
        PID:1672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        23⤵
        Views/modifies file attributes
        
        PID:3968
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        23⤵
        
        PID:4672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        23⤵
        
        PID:4020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        23⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        23⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2392
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9DAD.tmp\9DAE.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        24⤵
        Executes a command shell one-liner
        
        PID:792
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        25⤵
        
        PID:2700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        25⤵
        
        PID:1392
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        25⤵
        
        PID:2928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        25⤵
        
        PID:1396
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        25⤵
        
        PID:2008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        25⤵
        
        PID:2480
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        25⤵
        
        PID:4384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        25⤵
        
        PID:2276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        25⤵
        
        PID:4956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        25⤵
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        25⤵
        
        PID:3020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        25⤵
        
        PID:1288
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        25⤵
        
        PID:3264
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        25⤵
        
        PID:4268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        25⤵
        
        PID:3220
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        25⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        25⤵
        
        PID:820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        25⤵
        
        PID:3096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        25⤵
        
        PID:3804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        25⤵
        
        PID:3388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        25⤵
        
        PID:3232
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        25⤵
        
        PID:4372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        25⤵
        
        PID:4488
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        25⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        25⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A464.tmp\A465.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        26⤵
        Executes a command shell one-liner
        
        PID:1608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        27⤵
        
        PID:4168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        27⤵
        
        PID:548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        27⤵
        
        PID:4288
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        27⤵
        Views/modifies file attributes
        
        PID:4800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        27⤵
        
        PID:3276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        27⤵
        
        PID:5020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        27⤵
        
        PID:5108
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        27⤵
        
        PID:3260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        27⤵
        
        PID:2488
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        27⤵
        
        PID:4216
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        27⤵
        Views/modifies file attributes
        
        PID:2700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        27⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        27⤵
        
        PID:2676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        27⤵
        
        PID:692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        27⤵
        
        PID:4200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        27⤵
        
        PID:4788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        27⤵
        
        PID:3284
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        27⤵
        
        PID:4384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        27⤵
        
        PID:2312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        27⤵
        
        PID:4008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        27⤵
        
        PID:1552
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        27⤵
        
        PID:2040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        27⤵
        
        PID:3020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        27⤵
        
        PID:3852
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        27⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        27⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3628
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ADDA.tmp\ADDB.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        28⤵
        Executes a command shell one-liner
        
        PID:2176
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        29⤵
        
        PID:4784
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        29⤵
        
        PID:3952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        29⤵
        
        PID:2580
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        29⤵
        
        PID:2296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        29⤵
        Views/modifies file attributes
        
        PID:3352
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        29⤵
        
        PID:1116
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        29⤵
        
        PID:956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        29⤵
        
        PID:4168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        29⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        29⤵
        
        PID:2564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        29⤵
        
        PID:4800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        29⤵
        
        PID:3276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        29⤵
        
        PID:3468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        29⤵
        
        PID:3260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        29⤵
        
        PID:4332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        29⤵
        
        PID:3744
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        29⤵
        
        PID:2536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        29⤵
        
        PID:3856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        29⤵
        
        PID:2676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        29⤵
        
        PID:3304
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        29⤵
        
        PID:2608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        29⤵
        
        PID:5012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        29⤵
        
        PID:4384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        29⤵
        
        PID:5052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        29⤵
        
        PID:3428
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        29⤵
        Views/modifies file attributes
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        29⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4636
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B78E.tmp\B78F.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        30⤵
        Executes a command shell one-liner
        
        PID:3780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        31⤵
        
        PID:2580
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        31⤵
        
        PID:4236
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        31⤵
        
        PID:2708
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        31⤵
        Views/modifies file attributes
        
        PID:4944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        31⤵
        
        PID:2448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        31⤵
        
        PID:548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        31⤵
        
        PID:4168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        31⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        31⤵
        Views/modifies file attributes
        
        PID:2972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        31⤵
        
        PID:4700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        31⤵
        
        PID:5020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        31⤵
        
        PID:5108
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        31⤵
        
        PID:1924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        31⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        31⤵
        
