Technical Information
- '%WINDIR%\syswow64\taskkill.exe' /f /im taskger.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im GthUdTask.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im taskmgzr.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im BthUdTask.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SvidaPctb.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im taskmgr.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im System.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im WavesSys.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im wscript.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTSWA.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTSWB.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTSWC.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTN.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENAC.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTC.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTA.exe
- ClassName: '' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskger.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTN.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTA.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\sqlagentc.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGEATC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGEATC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGEATC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskger.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskmgzr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskmgzr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskmgzr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\vget.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\vget.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im GthUdTask.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft GthUdTask\GthUdTask.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Corporati Assemblies GthUdTask"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im BthUdTask.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft BthUdTask\BthUdTask.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskger.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Corporati Assemblies BthUdTask"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft SvidaPctb\SvidaPctb.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im WavesSys.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Corporati Assemblies WavesSys"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im System.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft StuSystem\System.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskmgr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wscript.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWA.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWB.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SvidaPctb.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGEATN.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGEATA.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskger.exe
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\sqlagentc.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTC.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTN.exe
- '%WINDIR%\syswow64\cacls.exe' C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTA.exe
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGEATC.exe
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft StuSystem\System.exe
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGEATC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGEATC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\sqlagentc.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAC.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskger.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskmgzr.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskmgzr.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskmgzr.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\vget.vbs
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\vget.vbs
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im GthUdTask.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft GthUdTask\GthUdTask.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft GthUdTask\GthUdTask.exe
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Corporati Assemblies GthUdTask"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im BthUdTask.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft BthUdTask\BthUdTask.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft BthUdTask\BthUdTask.exe
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Corporati Assemblies BthUdTask"
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskger.exe
- '%WINDIR%\syswow64\sc.exe' delete "Corporati Assemblies GthUdTask"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWC.exe
- '%WINDIR%\syswow64\sc.exe' delete "Corporati Assemblies BthUdTask"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SvidaPctb.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles%\Microsoft SvidaPctb\SvidaPctb.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft SvidaPctb\SvidaPctb.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im WavesSys.exe
- '%WINDIR%\syswow64\cmd.exe' /c sc delete "Corporati Assemblies WavesSys"
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGEATC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im System.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGEATN.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskmgr.exe
- '%WINDIR%\syswow64\sc.exe' delete "Corporati Assemblies WavesSys"
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wscript.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWA.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWB.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %ProgramFiles(x86)%\Microsoft StuSystem\System.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGEATA.exe