If so, it stops the execution and deletes the folder containing the malicious script from this machine. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\railways.ir\sysvol\railways.ir\scripts\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. It moves wiper-related files to “C:\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00