        PID:2860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        31⤵
        
        PID:4332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        31⤵
        
        PID:2536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        31⤵
        
        PID:3856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        31⤵
        
        PID:1396
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        31⤵
        
        PID:2008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        31⤵
        
        PID:2952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        31⤵
        
        PID:3284
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        31⤵
        Views/modifies file attributes
        
        PID:5012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        31⤵
        
        PID:2276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        31⤵
        
        PID:4008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        31⤵
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        31⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        31⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1324
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C366.tmp\C367.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        32⤵
        Executes a command shell one-liner
        
        PID:2876
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        33⤵
        
        PID:4944
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        33⤵
        
        PID:3432
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        33⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        33⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        33⤵
        
        PID:2388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        33⤵
        
        PID:4700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        33⤵
        
        PID:876
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        33⤵
        
        PID:4760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        33⤵
        
        PID:3276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        33⤵
        
        PID:5108
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        33⤵
        
        PID:3776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        33⤵
        Views/modifies file attributes
        
        PID:1392
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        33⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        33⤵
        
        PID:2536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        33⤵
        
        PID:1920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        33⤵
        Views/modifies file attributes
        
        PID:3304
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        33⤵
        
        PID:2608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        33⤵
        
        PID:3284
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        33⤵
        
        PID:4384
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        33⤵
        
        PID:5052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        33⤵
        Views/modifies file attributes
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        33⤵
        
        PID:2040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        33⤵
        
        PID:3732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        33⤵
        
        PID:4260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        33⤵
        
        PID:1288
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        33⤵
        Views/modifies file attributes
        
        PID:3588
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        33⤵
        
        PID:212
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        33⤵
        
        PID:4860
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        33⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        33⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D027.tmp\D028.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        34⤵
        Executes a command shell one-liner
        
        PID:1924
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        35⤵
        
        PID:4332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        35⤵
        
        PID:4872
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        35⤵
        
        PID:2676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        35⤵
        
        PID:2008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        35⤵
        
        PID:4164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        35⤵
        Views/modifies file attributes
        
        PID:2312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        35⤵
        
        PID:4956
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        35⤵
        
        PID:4008
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        35⤵
        
        PID:2032
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        35⤵
        Views/modifies file attributes
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        35⤵
        
        PID:2360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        35⤵
        Views/modifies file attributes
        
        PID:4996
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        35⤵
        
        PID:4260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        35⤵
        
        PID:1288
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        35⤵
        
        PID:3264
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        35⤵
        
        PID:4988
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        35⤵
        
        PID:4268
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        35⤵
        
        PID:2504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        35⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        35⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        35⤵
        
        PID:3768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        35⤵
        
        PID:3360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        35⤵
        
        PID:4044
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        35⤵
        
        PID:1712
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        35⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        35⤵
        
        PID:3404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        35⤵
        
        PID:2052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        35⤵
        
        PID:3356
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        35⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        35⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DD47.tmp\DD48.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        36⤵
        Executes a command shell one-liner
        
        PID:4472
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        37⤵
        
        PID:2504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        37⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        37⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        37⤵
        
        PID:4648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        37⤵
        
        PID:5024
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        37⤵
        
        PID:1016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        37⤵
        Views/modifies file attributes
        
        PID:2228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        37⤵
        
        PID:5064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        37⤵
        
        PID:3880
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        37⤵
        
        PID:5096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        37⤵
        
        PID:4168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        37⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        37⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        37⤵
        
        PID:2012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        37⤵
        
        PID:2388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        37⤵
        
        PID:4700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        37⤵
        
        PID:2600
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        37⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        37⤵
        
        PID:2536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        37⤵
        
        PID:4788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        37⤵
        
        PID:1436
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        37⤵
        
        PID:2608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        37⤵
        
        PID:4164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        37⤵
        
        PID:3700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        37⤵
        
        PID:5052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        37⤵
        
        PID:3020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        37⤵
        
        PID:4620
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        37⤵
        
        PID:4188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        37⤵
        
        PID:3420
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        37⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        37⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EA85.tmp\EA86.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        38⤵
        Executes a command shell one-liner
        
        PID:4164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        39⤵
        
        PID:1052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        39⤵
        
        PID:212
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        39⤵
        
        PID:788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        39⤵
        
        PID:1760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        39⤵
        
        PID:820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        39⤵
        
        PID:4512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        39⤵
        
        PID:1112
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        39⤵
        
        PID:3360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        39⤵
        Views/modifies file attributes
        
