Technical Information
- '%WINDIR%\syswow64\taskkill.exe' /f /im taskger.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im taskmgzr.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im wscript.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTSWA.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTC.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTN.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTSWB.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENAN.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENTA.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENAC.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im SQLAGENAA.exe
- <Current directory>update2.bat
- <Current directory>update2.bat
- %WINDIR%\temp\adobearm.log
- %WINDIR%\temp\dmi8538.tmp
- %WINDIR%\temp\fxsapidebuglogfile.txt
- %WINDIR%\temp\fxstiffdebuglogfile.txt
- %WINDIR%\temp\ts_267a.tmp
- %WINDIR%\temp\ts_2b0f.tmp
- %WINDIR%\temp\ts_2bfb.tmp
- %WINDIR%\temp\ts_316a.tmp
- %WINDIR%\temp\ts_361e.tmp
- %WINDIR%\temp\ts_3852.tmp
- %WINDIR%\temp\ts_39ba.tmp
- %WINDIR%\temp\ts_4f66.tmp
- %WINDIR%\temp\ts_5080.tmp
- %WINDIR%\temp\ts_77d1.tmp
- %WINDIR%\temp\ts_8e67.tmp
- ClassName: '' WindowName: ''
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskger.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGENAC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGENAC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>Update2.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAN.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAA.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %WINDIR%\Temp\*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGENAC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\temp\*' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskger.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskger.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskmgzr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskmgzr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskmgzr.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\vget.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\vget.vbs' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wscript.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGENAC.exe /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWA.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWB.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTN.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTA.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 1.1.1.1 -n 1 -w 1000 & start %TEMP%\SQLAGENTSWC.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskger.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAN.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAA.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\Users\MSSQLSERVER\AppData\Local\Temp\*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\Users\MSSQL~1\AppData\Local\Temp\*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %WINDIR%\Temp\*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\*
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\Users\Administrator\AppData\Local\Temp\*
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>Update2.bat
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\Administrator\AppData\Local\Temp\2\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTN.exe
- '%WINDIR%\syswow64\cacls.exe' C:\Users\Administrator\AppData\Local\Temp\2\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\Administrator\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\Administrator\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\Administrator\AppData\Local\Temp\1\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\Administrator\AppData\Local\Temp\1\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cacls.exe' C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGENAC.exe /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENAC.exe
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\2\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\1\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskger.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im taskmgzr.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskmgzr.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\taskmgzr.exe
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\vget.vbs
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q C:\RECYCLER\vget.vbs
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\temp\*
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im wscript.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWA.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTSWB.exe
- '%WINDIR%\syswow64\cmd.exe' /c ping 1.1.1.1 -n 1 -w 1000 & start %TEMP%\SQLAGENTSWC.exe
- '%WINDIR%\syswow64\cacls.exe' %WINDIR%\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTC.exe
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQL~1\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGENAC.exe /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\MSSQLSERVER\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls %WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGENAC.exe /e /t /g system:f
- '%WINDIR%\syswow64\cmd.exe' /c cacls C:\Users\Administrator\AppData\Local\Temp\SQLAGENAC.exe /e /t /g everyone:f
- '%WINDIR%\syswow64\cmd.exe' /c del /f /a /q %PROGRAMDATA%\taskger.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im SQLAGENTA.exe
- '%WINDIR%\syswow64\ping.exe' 1.1.1.1 -n 1 -w 1000