        PID:3388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        39⤵
        
        PID:4224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        39⤵
        
        PID:2228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        39⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        39⤵
        
        PID:2580
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        39⤵
        
        PID:2052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        39⤵
        
        PID:2296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        39⤵
        
        PID:2564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        39⤵
        
        PID:2972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        39⤵
        
        PID:2492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        39⤵
        Views/modifies file attributes
        
        PID:2012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        39⤵
        
        PID:2868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        39⤵
        Views/modifies file attributes
        
        PID:4232
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        39⤵
        
        PID:1748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        39⤵
        
        PID:3776
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        39⤵
        
        PID:4332
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        39⤵
        
        PID:1436
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        39⤵
        Views/modifies file attributes
        
        PID:1396
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        39⤵
        
        PID:4200
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        39⤵
        
        PID:960
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        39⤵
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        39⤵
        
        PID:4188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        39⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        39⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4760
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F582.tmp\F583.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        40⤵
        Executes a command shell one-liner
        
        PID:2676
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        41⤵
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        41⤵
        
        PID:4188
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        41⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        41⤵
        
        PID:2504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        41⤵
        
        PID:1688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        41⤵
        Views/modifies file attributes
        
        PID:3768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        41⤵
        Views/modifies file attributes
        
        PID:2056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        41⤵
        
        PID:3360
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        41⤵
        
        PID:740
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        41⤵
        
        PID:4372
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        41⤵
        
        PID:5064
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        41⤵
        
        PID:2864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        41⤵
        
        PID:3404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        41⤵
        
        PID:3432
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        41⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        41⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        41⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        41⤵
        
        PID:2492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        41⤵
        Views/modifies file attributes
        
        PID:2012
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        41⤵
        
        PID:2768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        41⤵
        
        PID:1276
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        41⤵
        
        PID:1748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        41⤵
        
        PID:692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        41⤵
        
        PID:212
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        41⤵
        
        PID:4184
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        41⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        41⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        41⤵
        
        PID:4648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        41⤵
        
        PID:3096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        41⤵
        
        PID:2504
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        41⤵
        
        PID:4044
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        41⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        41⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3804
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\234.tmp\235.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        42⤵
        Executes a command shell one-liner
        
        PID:2228
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        43⤵
        
        PID:5096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        43⤵
        
        PID:4608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        43⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        43⤵
        
        PID:2972
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        43⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        43⤵
        
        PID:2868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        43⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        43⤵
        
        PID:2920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        43⤵
        
        PID:1748
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        43⤵
        
        PID:692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        43⤵
        
        PID:788
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        43⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        43⤵
        
        PID:1760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        43⤵
        
        PID:820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        43⤵
        
        PID:4512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        43⤵
        
        PID:1016
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        43⤵
        
        PID:2052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        43⤵
        
        PID:2296
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        43⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        43⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        43⤵
        
        PID:4800
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        43⤵
        
        PID:2492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        43⤵
        
        PID:2204
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        43⤵
        
        PID:2868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        43⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        43⤵
        
        PID:1920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        43⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        43⤵
        Views/modifies file attributes
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        43⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        43⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        43⤵
        
        PID:820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        43⤵
        
        PID:4512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        43⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        43⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2972
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FE0.tmp\FE1.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        44⤵
        Executes a command shell one-liner
        
        PID:2868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        45⤵
        
        PID:4184
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        45⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        45⤵
        
        PID:1688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        45⤵
        Views/modifies file attributes
        
        PID:3096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        45⤵
        
        PID:3388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        45⤵
        
        PID:5096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        45⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        45⤵
        
        PID:2468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        45⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        45⤵
        
        PID:3856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        45⤵
        
        PID:4764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        45⤵
        
        PID:4648
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        45⤵
        
        PID:692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        45⤵
        
        PID:4168
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        45⤵
        
        PID:3300
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        45⤵
        
        PID:4608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        45⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        45⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        45⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        45⤵
        Views/modifies file attributes
        
        PID:3856
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        45⤵
        
        PID:1760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        45⤵
        
        PID:820
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        45⤵
        Views/modifies file attributes
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        45⤵
        
        PID:2052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        45⤵
        Views/modifies file attributes
        
        PID:5096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        45⤵
        
        PID:2516
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        45⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        45⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        45⤵
        Views/modifies file attributes
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        45⤵
        
        PID:3768
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        45⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        45⤵
        
        PID:2468
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        45⤵
        
        PID:692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        45⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        45⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3768
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\203B.tmp\203C.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        46⤵
        Executes a command shell one-liner
        
        PID:3288
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        47⤵
        
        PID:2564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        47⤵
        
        PID:2920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        47⤵
        
        PID:1684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        47⤵
        
        PID:2832
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        47⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        47⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        47⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        47⤵
        
        PID:3300
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        47⤵
        
        PID:5096
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        47⤵
        Views/modifies file attributes
        
        PID:888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        47⤵
        
        PID:4688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        47⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        47⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        47⤵
        
        PID:4692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        47⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        47⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        47⤵
        
        PID:2084
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        47⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        47⤵
        
        PID:2920
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        47⤵
        
        PID:1284
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        47⤵
        
        PID:4688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        47⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        47⤵
        Views/modifies file attributes
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        47⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        47⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        47⤵
        
        PID:2908
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        47⤵
        
        PID:2564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        47⤵
        
        PID:3144
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        47⤵
        
        PID:888
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        47⤵
        
        PID:1684
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        47⤵
        
        PID:2492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        47⤵
        
        PID:4688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        47⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        47⤵
        
        PID:1120
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        47⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        47⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2516
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\347F.tmp\3480.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        48⤵
        Executes a command shell one-liner
        
        PID:4952
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        49⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        49⤵
        
        PID:4688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        49⤵
        Views/modifies file attributes
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        49⤵
        
        PID:1120
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        49⤵
        
        PID:2548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        49⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        49⤵
        
        PID:3456
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        49⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        49⤵
        
        PID:4688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        49⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        49⤵
        
        PID:4244
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        49⤵
        
        PID:4512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        49⤵
        
        PID:2564
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        49⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        49⤵
        Views/modifies file attributes
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        49⤵
        
        PID:2348
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        49⤵
        
        PID:5040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        49⤵
        Views/modifies file attributes
        
        PID:688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        49⤵
        
        PID:3300
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        49⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        49⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        49⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        49⤵
        Views/modifies file attributes
        
        PID:4608
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        49⤵
        
        PID:4692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        49⤵
        
        PID:2548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        49⤵
        
        PID:3300
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        49⤵
        Views/modifies file attributes
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        49⤵
        
        PID:4612
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        49⤵
        
        PID:1928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10807.exe"
        49⤵
        
        PID:5040
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        49⤵
        
        PID:688
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        49⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        49⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        49⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        49⤵
        
        PID:4612
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        49⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        49⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4AC6.tmp\4AC7.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        50⤵
        Executes a command shell one-liner
        
        PID:5080
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        51⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        51⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        51⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        51⤵
        
        PID:548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        51⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        51⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        51⤵
        
        PID:3696
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        51⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        51⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        51⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        51⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        51⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        51⤵
        Views/modifies file attributes
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        51⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        51⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        51⤵
        
        PID:3260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        51⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        51⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        51⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        51⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        51⤵
        
        PID:3260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        51⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        51⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        51⤵
        
        PID:548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        51⤵
        
        PID:4412
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        51⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        51⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        51⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        51⤵
        
        PID:548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10807.exe"
        51⤵
        
        PID:5060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10823.exe"
        51⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        51⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        51⤵
        
        PID:4464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        51⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        51⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        51⤵
        
        PID:4412
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        51⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        51⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4080
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\688F.tmp\6890.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        52⤵
        Executes a command shell one-liner
        
        PID:3980
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        53⤵
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        53⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        53⤵
        
        PID:4028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        53⤵
        
        PID:3520
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        53⤵
        
        PID:4548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        53⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        53⤵
        
        PID:3260
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        53⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        53⤵
        
        PID:1592
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        53⤵
        
        PID:3732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        53⤵
        
        PID:4548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        53⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        53⤵
        
        PID:3224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        53⤵
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        53⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        53⤵
        
        PID:4836
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        53⤵
        
        PID:4548
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        53⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        53⤵
        
        PID:3224
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        53⤵
        Views/modifies file attributes
        
        PID:844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        53⤵
        
        PID:3312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        53⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        53⤵
        Views/modifies file attributes
        
        PID:4368
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        53⤵
        
        PID:4344
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        53⤵
        
        PID:4028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        53⤵
        
        PID:3732
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        53⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        53⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        53⤵
        
        PID:4872
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10807.exe"
        53⤵
        
        PID:2484
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10823.exe"
        53⤵
        
        PID:1592
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10843.exe"
        53⤵
        
        PID:4028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        53⤵
        
        PID:4992
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        53⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        53⤵
        
        PID:3796
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        53⤵
        
        PID:4120
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        53⤵
        
        PID:5052
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        53⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        53⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3404
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8212.tmp\8213.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        54⤵
        Executes a command shell one-liner
        
        PID:3312
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        55⤵
        Views/modifies file attributes
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        55⤵
        
        PID:1592
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        55⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        55⤵
        Views/modifies file attributes
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        55⤵
        Views/modifies file attributes
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        55⤵
        Views/modifies file attributes
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        55⤵
        Views/modifies file attributes
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        55⤵
        
        PID:2764
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10807.exe"
        55⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10823.exe"
        55⤵
        
        PID:760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10843.exe"
        55⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10869.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        55⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        55⤵
        
        PID:2308
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        55⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        55⤵
        
        PID:1020
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        55⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        55⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9D7A.tmp\9D7B.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        56⤵
        Executes a command shell one-liner
        
        PID:1984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        57⤵
        
        PID:536
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        57⤵
        
        PID:1828
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        57⤵
        
        PID:4256
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        57⤵
        
        PID:5000
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        57⤵
        
        PID:3928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        57⤵
        
        PID:4772
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        57⤵
        
        PID:1872
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        57⤵
        
        PID:4848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        57⤵
        
        PID:2112
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        57⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        57⤵
        
        PID:3904
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        57⤵
        Views/modifies file attributes
        
        PID:1028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        57⤵
        
        PID:672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        57⤵
        
        PID:3668
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        57⤵
        
        PID:3728
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        57⤵
        
        PID:448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        57⤵
        
        PID:3824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        57⤵
        
        PID:2144
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        57⤵
        
        PID:1056
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        57⤵
        
        PID:2984
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        57⤵
        
        PID:2628
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        57⤵
        
        PID:2692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        57⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        57⤵
        
        PID:4808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        57⤵
        
        PID:4388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        57⤵
        
        PID:3512
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        57⤵
        
        PID:1028
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        57⤵
        
        PID:672
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        57⤵
        
        PID:2508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10807.exe"
        57⤵
        
        PID:4868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10823.exe"
        57⤵
        
        PID:448
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10843.exe"
        57⤵
        
        PID:3824
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10869.exe"
        57⤵
        Views/modifies file attributes
        
        PID:4256
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10888.exe"
        57⤵
        
        PID:400
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        57⤵
        
        PID:464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        57⤵
        
        PID:812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        57⤵
        
        PID:760
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        57⤵
        
        PID:2500
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        57⤵
        
        PID:4808
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        57⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        
        C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
        57⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3824
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BA97.tmp\BA98.bat C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        58⤵
        Executes a command shell one-liner
        
        PID:848
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10464.exe"
        59⤵
        
        PID:2628
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe"
        59⤵
        
        PID:4112
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe"
        59⤵
        
        PID:1404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10477.exe.exe.exe"
        59⤵
        
        PID:1700
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe"
        59⤵
        
        PID:408
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe"
        59⤵
        
        PID:4388
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10484.exe.exe.exe"
        59⤵
        
        PID:2632
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe"
        59⤵
        
        PID:376
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe"
        59⤵
        
        PID:3152
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10497.exe.exe.exe"
        59⤵
        
        PID:4844
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe"
        59⤵
        
        PID:1524
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10523.exe.exe"
        59⤵
        
        PID:540
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe"
        59⤵
        
        PID:4060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10568.exe.exe"
        59⤵
        
        PID:4180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10630.exe"
        59⤵
        
        PID:404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10653.exe"
        59⤵
        
        PID:3496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10657.exe"
        59⤵
        
        PID:4868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10670.exe"
        59⤵
        
        PID:2164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10699.exe"
        59⤵
        
        PID:3928
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10706.exe"
        59⤵
        
        PID:2492
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10712.exe"
        59⤵
        
        PID:812
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10722.exe"
        59⤵
        
        PID:2692
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10732.exe"
        59⤵
        
        PID:4004
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10742.exe"
        59⤵
        
        PID:2804
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10751.exe"
        59⤵
        
        PID:3048
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10764.exe"
        59⤵
        Views/modifies file attributes
        
        PID:4432
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10771.exe"
        59⤵
        
        PID:4076
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10784.exe"
        59⤵
        
        PID:4160
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10794.exe"
        59⤵
        
        PID:3904
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10807.exe"
        59⤵
        
        PID:964
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10823.exe"
        59⤵
        Views/modifies file attributes
        
        PID:4508
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10843.exe"
        59⤵
        
        PID:1400
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10869.exe"
        59⤵
        
        PID:4060
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10888.exe"
        59⤵
        
        PID:4180
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "10911.exe"
        59⤵
        
        PID:404
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe"
        59⤵
        
        PID:3496
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe"
        59⤵
        
        PID:4868
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe"
        59⤵
        
        PID:2164
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe"
        59⤵
        
        PID:1780
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe"
        59⤵
        
        PID:464
        
        C:\Windows\system32\attrib.exe
        
        attrib -r -a -s -h -i "2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe"
        59⤵
        
        PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10464.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\10464.exe.exe
Size 7.2MB
SHA256 56be4d3b730e2a37839fc04dd3dcc738e5f9e0990c8c07bd89967d5f313737e5
MD5 a9adc7e1a3745d93b2f5b787ed4954ed
SHA1 340832f2dffc253b4da7431fe848bf3afa224fe8
SHA512 320a905d018508c3f4eefee595d6af3a4061572d9a58bd92929b5a8f656734ea2f3901222beaf18b3e796bcf25faf669dfcbb7ea2504f437a211e1161a527983
SSDEEP 196608:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKT:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYw
TLSH
T12F76AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10477.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\10477.exe.exe
Size 7.9MB
SHA256 07cde7149345063bd0114a2230e7f3b100bdeb220d01f53ecd8a9f30294b0e5b
MD5 4ae2d9fb3bd96bea88dd9b9cca94f36d
SHA1 4f9a2dd68cdd4269794ce502d612c6a2b9838c1d
SHA512 c5039903cb201100db7147df2f6d0eebfb3f1b016694fa343c56e47a182ce917a5232755ccda6135453151b69e5d3b13677deafb1e3d87db20e3cbfdbd2a6a65
SSDEEP 196608:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKKKKy:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYN
TLSH
T1C586AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10477.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\10477.exe.exe
Size 192KB
SHA256 ad42a233ea60db53cbc53d3554b7ebf0bbbf6a69f3b56698b58528f9a1469195
MD5 ab3166e3621fa1660569c7ef8b2b6936
SHA1 7e3e8608a0735e91a3a33131eb0b3a26d5e4d7e4
SHA512 e64a3292543127f5980f58dda32eef3df697fb9a0ae6ce3c1deb2ff6aeb6fe1bfb3b023bfcc01d3c381773ca839caa103b93a8ebbbb5392282e4f36c93e94da4
SSDEEP 3072:BvVMC8HVcrhghUOca0UDrwezuJD0Ez00PoyHPCtLcdcBmvM0Q+:Bv2HVcr62/bUDrwdJ/z00Xv2pBcJ5
TLSH
T1AF14AE07B2D286B2C1914671C6A16AF6E7719F39C7125FD7930C7E06BEB02E0CDB119A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe

Path C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe
Size 6.7MB
SHA256 2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82
MD5 4f9f0ee819d04528dde2398607fa8bd7
SHA1 5ad548b47883bc9c8685d68a3dac85f148c14c2c
SHA512 107560004b3a8384f947a990c391ea3cf9d5439f4e18dd207f0286b88dc79e207fb48d9a3ff01bf44be20f13855a36c35b558e868cd10f6a69c8659c567ad2a8
SSDEEP 49152:Ew9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
TLSH
T14B66AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe
Size 13.4MB
SHA256 a25942496b2382f40d3d888269e8aa5b8bd89434358a9a1d822b5ebead073e8f
MD5 f0b48ea753ae24e5eeb6329a58ec8398
SHA1 c6a8376d2d533062687828e3bba724ac6c420e45
SHA512 8915745c3afa21c1654c1fc48a0b154ab593954d853c844a629d90fe1c2f25ad1bf6c4c66e9e0da9831b67a81ffed20b6561f52260a4b64955c937a62d0d476f
SSDEEP 393216:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKKKKKKKKKKKKKKKKKKKKKKKKKKKK:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYK
TLSH
T19FE6AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe
Size 20.2MB
SHA256 6e88ef99df867d29724a90ed1ab974ff6768b6c42292381a519a2eda7d46d648
MD5 49b2457d525fdafe2d23239197abd6c2
SHA1 d361ef16d40df056550754b2e3bf7b6dfd40ccf4
SHA512 a1d77b78f28387ba0804bfaa3804fabe05aa524d939638a59f378104171bb9fe9c622d71b3403ab879c1f86e447646ef76d7915cae211db2959af3e1f358d77c
SSDEEP 393216:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKK:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYU
TLSH
T18327AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe
Size 26.9MB
SHA256 23bef962f518eb8c433b77b7bfebbcf56351f3b6710fd42510672776d2a49e28
MD5 440682b23abc92d52d791837e30ef085
SHA1 93b3f44a1823c6114154a6c6bcb891d3480e7c35
SHA512 53c5ac811ba4fdd6e231febb01c73dbcf8d070f5c445a994a6b983cdbef334d997b1263b818c38a41b0b0413063d94de3c157a3692b69c94801ce8be8a0f50fb
SSDEEP 786432:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKU:
TLSH
T14557AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe
Size 33.6MB
SHA256 0ecea40ec393bce03e81d2649b2e3c3d015b1f727b807ed84f5ce42b9a40e77e
MD5 4b49dafdcd8a62e3a0764b97775d27de
SHA1 5887035db8703db033c17e437201d46c51237bf2
SHA512 26aebee8cb5bfd64b780c38af03805c39b7493f27b9884dc3d9eadd47436d40ef6f2447d778069dccade9358ecec7ccb0fdd749087f11ae21a2b7b1d0b43e8bf
SSDEEP 786432:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKG:
TLSH
T11777AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82.exe.exe.exe.exe.exe.exe
Size 40.3MB
SHA256 339ffe45f04af21d43b9e6f502321d4a1edff4631b076fc0562ed98e864a170f
MD5 1b68b9b3daa2f0b3656f6345f8e332b3
SHA1 9a86700a990f3f4dd37a1ebed577b38de1c88022
SHA512 94f4720f8ab3265a5b44d19a7ac8738aae49e90e51a637c553b856b483a286ef1d1c3e6317126a3858ee98115a7e8aba80a18bb4d85d386339e49d5878427869
SSDEEP 786432:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKKKKKKKKKKKKKKKKKKKKKKKKKKKKYKKw:
TLSH
T12197AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81FD.bat

Path C:\Users\Admin\AppData\Local\Temp\81FC.tmp\81FD.bat
Size 214B
SHA256 d89dd0f34fd2e1ede30f1219b605679c41b951d96317663a6600d9f9acdcd342
MD5 4e62fb3abdc457c7bc1a243f9460e7c3
SHA1 041214e9a4026add8a0c331651af489f10f863a9
SHA512 6f5789f2c145adadddb1ffafe26def963998075f678b22424eaa67a7b1a522742a9b4d392ce8720ece04ccee421bcb4347c398b75440aff4253518c4c04df5cf
TLSH
T144D0C98EBAC2157626833D55C5865C4335CF209F5E520EC37424C1EA2481CBC438FAAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3192-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download

memory/3192-68-0x0000000000412000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads